CISM Exam Dumps - Reliable Way to Pass and Get Certified

CISM Exam Dumps – Reliable Way to Pass and Get Certified

Category:

Comments:

0 Comments

Post Date:

July 17, 2025

If you are looking for a reliable and comprehensive way to prepare for your CISM certification exam, look no further than CISM exam questions. These CISM exam dumps questions are designed to help you assess your knowledge, identify your strengths and weaknesses, and improve your chances of passing the exam on the first try. These CISM dumps questions cover all the topics and concepts that are essential for the CISM exam, so you can be sure that you are fully prepared. Test ISACA CISM free dumps below.

Page 1 of 29

1. Which of the following BEST protects against emerging advanced persistent threat (APT) actors?

Honeypot environment

Updated security awareness materials

Ongoing incident response training

Proactive monitoring

2. Which of the following is the MOST important characteristic of an effective information security metric?

The metric expresses residual risk relative to risk tolerance.

The metric is frequently reported to senior management.

The metric directly maps to an industry risk management framework.

The metric compares the organization's inherent risk against its risk appetite.

3. Which of the following will BEST facilitate timely and effective incident response?

Including penetration test results in incident response planning

Assessing the risk of compromised assets

Classifying the severity of an incident

Notifying stakeholders when invoking the incident response plan

4. To help ensure that an information security training program is MOST effective, its contents should be:

based on recent incidents.

based on employees’ roles.

aligned to business processes.

focused on information security policy.

5. An organization has identified a weakness in the ability of its employees to identify and report cybersecurity incidents. Although training materials have been provided, employees show a lack of interest.

Which of the following is the information security manager’s BEST course of action?

Block network access until security awareness training is complete.

Conduct an enterprise cybersecurity risk assessment.

Obtain key stakeholder and leadership support.

Send an email mandating training for the employees.

6. Which of the following is the MOST important consideration when defining control objectives?

Senior management support

Risk appetite

Threat environment

Budget allocation

7. Which of the following should be considered FIRST when recovering a compromised system that needs a complete rebuild?

Patch management files

Network system logs

Configuration management files

Intrusion detection system (IDS) logs

8. Which of the following is the PRIMARY preventive method to mitigate risks associated with privileged accounts?

Eliminate privileged accounts.

Perform periodic certification of access to privileged accounts.

Frequently monitor activities on privileged accounts.

Provide privileged account access only to users who need it.

9. Which of the following trends would be of GREATEST concern when reviewing the performance of an organization's intrusion detection systems (IDSs)?

Decrease in false positives

Increase in false positives

Increase in false negatives

Decrease in false negatives

10. The PRIMARY reason to properly classify information assets is to determine:

appropriate encryption strength using a risk-based approach.

the business impact if assets are compromised.

the appropriate protection based on sensitivity.

user access levels based on the need to know.

Page 2 of 29

11. An incident management team leader sends out a notification that the organization has successfully recovered from a cyberattack.

Which of the following should be done NEXT?

Prepare an executive summary for senior management

Gather feedback on business impact

Conduct a meeting to capture lessons learned.

Secure and preserve digital evidence for analysis.

12. Measuring which of the following is the MOST accurate way to determine the alignment of an information security strategy with organizational goals?

Number of blocked intrusion attempts

Number of business cases reviewed by senior management

Trends in the number of identified threats to the business

Percentage of controls integrated into business processes

13. Which of the following is the BEST source of information to support an organization's information security vision and strategy?

Metrics dashboard

Governance policies

Capability maturity model

Enterprise information security architecture

14. Which of the following is a PRIMARY function of an incident response team?

To provide effective incident mitigation

To provide a risk assessment for zero-day vulnerabilities

To provide a single point of contact for critical incidents

To provide a business impact analysis (BIA)

15. In a call center, the BEST reason to conduct a social engineering is to:

Identify candidates for additional security training.

minimize the likelihood of successful attacks.

gain funding for information security initiatives.

improve password policy.

16. During the due diligence phase of an acquisition, the MOST important course of action for an information security manager is to:

perform a risk assessment.

review the state of security awareness.

review information security policies.

perform a gap analysis.

17. Which of the following will BEST enable an effective information asset classification process?

Including security requirements in the classification process

Analyzing audit findings

Reviewing the recovery time objective (RTO) requirements of the asset

Assigning ownership

18. An information security team has confirmed that threat actors are taking advantage of a newly announced critical vulnerability within an application.

Which of the following should be done FIRST?

Install additional application controls.

Notify senior management.

Invoke the incident response plan.

Prevent access to the application.

19. The PRIMARY purpose for conducting cybersecurity risk assessments is to:

Assist in security reporting to senior management

Provide metrics to indicate cybersecurity program effectiveness

Verify compliance across multiple sectors

Understand the organization's current security posture

20. An intrusion has been detected and contained.

Which of the following steps represents the BEST practice for ensuring the integrity of the recovered system?

Install the OS, patches, and application from the original source.

Restore the OS, patches, and application from a backup.

Restore the application and data from a forensic copy.

Remove all signs of the intrusion from the OS and application.

Page 3 of 29

21. An organization is experiencing a sharp increase in incidents related to phishing messages. The root cause is an outdated email filtering system that is no longer supported by the vendor.

Which of the following should be the information security manager's FIRST course of action?

Reinforce security awareness practices for end users.

Temporarily outsource the email system to a cloud provider.

Develop a business case to replace the system.

Monitor outgoing traffic on the firewall.

22. An information security manager determines there are a significant number of exceptions to a newly released industry-required security standard.

Which of the following should be done NEXT?

Document risk acceptances.

Revise the organization's security policy.

Assess the consequences of noncompliance.

Conduct an information security audit.

23. An organization requires that business-critical applications be recovered within 30 minutes in the event of a disaster.

Which of the following metrics should be defined in the business continuity plan (BCP) to manage this requirement?

Recovery time objective (RTO)

Recovery point objective (RPO)

Maximum tolerable downtime (MTD)

Service level agreement (SLA)

24. Internal audit has reported a number of information security issues that are not in compliance with regulatory requirements.

What should the information security manager do FIRST?

Perform a vulnerability assessment

Perform a gap analysis to determine needed resources

Create a security exception

Assess the risk to business operations

25. An organization wants to integrate information security into its HR management processes.

Which of the following should be the FIRST step?

