Choosing the Right Path for Your CISM Exam Preparation
Welcome to PassExamHub's comprehensive study guide for the Certified Information Security Manager exam. Our CISM dumps is designed to equip you with the knowledge and resources you need to confidently prepare for and succeed in the CISM certification exam.
What Our Isaca CISM Study Material Offers
PassExamHub's CISM dumps PDF is carefully crafted to provide you with a comprehensive and effective learning experience. Our study material includes:
In-depth Content: Our study guide covers all the key concepts, topics, and skills you need to master for the CISM exam. Each topic is explained in a clear and concise manner, making it easy to understand even the most complex concepts.
Online Test Engine: Test your knowledge and build your confidence with a wide range of practice questions that simulate the actual exam format. Our test engine cover every exam objective and provide detailed explanations for both correct and incorrect answers.
Exam Strategies: Get valuable insights into exam-taking strategies, time management, and how to approach different types of questions.
Real-world Scenarios: Gain practical insights into applying your knowledge in real-world scenarios, ensuring you're well-prepared to tackle challenges in your professional career.
Why Choose PassExamHub?
Expertise: Our CISM exam questions answers are developed by experienced Isaca certified professionals who have a deep understanding of the exam objectives and industry best practices.
Comprehensive Coverage: We leave no stone unturned in covering every topic and skill that could appear on the CISM exam, ensuring you're fully prepared.
Engaging Learning: Our content is presented in a user-friendly and engaging format, making your study sessions enjoyable and effective.
Proven Success: Countless students have used our study materials to achieve their CISM certifications and advance their careers.
Start Your Journey Today!
Embark on your journey to Certified Information Security Manager success with PassExamHub. Our study material is your trusted companion in preparing for the CISM exam and unlocking exciting career opportunities.
Related Exams
Isaca CISM Sample Question Answers
Question # 1
Meeting which of the following security objectives BEST ensures that information isprotected against unauthorized disclosure?
A. Integrity B. Authenticity C. Confidentiality D. Nonrepudiation
Answer: C
Explanation: Confidentiality is the security objective that best ensures that information is
protected against unauthorized disclosure. Confidentiality means that only authorized
parties can access or view sensitive or classified information. Integrity means that
information is accurate and consistent and has not been tampered with or modified by
unauthorized parties. Authenticity means that information is genuine and trustworthy and
has not been forged or misrepresented by unauthorized parties. Nonrepudiation means
that information can be verified and proven to be sent or received by a specific party
An organization has identified a large volume of old data that appears to be unused. Which of the following should the information security manager do NEXT?
A. Consult the record retention policy. B. Update the awareness and training program. C. Implement media sanitization procedures. D. Consult the backup and recovery policy.
Answer: A
Explanation:
The next thing that the information security manager should do after identifying a large
volume of old data that appears to be unused is to consult the record retention policy. The
record retention policy is a document that defines the types, formats, and retention periods
of data that the organization needs to keep for legal, regulatory, operational, or historical
purposes. By consulting the record retention policy, the information security manager can
determine if the old data is still required to be stored, archived, or disposed of, and how to
do so in a secure and compliant manner.
References: The CISM Review Manual 2023 states that “the information security manager
is responsible for ensuring that the data lifecycle management process is in alignment with
the organization’s record retention policy” and that “the record retention policy defines the
types, formats, and retention periods of data that the organization needs to keep for legal,
regulatory, operational, or historical purposes” (p. 140). The CISM Review Questions,
Answers & Explanations Manual 2023 also provides the following rationale for this answer:
“Consult the record retention policy is the correct answer because it is the next logical step
to take after identifying a large volume of old data that appears to be unused, as it will help
the information security manager to decide on the appropriate data lifecycle management
actions for the old data, such as storage, archiving, or disposal” (p. 64). Additionally, the
article Data Retention Policy: What It Is and How to Create One from the ISACA Journal
2019 states that “a data retention policy is a document that outlines the types, formats, and
retention periods of data that an organization needs to keep for various purposes, such as
legal compliance, business operations, or historical records” and that “a data retention
policy can help an organization to manage its data lifecycle, optimize its storage capacity,
reduce its costs, and enhance its security and privacy” (p. 1)1.
