During the selection of a Software as a Service (SaaS) vendor for a business process, the vendor provides evidence of a globally accepted information security certification. Which of the following is the MOST important consideration?

The certification is issued for the specific scope.

The certification includes industry-recognized security controls.

The certification was issued within the last five years.

The certification is issued for the specific scope.

The certification is easily verified.

An information security manager notes that security incidents are not being appropriately escalated by the help desk after tickets are logged. Which of the following is the BEST automated control to resolve this issue?

Integrating incident response workflow into the help desk ticketing system

Implementing automated vulnerability scanning in the help desk workflow

Changing the default setting for all security incidents to the highest priority

Integrating automated service level agreement (SLA) reporting into the help desk ticketing system

Integrating incident response workflow into the help desk ticketing system

When developing an incident escalation process, the BEST approach is to classify incidents based on:

recovery point objectives (RPOs).

Of the following, who is BEST positioned to be accountable for risk acceptance decisions based on risk appetite?

Information security steering committee

Which of the following should an information security manager do FIRST when there is a conflict between the organization's information security policy and a local regulation?

Enforce the organization's information security policy.

Obtain an independent assessment of the regulation.

Which of the following should an information security manager do FIRST to address the risk associated with a new third-party cloud application that will not meet organizational security requirements?

Consult with the business owner.

Restrict application network access temporarily.

Include security requirements in the contract.

An organization has implemented a new customer relationship management (CRM) system. Who should be responsible for enforcing authorized and controlled access to the CRM data?

The information security manager

Which of the following is the PRIMARY reason to regularly update business continuity and disaster recovery documents?

To ensure the availability of business operations

To enforce security policy requirements

To maintain business asset inventories

To ensure audit and compliance requirements are met

To ensure the availability of business operations

The PRIMARY reason for creating a business case when proposing an information security project is to:

establish the value of the project in relation to business objectives.

provide demonstrated return on investment (ROI).

establish the value of the project in relation to business objectives.

gain key business stakeholder engagement.

Which of the following BEST helps to ensure the effective execution of an organization's disaster recovery plan (DRP)?

Procedures are available at the primary and failover location.

The plan is reviewed by senior and IT operational management.

The plan is based on industry best practices.

Process steps are documented by the disaster recovery team.

Procedures are available at the primary and failover location.

The ULTIMATE responsibility for ensuring the objectives of an information security framework are being met belongs to:

)the information security officer.

A newly appointed information security manager has been asked to update all security-related policies and procedures that have been static for five years or more. What should be done NEXT?

Inventory and review current security policies.

Update in accordance with the best business practices.

Perform a risk assessment of the current IT environment.

Gain an understanding of the current business direction.

Inventory and review current security policies.

A small organization has a contract with a multinational cloud computing vendor. Which of the following would present the GREATEST concern to an information security manager if omitted from the contract?

Authority of the subscriber to approve access to its data

Right of the subscriber to conduct onsite audits of the vendor

Escrow of software code with conditions for code release

Authority of the subscriber to approve access to its data

Commingling of subscribers' data on the same physical server

Which of the following is MOST appropriate to communicate to senior management regarding information risk?

Vulnerability scanning progress

Which of the following is MOST important when designing security controls for new cloud-based services?

Understanding the business and IT strategy for moving resources to the cloud

Evaluating different types of deployment models according to the associated risks

Understanding the business and IT strategy for moving resources to the cloud

Defining an incident response policy to protect data moving between onsite and cloud applications

Performing a business impact analysis (BIA) to gather information needed to develop recovery strategies

A KEY consideration in the use of quantitative risk analysis is that it:

assigns numeric values to exposures of information assets.

aligns with best practice for risk analysis of information assets.

assigns numeric values to exposures of information assets.

applies commonly used labels to information assets.

is based on criticality analysis of information assets.

An organization's information security team presented the risk register at a recent information security steering committee meeting. Which of the following should be of MOST concern to the committee?

No owners were identified for some risks.

Business applications had the highest number of risks.

Risk mitigation action plans had no timelines.

Risk mitigation action plan milestones were delayed.

After the occurrence of a major information security incident, which of the following will BEST help an information security manager determine corrective actions?

Conducting a postmortem assessment

Calculating cost of the incident

Conducting a postmortem assessment

Before approving the implementation of a new security solution, senior management requires a business case. Which of the following would BEST support the justification for investment?

The solution contributes to business strategy.

The solution improves business risk tolerance levels.

The solution improves business resiliency.

The solution reduces the cost of noncompliance with regulations.

The PRIMARY objective of timely declaration of a disaster is to:

ensure the continuity of the organization's essential services.

ensure engagement of business management in the recovery process.

assess and correct disaster recovery process deficiencies.

protect critical physical assets from further loss.

ensure the continuity of the organization's essential services.

What should an information security manager verify FIRST when reviewing an information asset management program?

Information assets have been classified.

System owners have been identified.

Key applications have been secured.

Information assets have been classified.

Information assets have been inventoried.

Company A, a cloud service provider, is in the process of acquiring Company B to gain new benefits by incorporating their technologies within its cloud services.Which of the following should be the PRIMARY focus of Company A's information security manager?

The organizational structure of Company B

The cost to align to Company A's security policies

Company A's security architecture

An organization learns that a third party has outsourced critical functions to another external provider. Which of the following is the information security manager's MOST important course of action?

Evaluate the third party's agreements with its external provider.

Engage an independent audit of the third party's external provider.

Recommend canceling the contract with the third party.

Evaluate the third party's agreements with its external provider.

Conduct an external audit of the contracted third party.

During the due diligence phase of an acquisition, the MOST important course of action for an information security manager is to:

review the state of security awareness.

review information security policies.

Which of the following would be MOST useful when determining the business continuity strategy for a large organization's data center?

Business continuity risk analysis

An organization implemented a number of technical and administrative controls to mitigate risk associated with ransomware. Which of the following is MOST important to present to senior management when reporting on the performance of this initiative?

The cost and associated risk reduction

Benchmarks of industry peers impacted by ransomware

The number and severity of ransomware incidents

The total cost of the investment

Which of the following is MOST important to include in an information security status report to senior management?

Review of information security policies

Information security budget requests

Which of the following is the MOST important benefit of using a cloud access security broker when migrating to a cloud environment?

Increased third-party assurance

Reduced total cost of ownership (TCO)

An organization wants to integrate information security into its HR management processes. Which of the following should be the FIRST step?

Assess the business objectives of the processes.

Calculate the return on investment (ROI).

Provide security awareness training to HR.

Benchmark the processes with best practice to identify gaps.

Assess the business objectives of the processes.

Which of the following is the MOST effective defense against malicious insiders compromising confidential information?

Role-based access control (RBAC)

Regular audits of access controls

Strong background checks when hiring staff

Role-based access control (RBAC)

Isaca CISM Practice Test 15 - Free Online Exam Prep & Questions

Which of the following should be the PRIMARY basis for establishing metrics that measure the effectiveness of an information security program?

Become a Premium Member for full access

Unlock Premium Member

Isaca CISM Practice Test 15

Question

Isaca CISM Practice Tests

Practice Tests