Benchmark the processes with best practice to identify gaps.

Calculate the return on investment (ROI).

Provide security awareness training to H

Assess the business objectives of the processes.

26. The PRIMARY benefit of introducing a single point of administration in network monitoring is that it:

reduces unauthorized access to systems.

promotes efficiency in control of the environment.

prevents inconsistencies in information in the distributed environment.

allows administrative staff to make management decisions.

27. When taking a risk-based approach to vulnerability management, which of the following is MOST important to consider when prioritizing a vulnerability?

A. The information available about the vulnerability

B. The sensitivity of the asset and the data it contains

C. IT resource availability and constraints

D. Whether patches have been developed and tested

28. An information security manager believes that information has been classified inappropriately, = the

risk of a breach.

Which of the following is the information security manager's BEST action?

Refer the issue to internal audit for a recommendation.

Re-classify the data and increase the security level to meet business risk.

Instruct the relevant system owners to reclassify the data.

Complete a risk assessment and refer the results to the data owners.

29. In order to gain organization-wide support for an information security program, which of the following is MOST important to consider?

Maturity of the security policy

Clarity of security roles and responsibilities

Corporate culture

Corporate risk framework

30. Which of the following is the MOST effective way to ensure the security of services and solutions delivered by third-party vendors?

Integrate risk management into the vendor management process.

Conduct security reviews on the services and solutions delivered.

Review third-party contracts as part of the vendor management process.

Perform an audit on vendors' security controls and practices.

Page 4 of 29

31. Which of the following is the MOST effective way to prevent information security incidents?

Implementing a security information and event management (SIEM) tool

Implementing a security awareness training program for employees

Deploying a consistent incident response approach

Deploying intrusion detection tools in the network environment

32. Which of the following is MOST important to include in a post-incident review following a data breach?

An evaluation of the effectiveness of the information security strategy

Evaluations of the adequacy of existing controls

Documentation of regulatory reporting requirements

A review of the forensics chain of custom

33. When performing a business impact analysis (BIA), who should calculate the recovery time and cost estimates?

Business process owner

Business continuity coordinator

Senior management

Information security manager

34. Which of the following is MOST important to include in an information security status report to senior management?

Key risk indicators (KRIs)

Review of information security policies

Information security budget requests

List of recent security events

35. The MOST important reason for having an information security manager serve on the change management committee is to:

identify changes to the information security policy.

ensure that changes are tested.

ensure changes are properly documented.

advise on change-related risk.

36. A Seat a-hosting organization's data center houses servers, appli .. BEST approach for developing a physical access control policy for the organization?

Review customers’ security policies.

Conduct a risk assessment to determine security risks and mitigating controls.

Develop access control requirements for each system and application.

Design single sign-on (SSO) or federated access.

37. A security incident has been reported within an organization When should an information security manager contact the information owner?

After the incident has been mitigated

After the incident has been confirmed.

After the potential incident has been togged

After the incident has been contained

38. Which of the following BEST determines the allocation of resources during a security incident response?

Senior management commitment

A business continuity plan (BCP)

An established escalation process

Defined levels of severity

39. After a recovery from a successful malware attack, instances of the malware continue to be discovered.

Which phase of incident response was not successful?

EradicationB Recovery

Lessons learned review

Incident declaration

40. Which of the following BEST enables an organization to determine the costs of downtime for a critical application?

A. Fault tree analysis

B. Cost-benefit analysis

C. Return on investment (ROI) analysis

D. Business impact analysis (BIA)

Page 5 of 29

41. Which of the following should be the MOST important consideration of business continuity management?

Ensuring human safety

Identifying critical business processes

Ensuring the reliability of backup data

Securing critical information assets

42. Which of the following is the GREATEST benefit of incorporating information security governance into the corporate governance framework?

Heightened awareness of information security strategies

Improved process resiliency in the event of attacks

Promotion of security-by-design principles to the business

Management accountability for information security

43. Which of the following is the BEST indication of effective information security governance?

Information security is considered the responsibility of the entire information security team.

Information security controls are assigned to risk owners.

Information security is integrated into corporate governance.

Information security governance is based on an external security framework.

44. When preventive controls to appropriately mitigate risk are not feasible, which of the following is the MOST important action for the information security manager?

Managing the impact

Identifying unacceptable risk levels

Assessing vulnerabilities

Evaluating potential threats

45. Which of the following is the MOST important reason for obtaining input from risk owners when implementing controls?

To reduce risk mitigation costs

To resolve vulnerabilities in enterprise architecture (EA)

To manage the risk to an acceptable level

To eliminate threats impacting the business

46. Which of the following should an information security manager do FIRST when creating an organization's disaster recovery plan (DRP)?

Conduct a business impact analysis (BIA)

Identify the response and recovery learns.

Review the communications plan.

Develop response and recovery strategies.

47. Which of the following is the BEST way to obtain support for a new organization-wide information

security program?

Benchmark against similar industry organizations

Deliver an information security awareness campaign.

Publish an information security RACI chart.

Establish an information security strategy committee.

48. Which of the following is the MOST effective way to protect the authenticity of data in transit?

Digital signature

Private key

Access controls

Public key

49. Following an unsuccessful denial of service (DoS) attack, identified weaknesses should be:

Tracked and reported on until their final resolution

Noted and re-examined later if similar weaknesses are found

Documented in security awareness programs

Quickly resolved and eliminated regardless of cost

50. Which of the following eradication methods is MOST appropriate when responding to an incident resulting in malware on an application server?

Disconnect the system from the network.

Change passwords on the compromised system.

Restore the system from a known good backup.

Perform operation system hardening.

Page 6 of 29

51. Which of the following is a desired outcome of information security governance?

Penetration test

Improved risk management

Business agility

A maturity model

52. Which of the following is the responsibility of a risk owner?

Implementing risk treatment plan activities with control owners

Evaluating control effectiveness

Approving risk treatment plans

Approving the selection of risk mitigation measures

53. Which of the following is the MOST effective way to influence organizational culture to align with security guidelines?

Adhere to regulatory requirements

Conduct security awareness

Document and distribute security procedures

Communicate and enforce security policies

54. An organization's information security manager reads on social media that a recently purchased vendor product has been compromised and customer data has been posted online.