Question # 5
Which of the following BEST helps to ensure the effective execution of an organization'sdisaster recovery plan (DRP)?
A. The plan is reviewed by senior and IT operational management. B. The plan is based on industry best practices. C. Process steps are documented by the disaster recovery team. D. Procedures are available at the primary and failover location.
Answer: D
Explanation:
The best way to ensure the effective execution of a disaster recovery plan (DRP) is to
make sure that the procedures are available at both the primary and the failover location,
so that the staff can access them in case of a disaster. The procedures should be clear,
concise, and updated regularly to reflect the current situation and requirements. Having the
procedures available at both locations also helps to avoid confusion and delays in the
and Disaster Recovery, Section: Disaster Recovery Planning, Subsection: Disaster
Recovery Plan Development, Page 373.
Question # 6
Which of the following should have the MOST influence on an organization's response to a ew industry regulation?
A. The organization's control objectives B. The organization's risk management framework C. The organization's risk appetite D. The organization's risk control baselines
Answer: C
Explanation:
The most influential factor on an organization’s response to a new industry regulation is the
organization’s risk appetite. This is because the risk appetite defines the level of risk that
the organization is willing to accept in pursuit of its objectives, and it guides the decisionmaking
process for managing risks. The risk appetite also determines the extent to which
the organization needs to comply with the new regulation, and the resources and actions
required to achieve compliance. The risk appetite should be aligned with the organization’s
strategy, culture, and values, and it should be communicated and monitored throughout the organization.
Question # 7
Which of the following roles is MOST appropriate to determine access rights for specificusers of an application?
A. Data owner B. Data custodian C. System administrator D. Senior management
Answer: A
Explanation: The data owner is the most appropriate role to determine access rights for
specific users of an application because they have legal rights and complete control over
data elements4. They are also responsible for approving data glossaries and definitions,
ensuring the accuracy of information, and supervising operations related to data quality5
. The data custodian is responsible for the safe custody, transport, and storage of the data
and implementation of business rules, but not for determining access rights4. The system
administrator is responsible for managing the security and storage infrastructure of data
sets according to the organization’s data governance policies, but not for determining
access rights5. Senior management is responsible for setting the strategic direction and
priorities for data governance, but not for determining access rights5. References: 5
The effectiveness of an incident response team will be GREATEST when:
A. the incident response team meets on a regular basis to review log files. B. the incident response team members are trained security personnel. C. the incident response process is updated based on lessons learned. D. incidents are identified using a security information and event monitoring {SIEM) system.
Answer: C
Question # 9
Which of the following metrics provides the BEST evidence of alignment of information security governance with corporate governance?
A. Average return on investment (ROI) associated with security initiatives B. Average number of security incidents across business units C. Mean time to resolution (MTTR) for enterprise-wide security incidents D. Number of vulnerabilities identified for high-risk information assets
Answer: A
Explanation: Average return on investment (ROI) associated with security initiatives is the
best metric to provide evidence of alignment of information security governance with
corporate governance because it demonstrates the value and benefits of security
investments to the organization’s strategic goals and objectives. Average number of
security incidents across business units is not a good metric because it does not measure
the effectiveness or efficiency of security initiatives or their alignment with corporate
governance. Mean time to resolution (MTTR) for enterprise-wide security incidents is not a
good metric because it does not measure the impact or outcome of security initiatives or
their alignment with corporate governance. Number of vulnerabilities identified for high-risk
information assets is not a good metric because it does not measure the performance or
improvement of security initiatives or their alignment with corporate governance.
A business impact analysis (BIA) should be periodically executed PRIMARILY to:
A. validate vulnerabilities on environmental changes. B. analyze the importance of assets. C. check compliance with regulations. D. verify the effectiveness of controls.
