Which of the following should be the PRIMARY objective when establishing a new information security program?

Executing the security strategy

Facilitating operational security

Which of the following is the MOST essential element of an information security program?

Involving functional managers in program development

Benchmarking the program with global standards for relevance

Prioritizing program deliverables based on available resources

Involving functional managers in program development

Applying project management practices used by the business

Which of the following has the MOST influence on the information security investment process?

Security key performance indicators (KPIs)

An external security audit has reported multiple instances of control noncompliance. Which of the following is MOST important for the information security manager to communicate to senior management?

The impact of noncompliance on the organization's risk profile

Control owner responses based on a root cause analysis

The impact of noncompliance on the organization's risk profile

A noncompliance report to initiate remediation activities

A business case for transferring the risk

Which of the following is the BEST way to obtain organization-wide support for an information security program?

Position security as a business enabler.

Mandate regular security awareness training.

Develop security performance metrics.

Position security as a business enabler.

Prioritize security initiatives based on IT strategy.

Which of the following BEST facilitates the development of a comprehensive information security policy?

Alignment with an established information security framework

An established internal audit program

Security key performance indicators (KPIs)

Areview of recent information security incidents

Company A, a cloud service provider, is in the process of acquiring Company B to gain new benefits by incorporating their technologies within its cloud services.Which of the following should be the PRIMARY focus of Company A's information security manager?

Company A's security architecture

The cost to align to Company A's security policies

Company A's security architecture

The organizational structure of Company B

Which of the following is the BEST way to ensure data is not co-mingled or exposed when using a cloud service provider?

Require the provider to follow stringent data classification procedures.

Obtain an independent audit report.

Require the provider to follow stringent data classification procedures.

Include high penalties for security breaches in the contract.

Review the provider's information security policies.

An organization involved in e-commerce activities operating from its home country opened a new office in another country with stringent security laws. In this scenario, the overall security strategy should be based on:

the most stringent requirements.

the security organization structure.

international security standards.

the most stringent requirements.

Which of the following would be of GREATEST assistance in determining whether to accept residual risk of a critical security system?

Cost-benefit analysis of mitigating controls

Which of the following is the BEST control to protect customer personal information that is stored in the cloud?

Timely deletion of digital records

Strong physical access controls

An organization is experiencing a sharp increase in incidents related to phishing messages. The root cause is an outdated email filtering system that is no longer supported by the vendor. Which of the following should be the information security manager's FIRST course of action?

Develop a business case to replace the system.

Reinforce security awareness practices for end users.

Temporarily outsource the email system to a cloud provider.

Develop a business case to replace the system.

Monitor outgoing traffic on the firewall.

Which of the following should an information security manager do FIRST to address the risk associated with a new third-party cloud application that will not meet organizational security requirements?

Consult with the business owner.

Include security requirements in the contract.

Consult with the business owner.

Restrict application network access temporarily.

Which of the following is the PRIMARY purpose of an acceptable use policy?

To protect the organization from misuse of information assets

To provide steps for carrying out security-related procedures

To facilitate enforcement of security process workflows

To protect the organization from misuse of information assets

To provide minimum security baselines for information assets

Which of the following metrics BEST demonstrates the effectiveness of an organization's security awareness program?

Percentage of employees who regularly attend security training

Number of security incidents reported to the help desk

Percentage of employees who regularly attend security training

Percentage of employee computers and devices infected with malware

Number of phishing emails viewed by end users

Which of the following BEST helps to enable the desired information security culture within an organization?

Information security awareness training and campaigns

Effective information security policies and procedures

Delegation of information security roles and responsibilities

Incentives for appropriate information security-related behavior

Which of the following is MOST appropriate to communicate to senior management regarding information risk?

Vulnerability scanning progress

Which of the following is the BEST way to determine the gap between the present and desired state of an information security program?

Conduct a capability maturity model evaluation.

Perform a risk analysis for critical applications.

Determine whether critical success factors (CSFs) have been defined.

Conduct a capability maturity model evaluation.

Review and update current operational procedures.

Which of the following should be the FIRST step when performing triage of a malware incident?

Comparing backup against production

An information security manager has become aware that a third-party provider is not in compliance with the statement of work (SOW). Which of the following is the BEST course of action?

Assess the extent of the issue.

Notify senior management of the issue.

Report the issue to legal personnel.

Initiate contract renegotiation.

Assess the extent of the issue.

A newly appointed information security manager has been asked to update all security-related policies and procedures that have been static for five years or more. What should be done NEXT?

Inventory and review current security policies.

Gain an understanding of the current business direction.

Perform a risk assessment of the current IT environment.

Inventory and review current security policies.

Update in accordance with the best business practices.

Which of the following is the PRIMARY responsibility of the information security function when an organization adopts emerging technologies?

Assessing the potential security risk

Developing security training for the new technologies

Designing new security controls

Creating an acceptable use policy for the technologies

Assessing the potential security risk

An organization is planning to outsource network management to a service provider. Including which of the following in the contract would be the MOST effective way to mitigate information security risk?

Requirement to comply with corporate security policy

Requirement for regular information security awareness

Requirement to comply with corporate security policy

Which of the following is the MOST effective way to convey information security responsibilities across an organization?

Documenting information security responsibilities within job descriptions

Implementing security awareness programs

Documenting information security responsibilities within job descriptions

Defining information security responsibilities in the security policy

An organization wants to integrate information security into its HR management processes. Which of the following should be the FIRST step?

Assess the business objectives of the processes.

Benchmark the processes with best practice to identify gaps.

Calculate the return on investment (ROI).

Provide security awareness training to HR.

Assess the business objectives of the processes.

An organization's automated security monitoring tool generates an excessively large amount of falsq positives. Which of the following is the BEST method to optimize the monitoring process?

Monitor incidents in a specific time frame.

A project team member notifies the information security manager of a potential security risk that has not been included in the risk register. Which of the following should the information security manager do FIRST?

Add the risk to the risk register.

Implement compensating controls.

Prepare a risk mitigation plan.

Add the risk to the risk register.

An organization implemented a number of technical and administrative controls to mitigate risk associated with ransomware. Which of the following is MOST important to present to senior management when reporting on the performance of this initiative?

The cost and associated risk reduction

The total cost of the investment

The cost and associated risk reduction

The number and severity of ransomware incidents

Benchmarks of industry peers impacted by ransomware

An organization has implemented a new customer relationship management (CRM) system. Who should be responsible for enforcing authorized and controlled access to the CRM data?

The information security manager

Which of the following should be an information security manager's FIRST course of action when one of the organization's critical third-party providers experiences a data breach?

Invoke the incident response plan.

Inform the public relations officer.

Monitor the third party's response.

Invoke the incident response plan.

Inform customers of the breach.

A new application has entered the production environment with deficient technical security controls. Which of the following is MOST Likely the root cause?

Inadequate incident response controls

Which of the following is MOST important to consider when choosing a shared alternate location for computing facilities?

The organization's risk tolerance

Incident response team training

An international organization with remote branches is implementing a corporate security policy for managing personally identifiable information (PII). Which of the following should be the information security manager's MAIN concern?

Consistency in awareness programs

Organizational reporting structure

Isaca CISM Practice Test 16 - Free Online Exam Prep & Questions

Communicating which of the following would be MOST helpful to gain senior management support for risk treatment options?

Become a Premium Member for full access

Unlock Premium Member

Isaca CISM Practice Test 16

Question

Isaca CISM Practice Tests

Practice Tests