What should the information security manager do FIRST?

Perform a business impact analysis (BIA).

Notify local law enforcement agencies of a breach.

Activate the incident response program.

Validate the risk to the organization.

55. Which of the following BEST facilitates effective incident response testing?

Including all business units in testing

Simulating realistic test scenarios

Reviewing test results quarterly

Testing after major business changes

56. The PRIMARY purpose of implementing information security governance metrics is to:

measure alignment with best practices.

assess operational and program metrics.

guide security towards the desired state.

refine control operations.

57. For which of the following is it MOST important that system administrators be restricted to read-only access?

User access log files

Administrator user profiles

Administrator log files

System logging options

58. An organization has implemented a new customer relationship management (CRM) system. Who should be responsible for enforcing authorized and controlled access to the CRM data?

Internal IT audit

The data custodian

The information security manager

The data owner

59. Which of the following provides the MOST comprehensive insight into ongoing threats facing an organization?

Business impact analysis (BIA)

Risk register

Penetration testing

Vulnerability assessment

60. Determining the risk for a particular threat/vulnerability pair before controls are applied can be expressed as:

a function of the likelihood and impact, should a threat exploit a vulnerability.

the magnitude of the impact, should a threat exploit a vulnerability.

a function of the cost and effectiveness of controls over a vulnerability.

the likelihood of a given threat attempting to exploit a vulnerability

Page 7 of 29

61. An organization permits the storage and use of its critical and sensitive information on employee-owned smartphones.

Which of the following is the BEST security control?

Establishing the authority to remote wipe

Developing security awareness training

Requiring the backup of the organization's data by the user

Monitoring how often the smartphone is used

62. Which of the following activities MUST be performed by an information security manager for change requests?

Perform penetration testing on affected systems.

Scan IT systems for operating system vulnerabilities.

Review change in business requirements for information security.

Assess impact on information security risk.

63. Which of the following would be MOST helpful to identify worst-case disruption scenarios?

Business impact analysis (BIA)

Business process analysis

SWOT analysis

Cast-benefit analysis

64. Which of the following roles is PRIMARILY responsible for developing an information classification framework based on business needs?

Information security manager

Information security steering committee

Information owner

Senior management

65. Which of the following BEST enables an organization to continuously assess the information security risk posture?

Key risk indicators (KRIs)

Periodic review of the risk register

Degree of senior management support

Compliance with industry regulations

66. In a business proposal, a potential vendor promotes being certified for international security standards as a measure of its security capability.

Before relying on this certification, it is MOST important that the information security manager confirms that the:

current international standard was used to assess security processes.

certification will remain current through the life of the contract.

certification scope is relevant to the service being offered.

certification can be extended to cover the client's business.

67. While conducting a test of a business continuity plan (BCP), which of the following is the MOST important consideration?

The test is scheduled to reduce operational impact.

The test involves IT members in the test process.

The test addresses the critical components.

The test simulates actual prime-time processing conditions.

68. Which of the following has the GREATEST influence on the successful integration of information security within the business?

Organizational structure and culture

Risk tolerance and organizational objectives

The desired state of the organization

Information security personnel

69. When performing a business impact analysis (BIA), who should be responsible for determining the initial recovery time objective (RTO)?

External consultant

Information owners

Information security manager

Business continuity coordinator

70. An information security program is BEST positioned for success when it is closely aligned with:

information security best practices.

recognized industry frameworks.

information security policies.

the information security strategy.

Page 8 of 29

71. Which of the following is the PRIMARY role of an information security manager in a software development project?

To enhance awareness for secure software design

To assess and approve the security application architecture

To identify noncompliance in the early design stage

To identify software security weaknesses

72. An organization recently updated and published its information security policy and standards.

What should the information security manager do NEXT?

Conduct a risk assessment.

Communicate the changes to stakeholders.

Update the organization's risk register.

Develop a policy exception process.

73. Which of the following BEST helps to enable the desired information security culture within an organization?

Information security awareness training and campaigns

Effective information security policies and procedures

Delegation of information security roles and responsibilities

Incentives for appropriate information security-related behavior

74. Which of the following presents the GREATEST risk associated with the use of an automated security information and event management (SIEM) system?

Low number of false positives

Low number of false negatives

High number of false positives

High number of false negatives

75. Which of the following should be the GREATEST concern for an information security manager when an annual audit reveals the organization's business continuity plan (BCP) has not been reviewed or updated in more than a year?

An outdated BCP may result in less efficient recovery if an actual incident occurs.

The organization may suffer reputational damage for not following industry best practices.

The audit finding may impact the overall risk rating of the organization.

The lack of updates to the BCP may result in noncompliance with internal policies.

76. Which of the following is the BEST way to help ensure an organization's risk appetite will be considered as part of the risk treatment process?

Establish key risk indicators (KRIs).

Use quantitative risk assessment methods.

Provide regular reporting on risk treatment to senior management

Require steering committee approval of risk treatment plans.

77. Information security policies should PRIMARILY reflect alignment with:

an information security framework.

industry best practices.

data security standards.

senior management intent.

78. Which of the following is the BEST method to protect against emerging advanced persistent threat (APT) actors?

Providing ongoing training to the incident response team

Implementing proactive systems monitoring

Implementing a honeypot environment

Updating information security awareness materials

79. Which of the following is MOST important for an information security manager to verify when selecting a third-party forensics provider?

Existence of a right-to-audit clause

Results of the provider's business continuity tests

Technical capabilities of the provider

Existence of the provider's incident response plan

80. When establishing an information security governance framework, it is MOST important for an information security manager to understand:

information security best practices.

risk management techniques.

the threat environment.

the corporate culture.

Page 9 of 29

81. Which of the following should an information security manager do FIRST after learning through mass media of a data breach at the organization's hosted payroll service provider?

Suspend the data exchange with the provider

Notify appropriate regulatory authorities of the breach.

Initiate the business continuity plan (BCP)

Validate the breach with the provider

82. Which of the following is the BEST way to reduce the risk associated with a bring your own device (BYOD) program?

Implement a mobile device policy and standard.

Provide employee training on secure mobile device practices.

Implement a mobile device management (MDM) solution.

Require employees to install an effective anti-malware app.