Answer: D
Explanation: A business impact analysis (BIA) is a process that helps identify and
evaluate the potential effects of disruptions or incidents on the organization’s mission,
objectives, and operations. A BIA should be periodically executed to verify the
effectiveness of the controls that are implemented to prevent, mitigate, or recover from
such disruptions or incidents12.
According to the CISM Manual, a BIA should be performed at least annually for critical
systems and processes, and more frequently for non-critical ones3. A BIA should also be
updated whenever there are significant changes in the organization’s environment, such as
new regulations, technologies, business models, or stakeholder expectations3. A BIA
should not be used to validate vulnerabilities on environmental changes (A), analyze the
(BIA) - YouTube 3: CISM ITEM DEVELOPMENT GUIDE - ISACA
Question # 11
To ensure that a new application complies with information security policy, the BESTapproach is to:
A. review the security of the application before implementation. B. integrate functionality the development stage. C. perform a vulnerability analysis. D. periodically audit the security of the application.
Answer: C
Explanation: Performing a vulnerability analysis is the best option to ensure that a new
application complies with information security policy because it helps to identify and
evaluate any security flaws or weaknesses in the application that may expose it to potential
threats or attacks, and provide recommendations or solutions to mitigate them. Reviewing
the security of the application before implementation is not a good option because it may
not detect or prevent all security issues that may arise after implementation or deployment.
Integrating security functionality at the development stage is not a good option because it
may not account for all security requirements or challenges of the application or its
environment. Periodically auditing the security of the application is not a good option
because it may not address any security issues that may occur between audits or after
Which of the following BEST enables the capability of an organization to sustain thedelivery of products and services within acceptable time frames and at predefined capacityduring a disruption?
A. Service level agreement (SLA) B. Business continuity plan (BCP) C. Disaster recovery plan (DRP) D. Business impact analysis (BIA)
Answer: B
Explanation: The best option to enable the capability of an organization to sustain the delivery of
products and services within acceptable time frames and at predefined capacity during a
disruption is B. Business continuity plan (BCP). This is because a BCP is a documented
collection of procedures and information that guides the organization to prepare for,
respond to, and recover from a disruption, such as a natural disaster, a cyberattack, or a
pandemic. A BCP aims to ensure the continuity of the critical business functions and
processes that support the delivery of products and services to the customers and
stakeholders. A BCP also defines the roles, responsibilities, resources, and actions
required to maintain the operational resilience of the organization in the face of a
An organization's information security team presented the risk register at a recentinformation security steering committee meeting. Which of the following should be of MOSTconcern to the committee?
A. No owners were identified for some risks. B. Business applications had the highest number of risks. C. Risk mitigation action plans had no timelines. D. Risk mitigation action plan milestones were delayed.
Answer: A
Explanation: The most concerning issue for the information security steering committee
should be that no owners were identified for some risks in the risk register. This means that
there is no clear accountability and responsibility for managing and mitigating those risks,
and that the risks may not be properly addressed or monitored. The risk owners are the
persons who have the authority and ability to implement the risk treatment options and to
accept the residual risk. The risk owners should be identified and assigned for each risk in
the risk register, and they should report the status and progress of the risk management
activities to the information security steering committee.
An organization is leveraging tablets to replace desktop computers shared by shift-basedstaff These tablets contain critical business data and are inherently at increased risk of theftWhich of the following will BEST help to mitigate this risk''
A. Deploy mobile device management (MDM) B. Implement remote wipe capability. C. Create an acceptable use policy. D. Conduct a mobile device risk assessment
Answer: D
Explanation: A key risk indicator (KRI) is a metric that provides an early warning of
potential exposure to a risk. A KRI should be relevant, measurable, timely, and actionable.
The most important factor in an organization’s selection of a KRI is the criticality of
information, which means that the KRI should reflect the value and sensitivity of the
information assets that are exposed to the risk. For example, a KRI for data breach risk
could be the number of unauthorized access attempts to a database that contains
confidential customer data. The criticality of information helps to prioritize the risks and
Which of the following should be the FIRST step in developing an information security strategy?
