Which of the following is the BEST course of action when confidential information is inadvertently disseminated outside the organization?

Review compliance requirements.

Management would like to understand the risk associated with engaging an Infrastructure-as-a-Service (laaS) provider compared to hosting internally. Which of the following would provide the BEST method of comparing risk scenarios?

Mapping the risk scenarios by likelihood and impact on a chart

Mapping risk scenarios according to sensitivity of data

Reviewing mitigating and compensating controls for each risk scenario

Mapping the risk scenarios by likelihood and impact on a chart

Performing a risk assessment on the laaS provider

A PRIMARY benefit of adopting an information security framework is that it provides:

standardized security controls.

credible emerging threat intelligence.

security and vulnerability reporting guidelines.

standardized security controls.

Which of the following should be the GREATEST concern for an information security manager when an annual audit reveals the organization's business continuity plan (BCP) has not been reviewed or updated in more than a year?

An outdated BCP may result in less efficient recovery if an actual incident occurs.

The organization may suffer reputational damage for not following industry best practices.

The audit finding may impact the overall risk rating of the organization.

The lack of updates to the BCP may result in noncompliance with internal policies.

Which of the following is the MOST appropriate metric to demonstrate the effectiveness of information security controls to senior management?

Annualized loss resulting from security incidents

Downtime due to malware infections

Number of security vulnerabilities uncovered with network scans

Annualized loss resulting from security incidents

An organization provides notebook PCs, cable wire locks, smartphone access, and virtual private network (VPN) access to its remote employees. Which of the following is MOST important for the information security manager to ensure?

Employees use the VPN when accessing the organization's online resources.

Employees use smartphone tethering when accessing from remote locations.

Employees physically lock PCs when leaving the immediate area.

Employees are trained on the acceptable use policy.

Employees use the VPN when accessing the organization's online resources.

Which of the following is the MOST important function of an information security steering committee?

Obtaining multiple perspectives from the business

Assigning data classifications to organizational assets

Developing organizational risk assessment processes

Obtaining multiple perspectives from the business

Defining security standards for logical access controls

An employee clicked on a malicious link in an email that resulted in compromising company data. What is the BEST way to mitigate this risk in the future?

Conduct phishing awareness training.

Implement disciplinary procedures.

Establish an acceptable use policy.

Assess and update spam filtering rules.

Which of the following is the PRIMARY purpose of a business impact analysis (BIA)?

To determine the criticality of information assets

To define security roles and responsibilities

To determine return on investment (ROI)

To establish incident severity levels

To determine the criticality of information assets

Which of the following is the MOST effective way to ensure information security policies are understood?

Provide regular security awareness training.

Implement a whistle-blower program.

Provide regular security awareness training.

Include security responsibilities in job descriptions.

An organization has remediated a security flaw in a system. Which of the following should be done NEXT?

Share lessons learned with the organization.

Update the system's documentation.

Allocate budget for penetration testing.

Which is MOST important to identify when developing an effective information security strategy?

Security awareness training needs

Potential savings resulting from security governance

A security incident has been reported within an organization. When should an information security manager contact the information owner?

After the incident has been confirmed

After the incident has been contained

After the incident has been mitigated

After the incident has been confirmed

After the potential incident has been logged

An organization recently updated and published its information security policy and standards. What should the information security manager do NEXT?

Communicate the changes to stakeholders.

Update the organization's risk register.

Develop a policy exception process.

Which of the following would BEST help to ensure compliance with an organization's information security requirements by an IT service provider?

Requiring regular reporting from the IT service provider

Requiring an external security audit of the IT service provider

Requiring regular reporting from the IT service provider

Defining information security requirements with internal IT

Defining the business recovery plan with the IT service provider

Which of the following is the BEST indicator of the maturity level of a vendor risk management process?

Percentage of vendors that are regularly reviewed against defined criteria

Average time required to complete the vendor risk management process

Percentage of vendors that have gone through the vendor onboarding process

Percentage of vendors that are regularly reviewed against defined criteria

Number of vendors rejected because of security review results

Which of the following should be the PRIMARY focus of a status report on the information security program to senior management?

Demonstrating risk is managed at the desired level

Providing evidence that resources are performing as expected

Verifying security costs do not exceed the budget

Demonstrating risk is managed at the desired level

Confirming the organization complies with security policies

Which of the following is the BEST indication that an organization has integrated information security governance with corporate governance?

Security performance metrics are measured against business objectives.

Impact is measured according to business loss when assessing IT risk.

Security policies are reviewed whenever business objectives are changed.

Service levels for security vendors are defined according to business needs.

Which of the following would BEST demonstrate the status of an organization's information security program to the board of directors?

Information security program metrics

Results of a recent external audit

The information security operations matrix

Changes to information security risks

When testing an incident response plan for recovery from a ransomware attack, which of the following is MOST important to verify?

Data backups are recoverable from an offsite location.

Digital currency is immediately available.

Network access requires two-factor authentication.

Data backups are recoverable from an offsite location.

An alternative network link is immediately available.

Which of the following elements of a service contract would BEST enable an organization to monitor the information security risk associated with a cloud service provider?

Breach detection and notification

Physical access to service provider premises

The PRIMARY purpose for continuous monitoring of security controls is to ensure:

alignment with compliance requirements.

Which of the following is the MOST effective way to ensure the security of services and solutions delivered by third-party vendors?

Integrate risk management into the vendor management process.

Conduct security reviews on the services and solutions delivered.

Review third-party contracts as part of the vendor management process.

Perform an audit on vendors' security controls and practices.

While conducting a test of a business continuity plan (BCP), which of the following is the MOST important consideration?

The test addresses the critical components.

The test is scheduled to reduce operational impact.

The test involves IT members in the test process.

The test addresses the critical components.

The test simulates actual prime-time processing conditions.

An organization is considering the feasibility of implementing a big data solution to analyze customer data. In order to support this initiative, the information security manager should FIRST:

assess potential information security risk to the organization.

inventory sensitive customer data to be processed by the solution.

determine information security resource and budget requirements.

assess potential information security risk to the organization.

develop information security requirements for the big data solution.

Which of the following is MOST important to consider when choosing a shared alternate location for computing facilities?

The organization's risk tolerance

Incident response team training

Prior to implementing a bring your own device (BYOD) program, it is MOST important to:

develop an acceptable use policy.

select mobile device management (MDM) software.

survey employees for requested applications.

develop an acceptable use policy.

review currently utilized applications.

Internal audit has reported a number of information security issues that are not in compliance with regulatory requirements. What should the information security manager do FIRST?

Assess the risk to business operations.

Perform a gap analysis to determine needed resources.

Perform a vulnerability assessment.

Assess the risk to business operations.

Which of the following is MOST important to the successful implementation of an information security program?

Adequate security resources are allocated to the program.

Key performance indicators (KPIs) are defined.

A balanced scorecard is approved by the steering committee.

The program is developed using global security standards.

Which of the following is MOST important to consider when defining control objectives?

The organization's risk appetite

An information security framework

Control recommendations from a recent audit

The organization's risk appetite

Which of the following should be an information security manager's FIRST course of action when one of the organization's critical third-party providers experiences a data breach?

Invoke the incident response plan.

Inform the public relations officer.

Inform customers of the breach.

Invoke the incident response plan.

Monitor the third party's response.

Isaca CISM Practice Test 14 - Free Online Exam Prep & Questions

Which of the following should be the FIRST step in patch management procedures when receiving an emergency security patch?

Become a Premium Member for full access

Unlock Premium Member

Isaca CISM Practice Test 14

Question

Isaca CISM Practice Tests

Practice Tests