83. Which of the following factors has the GREATEST influence on the successful implementation of information security strategy goals?

Regulatory requirements

Compliance acceptance

Management support

Budgetary approval

84. Which of the following BEST indicates misalignment of security policies with business objectives?

Low completion rate of employee awareness training

Lack of adequate funding for the security program

A large number of long-term policy exceptions

A large number of user noncompliance incidents

85. Which of the following provides the BEST evidence that a newly implemented security awareness program has been effective?

Senior management supports funding for ongoing awareness training.

Employees from each department have completed the required training.

There has been an increase in the number of phishing attempts reported.

There have been no reported successful phishing attempts since the training started.

86. Which of the following is the BEST indication that an organization has a mature information security culture?

Information security training is mandatory for all staff.

The organization's information security policy is documented and communicated.

The chief information security officer (CISO) regularly interacts with the board.

Staff consistently consider risk in making decisions.

87. The PRIMARY advantage of involving end users in continuity planning is that they:

have a better understanding of specific business needs.

are more objective than information security management.

can see the overall impact to the business.

can balance the technical and business risks.

88. Which of the following is MOST important to include in an incident response plan to ensure incidents are responded to by the appropriate individuals?

Skills required for the incident response team

A list of external resources to assist with incidents

Service level agreements (SLAs)

A detailed incident notification process

89. Which of the following is MOST important to include in security incident escalation procedures?

Key objectives of the security program

Recovery procedures

Notification criteria

Containment procedures

90. Which of the following should be an information security manager's FIRST course of action when one of the organization's critical third-party providers experiences a data breach?

Inform the public relations officer.

Monitor the third party's response.

Invoke the incident response plan.

Inform customers of the breach.

Page 10 of 29

91. Data classification is PRIMARILY the responsibility of:

senior management.

the data custodian.

the data owner.

the security manager.

92. Of the following, who should be assigned as the owner of a newly identified risk related to an organization's new payroll system?

Data privacy officer

Information security manager

Head of IT department

Head of human resources (HR)

93. The PRIMARY objective of timely declaration of a disaster is to:

ensure engagement of business management in the recovery process.

assess and correct disaster recovery process deficiencies.

protect critical physical assets from further loss.

ensure the continuity of the organization's essential services.

94. Unintentional behavior by an employee caused a major data loss incident.

Which of the following is the BEST way for the information security manager to prevent recurrence within the organization?

Implement compensating controls.

Communicate consequences for future instances.

Enhance the data loss prevention (DLP) solution.

Improve the security awareness training program.

95. Which of the following events would MOST likely require a revision to the information security program?

An increase in industry threat level .

A significant increase in reported incidents

A change in IT management

A merger with another organization

96. Which of the following is the BEST technical defense against unauthorized access to a corporate network through social engineering?

Requiring challenge/response information

Requiring multi factor authentication

Enforcing frequent password changes

Enforcing complex password formats

97. Which of the following is the MOST important reason for logging firewall activity?

Metrics reporting

Firewall tuning

Intrusion prevention

Incident investigation

98. An international organization with remote branches is implementing a corporate security policy for managing personally identifiable information (PII).

Which of the following should be the information security manager's MAIN concern?

Local regulations

Data backup strategy

Consistency in awareness programs

Organizational reporting structure

99. Following an employee security awareness training program, what should be the expected outcome?

A decrease in the number of viruses detected in incoming emails

A decrease in reported social engineering attacks

An increase in reported social engineering attempts

An increase in user-reported false positive incidents

100. Which of the following BEST facilitates effective strategic alignment of security initiatives?

The business strategy is periodically updated

Procedures and standards are approved by department heads.

Periodic security audits are conducted by a third-party.

Organizational units contribute to and agree on priorities

Page 11 of 29

101. Which of the following is MOST important to include in an information security status report management?

List of recent security events

Key risk indication (KRIs)

Review of information security policies

information security budget requests

102. Which of the following should be the FIRST step in developing an information security strategy?

Perform a gap analysis based on the current state

Create a roadmap to identify security baselines and controls.

Identify key stakeholders to champion information security.

Determine acceptable levels of information security risk.

103. Which of the following is the BEST tool to use for identifying and correlating intrusion attempt alerts?

A. Threat analytics software

B. Host intrusion detection system

C. SIEM

D. Network intrusion detection system

104. Which of the following is the GREATEST concern resulting from the lack of severity criteria in incident classification?

Statistical reports will be incorrect.

The service desk will be staffed incorrectly.

Escalation procedures will be ineffective.

Timely detection of attacks will be impossible.

105. Data entry functions for a web-based application have been outsourced to a third-party service provider who will work from a remote site Which of the following issues would be of GREATEST concern to an information security manager?

The application does not use a secure communications protocol

The application is configured with restrictive access controls

The business process has only one level of error checking

Server-based malware protection is not enforced

106. Network isolation techniques are immediately implemented after a security breach to:

preserve evidence as required for forensics

reduce the extent of further damage.

allow time for key stakeholder decision making.

enforce zero trust architecture principles.

107. When multiple Internet intrusions on a server are detected, the PRIMARY concern of the information security manager should be to ensure:

the integrity of evidence is preserved.

forensic investigation software is loaded on the server.

the incident is reported to senior management.

the server is unplugged from power.

108. An information security manager has become aware that a third-party provider is not in compliance with the statement of work (SOW).

Which of the following is the BEST course of action?

Notify senior management of the issue.

Report the issue to legal personnel.

Initiate contract renegotiation.

Assess the extent of the issue.

109. Which of the following is the BEST way to compete for funding for an information security program in an organization with limited resources?

A. Demonstrate the effectiveness of business continuity plans (BCPs).

B. Report key performance indicator (KPI) trends.

C. Demonstrate that the program enables business activities.

D. Provide evidence of increased security events at peer organizations.

110. Which of the following is MOST effective for communicating forward-looking trends within security reporting?

Key control indicator (KCIs)

Key risk indicators (KRIs)

Key performance indicators (KPIs)

Key goal indicators (KGIs)

Page 12 of 29

111. A small organization has a contract with a multinational cloud computing vendor.

Which of the following would present the GREATEST concern to an information security manager if omitted from the contract?