A. Perform a gap analysis based on the current state B. Create a roadmap to identify security baselines and controls. C. Identify key stakeholders to champion information security. D. Determine acceptable levels of information security risk.
Answer: A
Explanation: The FIRST step in developing an information security strategy is to perform
a gap analysis based on the current state of the organization’s information security posture.
A gap analysis is a systematic process of comparing the current state with the desired state
and identifying the gaps or deficiencies that need to be addressed. A gap analysis helps to establish a baseline for the information security strategy, as well as to prioritize the actions
and resources needed to achieve the strategic objectives. A gap analysis also helps to
align the information security strategy with the organizational goals and strategies, as well
as to ensure compliance with relevant standards and regulations. References = CISM
first step in developing an information security strategy is to conduct a risk-aware and
comprehensive inventory of your company’s context, including all digital assets,
employees, and vendors. Then you need to know about the threat environment and which
types of attacks are a threat to your company1. This is similar to performing a gap analysis
based on the current state3.
Question # 16
Which of the following is the PRIMARY purpose of a business impact analysis (BIA)?
A. To define security roles and responsibilities B. To determine return on investment (ROI) C. To establish incident severity levels D. To determine the criticality of information assets
Answer: D
Explanation:
A business impact analysis (BIA) is a process that identifies and evaluates the potential
effects of disruptions to critical business operations as a result of a disaster, accident or
emergency. The primary purpose of a BIA is to determine the criticality of information
assets and the impact of their unavailability on the organization’s mission, objectives and
Which of the following is the BEST way to reduce the risk of security incidents from targeted email attacks?
A. Implement a data loss prevention (DLP) system B. Disable all incoming cloud mail services C. Conduct awareness training across the organization D. Require acknowledgment of the acceptable use policy
Answer: C
Explanation:
Conducting awareness training across the organization is the best way to reduce the risk of
security incidents from targeted email attacks because it helps to educate and empower
the employees to recognize and avoid falling for such attacks. Targeted email attacks, such
as phishing, spear phishing, or business email compromise, rely on social engineering
techniques to deceive and manipulate the recipients into clicking on malicious links,
opening malicious attachments, or disclosing sensitive information. Awareness training can
help to raise the level of security culture and behavior among the employees, as well as to
provide them with practical tips and best practices to protect themselves and the
organization from targeted email attacks. Therefore, conducting awareness training across
Which of the following is MOST appropriate to communicate to senior management regarding information risk?
A. Defined risk appetite B. Emerging security technologies C. Vulnerability scanning progress D. Risk profile changes
Answer: D
Explanation:
The most appropriate information to communicate to senior management regarding
information risk is the risk profile changes, which reflect the current level and nature of the risks that the organization faces. The risk profile changes can help senior management to
understand the impact of the risks on the business objectives, the effectiveness of the risk
management strategy, and the need for any adjustments or improvements. The risk profile
changes can also help senior management to prioritize the allocation of resources and to
Which of the following provides the MOST useful information for identifying security controlgaps on an application server?
A. Risk assessments B. Threat models C. Penetration testing D. Internal audit reports
Answer: C
Explanation: Penetration testing is the most useful method for identifying security control
gaps on an application server because it simulates real-world attacks and exploits the
vulnerabilities and weaknesses of the application server. Penetration testing can reveal the
actual impact and risk of the security control gaps, and provide recommendations for
remediation and improvement.
References: The CISM Review Manual 2023 defines penetration testing as “a method of
evaluating the security of an information system or network by simulating an attack from a
malicious source” and states that “penetration testing can help identify security control gaps
and provide evidence of the potential impact and risk of the gaps” (p. 185). The CISM
Review Questions, Answers & Explanations Manual 2023 also provides the following
rationale for this answer: “Penetration testing is the correct answer because it is the most
useful method for identifying security control gaps on an application server, as it simulates
real-world attacks and exploits the vulnerabilities and weaknesses of the application server,
and provides recommendations for remediation and improvement” (p. 95). Additionally, the
web search result 4 states that “penetration testing is a valuable tool for discovering
security gaps in your application server and network infrastructure” and that “penetration
testing can help you assess the effectiveness and efficiency of your security controls, and
identify the areas that need improvement or enhancement” (p. 1).