Right of the subscriber to conduct onsite audits of the vendor

Escrow of software code with conditions for code release

Authority of the subscriber to approve access to its data

Commingling of subscribers' data on the same physical server

112. The PRIMARY objective of performing a post-incident review is to:

re-evaluate the impact of incidents.

identify vulnerabilities.

identify control improvements.

identify the root cause.

113. A business requires a legacy version of an application to operate but the application cannot be patched. To limit the risk exposure to the business, a firewall is implemented in front of the legacy application.

Which risk treatment option has been applied?

Mitigate

Transfer

Avoid

114. Which of the following is the PRIMARY role of the information security manager in application development?

To ensure security is integrated into the system development life cycle (SDLC)

To ensure compliance with industry best practice

To ensure enterprise security controls are implemented

To ensure control procedures address business risk

115. Which of the following will BEST enable an organization to meet incident response requirements when outsourcing its incident response function?

Including response times in service level agreements (SLAs)

Including a right-to-audit clause in service level agreements (SLAs)

Contracting with a well-known incident response provider

Requiring comprehensive response applications and tools

116. Which of the following is the MOST important detail to capture in an organization's risk register?

Risk appetite

Risk severity level

Risk acceptance criteria

Risk ownership

117. While classifying information assets an information security manager notices that several production databases do not have owners assigned to them What is the BEST way to address this situation?

Assign responsibility to the database administrator (DBA).

Review the databases for sensitive content.

Prepare a report of the databases for senior management.

Assign the highest classification level to those databases.

118. Following a successful attack, an information security manager should be confident the malware @ continued to spread at the completion of which incident response phase?

Containment

Recovery

Eradication

Identification

119. What is the role of the information security manager in finalizing contract negotiations with service providers?

To perform a risk analysis on the outsourcing process

To obtain a security standard certification from the provider

To update security standards for the outsourced process

To ensure that clauses for periodic audits are included

120. An organization is in the process of acquiring a new company.

Which of the following would be the BEST approach to determine how to protect newly acquired data assets prior to integration?

Include security requirements in the contract

Assess security controls.

Perform a risk assessment

Review data architecture.

Page 13 of 29

121. Which of the following is the MOST likely reason for a vulnerability scanner to return incomplete results?

Unauthenticated vulnerability scans are being performed.

Scan results are not ingested into a security information and event management (SIEM) tool.

Host names have not been fully enumerated.

Zero-day vulnerability signatures have not been ingested.

122. Which of the following BEST helps to ensure a risk response plan will be developed and executed in a timely manner?

Establishing risk metrics

Training on risk management procedures

Reporting on documented deficiencies

Assigning a risk owner

123. Which of the following should be done NEXT following senior management's decision to comply with new personal data regulations that are much more stringent than those currently followed to avoid massive fines?

Encrypt data in transit and at rest.

Complete a return on investment (ROI) analysis.

Create and implement a data minimization plan.

Conduct a gap analysis.

124. A global organization is developing an incident response team. The organization wants to keep headquarters informed of all incidents and wants to be able to present a unified response to widely dispersed events.

Which of the following BEST supports these objectives?

Virtual incident response team

Distributed incident response team

Outsourced incident response team

Centralized incident response team

125. Management would like to understand the risk associated with engaging an Infrastructure-as-a-Service (laaS) provider compared to hosting internally.

Which of the following would provide the BEST method of comparing risk scenarios?

Mapping risk scenarios according to sensitivity of data

Reviewing mitigating and compensating controls for each risk scenario

Mapping the risk scenarios by likelihood and impact on a chart

Performing a risk assessment on the laaS provider

126. The MOST useful technique for maintaining management support for the information security program is:

informing management about the security of business operations.

implementing a comprehensive security awareness and training program.

identifying the risks and consequences of failure to comply with standards.

benchmarking the security programs of comparable organizations.

127. Which of the following BEST facilitates an information security manager's efforts to obtain senior management commitment for an information security program?

Presenting evidence of inherent risk

Reporting the security maturity level

Presenting compliance requirements

Communicating the residual risk

128. An incident response team has established that an application has been breached.

Which of the following should be done NEXT?

Maintain the affected systems in a forensically acceptable state

Conduct a risk assessment on the affected application

Inform senior management of the breach.

Isolate the impacted systems from the rest of the network

129. Which of the following is the MOST effective way to detect security incidents?

Analyze recent security risk assessments.

Analyze security anomalies.

Analyze penetration test results.

Analyze vulnerability assessments.

130. Which of the following BEST enables an organization to operate smoothly with reduced capacities when service has been disrupted?

Crisis management plan

Disaster recovery plan (DRP)

Incident response plan

Business continuity plan (BCP)

Page 14 of 29

131. An organization has purchased an Internet sales company to extend the sales department.

The information security manager's FIRST step to ensure the security policy framework encompasses the new business model is to:

perform a gap analysis.

implement both companies' policies separately

merge both companies' policies

perform a vulnerability assessment

132. A finance department director has decided to outsource the organization's budget application and has identified potential providers.

Which of the following actions should be initiated FIRST by IN information security manager?

Determine the required security controls for the new solution

Review the disaster recovery plans (DRPs) of the providers

Obtain audit reports on the service providers' hosting environment

Align the roles of the organization's and the service providers' stats.

133. Which of the following should be done FIRST when implementing a security program?

Perform a risk analysis

Implement data encryption.

Create an information asset inventory.

Determine the value of information assets.

134. An organization's quality process can BEST support security management by providing:

security configuration controls.

assurance that security requirements are met.

guidance for security strategy.

a repository for security systems documentation.

135. The ULTIMATE responsibility for ensuring the objectives of an information security framework are being met belongs to:

)the information security officer.

the steering committee.

the board of directors.

the internal audit manager.

136. An anomaly-based intrusion detection system (IDS) operates by gathering data on:

normal network behavior and using it as a baseline lor measuring abnormal activity

abnormal network behavior and issuing instructions to the firewall to drop rogue connections

abnormal network behavior and using it as a baseline for measuring normal activity

attack pattern signatures from historical data

137. Which of the following metrics would BEST demonstrate the success of a newly implemented information security framework?

An increase in the number of identified security incidents

A decrease in the number of security audit findings

A decrease in the number of security policy exceptions

An increase in the number of compliant business processes

138. Prior to conducting a forensic examination, an information security manager should:

boot the original hard disk on a clean system.

create an image of the original data on new media.

duplicate data from the backup media.

shut down and relocate the server.

139. Which of the following is MOST important to ensure the alignment of an information security program with the organizational strategy?

Benchmarking against industry peers

Adoption of an industry recognized framework

Approval from senior management

Identification of business-specific risk factors

140. Which of the following should be the FIRST consideration when developing a strategy for protecting an organization's data?

Classification

Encryption

Access monitoring

Access rights

Page 15 of 29

141. Which of the following is the GREATEST inherent risk when performing a disaster recovery plan (DRP) test?

Poor documentation of results and lessons learned

Lack of communication to affected users

Disruption to the production environment

Lack of coordination among departments

142. Reverse lookups can be used to prevent successful:

denial of service (DoS) attacks

session hacking

phishing attacks

Internet protocol (IP) spoofing

143. Which of the following is the PRIMARY purpose of an acceptable use policy?

To provide steps for carrying out security-related procedures

To facilitate enforcement of security process workflows

To protect the organization from misuse of information assets

To provide minimum security baselines for information assets

144. An organization successfully responded to an information security incident. However, the information security manager learned that some of the steps specified in the incident management procedures were not taken by the response team.

What should be the information security manager's FIRST step?

Provide additional training to the incident response team.

Review the incident management procedures.

Interview the incident response team.

Remove the steps from the incident management procedures.

145. Which of the following should have the MOST influence on an organization's response to a new industry regulation?

The organization's control objectives

The organization's risk management framework

The organization's risk appetite

The organization's risk control baselines

146. Which of the following would be the MOST effective way to present quarterly reports to the board on the status of the information security program?

A capability and maturity assessment

Detailed analysis of security program KPIs

An information security dashboard

An information security risk register

147. Which of the following BEST supports the incident management process for attacks on an organization's supply chain?

Including service level agreements (SLAs) in vendor contracts

Establishing communication paths with vendors

Requiring security awareness training for vendor staff

Performing integration testing with vendor systems

148. What is the PRIMARY objective of implementing standard security configurations?

Maintain a flexible approach to mitigate potential risk to unsupported systems.

Minimize the operational burden of managing and monitoring unsupported systems.

Control vulnerabilities and reduce threats from changed configurations.

Compare configurations between supported and unsupported systems.

149. An organization faces severe fines and penalties if not in compliance with local regulatory requirements by an established deadline. Senior management has asked the information security manager to prepare an action plan to achieve compliance.

Which of the following would provide the MOST useful information for planning purposes? »

Results from a business impact analysis (BIA)

Deadlines and penalties for noncompliance

Results from a gap analysis

An inventory of security controls currently in place

150. To overcome the perception that security is a hindrance to business activities, it is important for an information security manager to:

rely on senior management to enforce security.

promote the relevance and contribution of security.

focus on compliance.

reiterate the necessity of security.

Page 16 of 29

151. Which of the following is the MOST important input to the development of an effective information security strategy?

Risk and business impact assessments

Business processes and requirements

Current and desired state of security

Well-defined security policies and procedures

152. Application data integrity risk is MOST directly addressed by a design that includes:

reconciliation routines such as checksums, hash totals, and record counts.

strict application of an authorized data dictionary.

application log requirements such as field-level audit trails and user activity logs.

access control technologies such as role-based entitlements.

153. Which of the following is the BEST reason to implement a comprehensive information security management system?

To ensure continuous alignment with the organizational strategy

To gain senior management support for the information security program

To support identification of key risk indicators (KRIs)

To facilitate compliance with external regulatory requirements

154. Which of the following is MOST important to have in place to help ensure an organization's cybersecurity program meets the needs of the business?

Risk assessment program

Information security awareness training

Information security governance

Information security metrics

155. When establishing classifications of security incidents for the development of an incident response plan, which of the following provides the MOST valuable input?

Business impact analysis (BIA) results

Vulnerability assessment results

The business continuity plan (BCP)

Recommendations from senior management

156. Which of the following will ensure confidentiality of content when accessing an email system over the Internet?

Multi-factor authentication

Digital encryption

Data masking

Digital signatures

157. An organization has identified IT failures in a call center application.

Of the following, who should own this risk?

Information security manager

Head of the call center

Chief executive officer (CEO)

Head of the IT department

158. The PRIMARY goal of the eradication phase in an incident response process is to:

maintain a strict chain of custody.

provide effective triage and containment of the incident.

remove the threat and restore affected systems

obtain forensic evidence from the affected system.

159. What is the BEST way to reduce the impact of a successful ransomware attack?

Perform frequent backups and store them offline.

Purchase or renew cyber insurance policies.

Include provisions to pay ransoms ih the information security budget.

Monitor the network and provide alerts on intrusions.

160. Which of the following would provide the MOST effective security outcome in an organizations contract management process?

Performing vendor security benchmark analyses at the request-for-proposal (RFP) stage

Ensuring security requirements are defined at the request-for-proposal (RFP) stage

Extending security assessment to cover asset disposal on contract termination

Extending security assessment to include random penetration testing

Page 17 of 29

161. Which of the following is the MOST critical factor for information security program success?

comprehensive risk assessment program for information security

The information security manager's knowledge of the business

Security staff with appropriate training and adequate resources

Ongoing audits and addressing open items

162. To confirm that a third-party provider complies with an organization's information security requirements, it is MOST important to ensure:

security metrics are included in the service level agreement (SLA).

contract clauses comply with the organization's information security policy.

the information security policy of the third-party service provider is reviewed.

right to audit is included in the service level agreement (SLA).

163. Which of the following BEST enables an organization to transform its culture to support information security?

Periodic compliance audits

Strong management support

Robust technical security controls

Incentives for security incident reporting

164. While responding to a high-profile security incident, an information security manager observed several deficiencies in the current incident response plan.

When would be the BEST time to update the plan?

While responding to the incident

During a tabletop exercise

During post-incident review

After a risk reassessment

165. Which of the following is MOST important to consider when aligning a security awareness program with the organization's business strategy?

Regulations and standards

People and culture

Executive and board directives

Processes and technology

166. An information security manager has been asked to provide both one-year and five-year plans for the information security program.

What is the PRIMARY purpose for the long-term plan?