Question # 20
Following a breach where the risk has been isolated and forensic processes have beenperformed, which of the following should be done NEXT?
A. Place the web server in quarantine. B. Rebuild the server from the last verified backup. C. Shut down the server in an organized manner. D. Rebuild the server with relevant patches from the original media.
Answer: B
Explanation:
= After a breach where the risk has been isolated and forensic processes have been
performed, the next step should be to rebuild the server from the last verified backup. This
will ensure that the server is restored to a known and secure state, and that any malicious
code or data that may have been injected or compromised by the attacker is removed.
Rebuilding the server from the original media may not be sufficient, as it may not include
the latest patches or configurations that were applied before the breach. Placing the web
server in quarantine or shutting it down may not be feasible or desirable, as it may disrupt
the business operations or services that depend on the server. Rebuilding the server from
the last verified backup is the best option to resume normal operations while maintaining
security. References =
CISM Review Manual 15th Edition, page 118: “Recovery is the process of restoring normal
operations after an incident. Recovery activities may include rebuilding systems, restoring
data, applying patches, changing passwords, and testing functionality.”
Data Breach Experts Share The Most Important Next Step You Should Take After A Data
Breach in 2014 & 2015, snippet: “Restore from backup. If you have a backup of your
system from before the breach, wipe your system clean and restore from backup. This will
ensure that any backdoors or malware installed by the hackers are removed.”
Question # 21
An organization involved in e-commerce activities operating from its home country openeda new office in another country with stringent security laws. In this scenario, the overallsecurity strategy should be based on:
A. the security organization structure. B. international security standards. C. risk assessment results. D. the most stringent requirements.
Answer: D
Question # 22
Which of the following is the BEST defense-in-depth implementation for protecting high value assets or for handling environments that have trust concerns?
A. Compartmentalization B. Overlapping redundancy C. Continuous monitoring D. Multi-factor authentication
Answer: A
Explanation: Compartmentalization is the best defense-in-depth implementation for
protecting high value assets or for handling environments that have trust concerns because
it is a strategy that divides the network or system into smaller segments or compartments,
each with its own security policies, controls, and access rules. Compartmentalization helps
to isolate and protect the most sensitive or critical data and functions from unauthorized or
malicious access, as well as to limit the damage or impact of a breach or compromise.
Compartmentalization also helps to enforce the principle of least privilege, which grants
users or processes only the minimum access rights they need to perform their tasks.
Therefore, compartmentalization is the correct answer.
An information security manager has identified that privileged employee access requests toproduction servers are approved; but user actions are not logged. Which of the followingshould be the GREATEST concern with this situation?
A. Lack of availability B. Lack of accountability C. Improper authorization D. Inadequate authentication
Answer: B
Explanation: The greatest concern with the situation of privileged employee access
requests to production servers being approved but not logged is the lack of accountability,
which means the inability to trace or verify the actions and decisions of the privileged users.
Lack of accountability can lead to security risks such as unauthorized changes, data
breaches, fraud, or misuse of privileges. Logging user actions is a key component of
privileged access management (PAM), which helps to monitor, detect, and prevent
unauthorized privileged access to critical resources. The other options, such as lack of availability, improper authorization, or inadequate authentication, are not directly related to
the situation of not logging user actions. References:
Which of the following BEST helps to enable the desired information security culture withinan organization?
A. Information security awareness training and campaigns B. Effective information security policies and procedures C. Delegation of information security roles and responsibilities D. Incentives for appropriate information security-related behavior
Answer: A
Explanation: Information security awareness training and campaigns are the best way to
enable the desired information security culture within an organization because they help to
educate, motivate and influence the behavior and attitude of the employees towards
information security. They also help to raise the awareness of the risks, threats and best
practices of information security among the staff and stakeholders.