To facilitate the continuous improvement of the IT organization

To ensure controls align with security needs

To create and document required IT capabilities

To prioritize security risks on a longer scale than the one-year plan

167. An organization is going through a digital transformation process, which places the IT organization in an unfamiliar risk landscape. The information security manager has been tasked with leading the IT risk management process.

Which of the following should be given the HIGHEST priority?

Identification of risk

Analysis of control gaps

Design of key risk indicators (KRIs)

Selection of risk treatment options

168. What will BEST facilitate the success of new security initiatives?

Establish an IT security steering committee.

Include business in security decision making.

Update security policies on a regular basis

Monitor post-implementation security metrics.

169. IT projects have gone over budget with too many security controls being added post-production.

Which of the following would MOST help to ensure that relevant controls are applied to a project?

Involving information security at each stage of project management

Identifying responsibilities during the project business case analysis

Creating a data classification framework and providing it to stakeholders

Providing stakeholders with minimum information security requirements

170. Before approving the implementation of a new security solution, senior management requires a business case.

Which of the following would BEST support the justification for investment?

The solution contributes to business strategy.

The solution improves business risk tolerance levels.

The solution improves business resiliency.

The solution reduces the cost of noncompliance with regulations.

Page 18 of 29

171. Which of the following should be the PRIMARY basis for determining the value of assets?

Cost of replacing the assets

Business cost when assets are not available

Original cost of the assets minus depreciation

Total cost of ownership (TCO)

172. An information security manager developing an incident response plan MUST ensure it includes:

an inventory of critical data.

criteria for escalation.

a business impact analysis (BIA).

critical infrastructure diagrams.

173. Which of the following BEST ensures information security governance is aligned with corporate governance?

A security steering committee including IT representation

A consistent risk management approach

An information security risk register

Integration of security reporting into corporate reporting

174. Detailed business continuity plans (BCPs) should be PRIMARILY based on:

strategies validated by senior management.

capabilities of available local vendors.

strategies that cover all applications.

cost and resources needed to execute.

175. An organization has updated its business goals in the middle of the fiscal year to respond to changes in market conditions.

Which of the following is MOST important for the information security manager to update in support of the new goals?

Information security threat profile

Information security policy

Information security objectives

Information security strategy

176. Which of the following is the PRIMARY benefit of training service desk staff to recognize incidents?

Incident response plan can be activated in a timely manner.

Incident metrics can be communicated.

Risk response options can be identified quickly.

Incident classification times can be improved.

177. Which of the following is MOST important when conducting a forensic investigation?

Analyzing system memory

Documenting analysis steps

Capturing full system images

Maintaining a chain of custody

178. Business objectives and organizational risk appetite are MOST useful inputs to the development of information security:

strategy.

risk assessments.

key performance indicators (KPIs).

standards.

179. Which of the following is the PRIMARY objective of a cyber resilience strategy?

Business continuity

Regulatory compliance

Employee awareness

Executive support

180. Which of the following BEST indicates the effectiveness of a recent information security awareness campaign delivered across the organization?

Decrease in the number of security incidents

Increase in the frequency of security incident escalations

Reduction in the impact of security incidents

Increase in the number of reported security incidents

Page 19 of 29

181. Which of the following roles is BEST suited to validate user access requirements during an annual

user access review?

Access manager

IT director

System administrator

Business owner

182. Which of the following is MOST important to have in place when conducting a security control assessment of a system?

Control specifications

Assurance test plan

Scanning tools

Security documentation

183. Which of the following is the BEST strategy when determining an organization’s approach to risk treatment?

Advancing the maturity of existing controls based on risk tolerance

Prioritizing controls that directly mitigate the organization's most critical risks

Implementing risk mitigation controls that are considered quick wins

Implementing a one-size-fits-all set of controls across all organizational units

184. Which of the following devices, when placed in a demilitarized zone (DMZ), would be considered the MOST significant exposure?

Mail relay server

Proxy server

Database server

Application server

185. An information security team has discovered that users are sharing a login account to an application with sensitive information, in violation of the access policy. Business management indicates that the practice creates operational efficiencies.

What is the information security manager's BEST course of action?

Enforce the policy.

Modify the policy.

Present the risk to senior management.

Create an exception for the deviation.

186. Which of the following BEST enables an information security manager to determine the comprehensiveness of an organization's information security strategy?

Internal security audit

External security audit

Organizational risk appetite

Business impact analysis (BIA)

187. Which of the following is the PRIMARY responsibility of an information security governance committee?

Discussing upcoming information security projects

Reviewing the information security risk register

Approving changes to the information security strategy

Reviewing monthly information security metrics

188. Which of the following should an information security manager do FIRST when a mandatory security standard hinders the achievement of an identified business objective?

Revisit the business objective.

Escalate to senior management.

Perform a cost-benefit analysis.

Recommend risk acceptance.

189. An information security manager is updating the organization's incident response plan.

Which of the following is the BEST way to validate that the process and procedures provided by IT and business units are complete, accurate, and known by all responsible teams?

Review the test objectives with stakeholders.

Conduct a data breach incident tabletop exercise.

Conduct an incident response plan survey.

Review data breach incident triage steps.

190. Which of the following is the BEST way to evaluate the effectiveness of physical and environmental security controls implemented for fire-related disasters?

Conduct evacuation exercises

Review the disaster recovery plan (DRP)

Conduct awareness sessions

Review emergency management team procedures

Page 20 of 29

191. Which of the following BEST illustrates residual risk within an organization?

Heat map

Risk management framework

Business impact analysis (BIA)

Balanced scorecard

192. Which of the following provides an information security manager with the MOST accurate indication of the organization's ability to respond to a cyber attack?

Walk-through of the incident response plan

Black box penetration test

Simulated phishing exercise

Red team exercise

193. A data loss prevention (DLP) tool has flagged personally identifiable information (Pll) during transmission.

Which of the following should the information security manager do FIRST?

Validate the scope and impact with the business process owner.

Initiate the incident response plan.

Review and validate the rules within the DLP system.

Escalate the issue to senior management.

194. Which of the following is the MOST important issue in a penetration test?

Having an independent group perform the test

Obtaining permission from audit

Performing the test without the benefit of any insider knowledge

Having a defined goal as well as success and failure criteria

195. Which of the following is the FIRST step when conducting a post-incident review?

Identify mitigating controls.