References = Organizational Culture for Information Security: A Systemic Perspective on
the Articulation of Human, Cultural and Social Systems, CISM Exam Content Outline
Question # 27
Which of the following BEST enables the assignment of risk and control ownership?
A. Aligning to an industry-recognized control framework B. Adopting a risk management framework C. Obtaining senior management buy-in D. Developing an information security strategy
Answer: C
Explanation: Obtaining senior management buy-in is the best way to enable the
assignment of risk and control ownership because it helps to establish the authority and
accountability of the risk and control owners, as well as to provide them with the necessary
resources and support to perform their roles. Risk and control ownership refers to the assignment of specific responsibilities and accountabilities for managing risks and controls
to individuals or groups within the organization. Obtaining senior management buy-in helps
to ensure that risk and control ownership is aligned with the organizational objectives,
structure, and culture, as well as to communicate the expectations and benefits of risk and
control ownership to all stakeholders. Therefore, obtaining senior management buy-in is
An organization is about to purchase a rival organization. The PRIMARY reason forperforming information security due diligence prior to making the purchase is to:
A. determine the security exposures. B. assess the ability to integrate the security department operations. C. ensure compliance with international standards. D. evaluate the security policy and standards.
Answer: A
Explanation:
Information security due diligence is the process of assessing the current state of
information security in an organization, identifying any gaps, risks, or vulnerabilities, and
estimating the costs and efforts required to remediate them. Performing information
security due diligence prior to making the purchase is important to determine the security
exposures that may affect the value, reputation, or liability of the organization, as well as
the feasibility and compatibility of integrating the security systems and processes of the two
1, Task 1.22; Information Security Due Diligence Questionnair
Question # 31
An organization wants to integrate information security into its HR management processes.Which of the following should be the FIRST step?
A. Calculate the return on investment (ROI). B. Provide security awareness training to HR. C. Benchmark the processes with best practice to identify gaps. D. Assess the business objectives of the processes.
Answer: D
Question # 32
Which of the following is the BEST indicator of the maturity level of a vendor riskmanagement process?
A. Average time required to complete the vendor risk management process B. Percentage of vendors that have gone through the vendor onboarding process C. Percentage of vendors that are regularly reviewed against defined criteria D. Number of vendors rejected because of security review results
Answer: C
Explanation:
The percentage of vendors that are regularly reviewed against defined criteria is the best
indicator of the maturity level of a vendor risk management process, as it reflects the extent
to which the organization has established and implemented a consistent, repeatable, and
effective process to monitor and evaluate the security performance and compliance of its
vendors. A high percentage indicates a mature process that covers all vendors and applies
clear and relevant criteria based on the organization’s risk appetite and objectives. A low
percentage indicates a less mature process that may be ad hoc, incomplete, or outdated.
The PRIMARY objective of timely declaration of a disaster is to:
A. ensure the continuity of the organization's essential services. B. protect critical physical assets from further loss. C. assess and correct disaster recovery process deficiencies. D. ensure engagement of business management in the recovery process.
Answer: A
Explanation: The primary objective of timely declaration of a disaster is to ensure the
continuity of the organization’s essential services, as it enables the activation of the
business continuity plan (BCP) and the disaster recovery plan (DRP) that outline the
processes and procedures to maintain or resume the critical business functions and
minimize the impact of the disruption. A timely declaration of a disaster also helps to
communicate the situation to the stakeholders, mobilize the resources, and request
FEMA, How a Disaster Gets Declared2; CISM Online Review Course, Module 4, Lesson 3,
Topic 13
Question # 34
Which of the following eradication methods is MOST appropriate when responding to anincident resulting in malware on an application server?
A. Disconnect the system from the network. B. Change passwords on the compromised system. C. Restore the system from a known good backup. D. Perform operation system hardening.
Answer: C
Explanation:
Restoring the system from a known good backup is the most appropriate eradication
method when responding to an incident resulting in malware on an application server, as it
ensures that the system is free of any malicious code and that the data and applications
are consistent with the expected state. Disconnecting the system from the network may
prevent further spread of the malware, but it does not eradicate it from the system.
Changing passwords on the compromised system may reduce the risk of unauthorized
access, but it does not remove the malware from the system. Performing operation system
hardening may improve the security configuration of the system, but it does not guarantee
Question # 35
Which of the following is the PRIMARY reason to regularly update business continuity and disaster recovery documents?
A. To enforce security policy requirements B. To maintain business asset inventories C. To ensure audit and compliance requirements are met D. To ensure the availability of business operations
Answer: D
Explanation:
The primary reason to regularly update business continuity and disaster recovery
documents is to ensure that the plans and procedures are aligned with the current business
needs and objectives, and that they can effectively support the availability of business
operations in the event of a disaster. Updating the documents also helps to enforce
security policy requirements, maintain business asset inventories, and ensure audit and
compliance requirements are met, but these are secondary benefits.
and Disaster Recovery, Section: Business Continuity Planning, Subsection: Business
Continuity Plan Maintenance, Page 378.
Question # 36
Which of the following roles is PRIMARILY responsible for developing an informationclassification framework based on business needs?
A. Information security manager B. Information security steering committee C. Information owner D. Senior management
Answer: C
Explanation: According to the CISM Review Manual (Digital Version), Chapter 3, Section
3.2.1, Information owners are responsible for developing an information classification
framework based on business needs1. They are also responsible for defining and
maintaining the classification scheme, policies, and procedures for their information
assets1.
The CISM Review Manual (Digital Version) also states that information owners should
collaborate with other stakeholders, such as information security managers, information
security steering committees, senior management, and legal counsel, to ensure that the
classification framework is aligned with the organization’s objectives and complies with
applicable laws and regulations1.
The CISM Exam Content Outline also covers the topic of information classification
frameworks in Domain 3 — Information Security Program Development and Management
(27% exam weight)2. The subtopics include:
3.2.1 Information Classification Frameworks
3.2.2 Information Classification Policies
3.2.3 Information Classification Procedures
3.2.4 Information Classification Training
I hope this answer helps you prepare for your CISM exam. Good luck!
Question # 37
An investigation of a recent security incident determined that the root cause was negligenthanding of incident alerts by system admit manager to address this issue?
A. Conduct a risk assessment and share the result with senior management. B. Revise the incident response plan-to align with business processes. C. Provide incident response training to data custodians. D. Provide incident response training to data owners.
Answer: C
Explanation: The best action for the system admin manager to address the issue of
negligent handling of incident alerts by system admins is to provide incident response
training to data custodians because it helps to improve their awareness and skills in
recognizing and reporting security incidents, and following the incident response
procedures and protocols. Conducting a risk assessment and sharing the result with senior
management is not a good action because it does not address the root cause of the issue
or provide any solutions or improvements. Revising the incident response plan to align with
business processes is not a good action because it does not address the root cause of the
issue or provide any solutions or improvements. Providing incident response training to
data owners is not a good action because data owners are not responsible for handling
incident alerts or performing incident response tasks. References:
A KEY consideration in the use of quantitative risk analysis is that it:
A. aligns with best practice for risk analysis of information assets. B. assigns numeric values to exposures of information assets. C. applies commonly used labels to information assets. D. is based on criticality analysis of information assets.
Answer: B
Explanation: A key consideration in the use of quantitative risk analysis is that it assigns
numeric values to exposures of information assets, such as the probability of occurrence,
the frequency of occurrence, the impact of occurrence, and the monetary value of the
assets. These numeric values help to measure and compare the risks in a more objective
and consistent way, and to support the decision-making process based on cost-benefit
analysis. Quantitative risk analysis also requires reliable and accurate data sources, and it
may involve the use of statistical tools and techniques.