Assess the costs of the incident.

Perform root cause analysis.

Assign responsibility for corrective actions.

196. Following an unsuccessful denial of service (DoS) attack, identified weaknesses should be:

quickly resolved and eliminated regardless of cost.

tracked and reported on until their final resolution.

documented in security awareness programs.

noted and re-examined later if similar weaknesses are found.

197. Which type of recovery site is MOST reliable and can support stringent recovery requirements?

Cold site

Warm site

Hot site

Mobile site

198. Which of the following MUST happen immediately following the identification of a malware incident?

Preparation

Recovery

Containment

Eradication

199. An employee has just reported the loss of a personal mobile device containing corporate information.

Which of the following should the information security manager do FIRST?

Initiate incident response.

Disable remote

Initiate a device reset.

Conduct a risk assessment.

200. Which of the following should be the GREATEST consideration when determining the recovery time objective (RTO) for an in-house critical application, database, or server?

Impact of service interruption

Results of recovery testing

Determination of recovery point objective (RPO)

Direction from senior management

Page 21 of 29

201. Which of the following MUST be established to maintain an effective information security governance framework?

Security controls automation

Defined security metrics

Change management processes

Security policy provisions

202. Which of the following security processes will BEST prevent the exploitation of system vulnerabilities?

Intrusion detection

Log monitoring

Patch management

Antivirus software

203. Which of the following is the PRIMARY benefit of an information security awareness training program?

Influencing human behavior

Evaluating organizational security culture

Defining risk accountability

Enforcing security policy

204. Which of the following has the MOST influence on the inherent risk of an information asset?

Risk tolerance

Net present value (NPV)

Return on investment (ROI)

Business criticality

205. Which of the following BEST enables staff acceptance of information security policies?

Strong senior management support

Gomputer-based training

Arobust incident response program

Adequate security funding

206. Which of the following should be the PRIMARY focus of an organization with immature incident detection capabilities?

Performing penetration testing

Improving user awareness

Installing new firewalls

Updating security policies

207. In which cloud model does the cloud service buyer assume the MOST security responsibility?

Disaster Recovery as a Service (DRaaS)

Infrastructure as a Service (laaS)

Platform as a Service (PaaS)

Software as a Service (SaaS)

208. What should be the FIRST step when an Internet of Things (loT) device in an organization's network is confirmed to have been hacked?

Monitor the network.

Perform forensic analysis.

Disconnect the device from the network

Escalate to the incident response team

209. Which of the following is the MOST important criterion when deciding whether to accept residual risk?

Cost of replacing the asset

Cost of additional mitigation

Annual loss expectancy (ALE)

Annual rate of occurrence

210. Which of the following will result in the MOST accurate controls assessment?

Mature change management processes

Senior management support

Well-defined security policies

Unannounced testing

Page 22 of 29

211. Which of the following is MOST important to include in an information security policy?

Best practices

Management objectives

Baselines

Maturity levels

212. When remote access to confidential information is granted to a vendor for analytic purposes, which of the following is the MOST important security consideration?

Data is encrypted in transit and at rest at the vendor site.

Data is subject to regular access log review.

The vendor must be able to amend data.

The vendor must agree to the organization's information security policy

213. An organization recently outsourced the development of a mission-critical business application.

Which of the following would be the BEST way to test for the existence of backdoors?

Scan the entire application using a vulnerability scanning tool.

Run the application from a high-privileged account on a test system.

Perform security code reviews on the entire application.

Monitor Internet traffic for sensitive information leakage.

214. Which of the following will have the GREATEST influence on the successful adoption of an information security governance program?

Security policies

Control effectiveness

Security management processes

Organizational culture

215. Identifying which of the following BEST enables a cyberattack to be contained?

The vulnerability exploited by the attack

The segment targeted by the attack

The IP address of the computer that launched the attack

The threat actor that initiated the attack

216. An employee clicked on a malicious link in an email that resulted in compromising company dat a.

What is the BEST way to mitigate this risk in the future?

Conduct phishing awareness training.

Implement disciplinary procedures.

Establish an acceptable use policy.

Assess and update spam filtering rules.

217. Which of the following presents the GREATEST challenge to a large multinational organization using an automated identity and access management (1AM) system?

Staff turnover rates that significantly exceed industry averages

Large number of applications in the organization

Inaccurate workforce data from human resources (HR)

Frequent changes to user roles during employment

218. The PRIMARY purpose for continuous monitoring of security controls is to ensure:

control gaps are minimized.

system availability.

effectiveness of controls.

alignment with compliance requirements.

219. Of the following, who is BEST suited to own the risk discovered in an application?

Information security manager

Senior management

System owner

Control owner

220. What should an information security manager verify FIRST when reviewing an information asset management program?

System owners have been identified.

Key applications have been secured.

Information assets have been classified.

Information assets have been inventoried.

Page 23 of 29

221. What should be an information security manager's FIRST step when developing a business case for a new intrusion detection system (IDS) solution?

Define the issues to be addressed.

Perform a cost-benefit analysis.

Calculate the total cost of ownership (TCO).

Conduct a feasibility study.

222. When updating the information security policy to accommodate a new regulation, the information security manager should FIRST:

Review key risk indicators (KRIs)

Perform a gap analysis

Consult process owners

Update key performance indicators (KPIs)

223. Which of the following has the MOST influence on the information security investment process?

IT governance framework

Information security policy

Organizational risk appetite

Security key performance indicators (KPIs)

224. Which of the following is MOST important to consider when determining asset valuation?

Asset recovery cost

Asset classification level

Cost of insurance premiums

Potential business loss

225. Which of the following is the BEST way to build a risk-aware culture?

Periodically change risk awareness messages.

Ensure that threats are documented and communicated in a timely manner.

Establish a channel for staff to report risks.

Periodically test compliance with security controls.

226. Which of the following provides the MOST comprehensive understanding of an organization's information security posture?

Security maturity assessment results

Threat analysis of the organization's environment

Results of vulnerability assessments

External penetration test findings

227. A penetration test was conducted by an accredited third party.

Which of the following should be the information security manager's FIRST course of action?

Ensure a risk assessment is performed to evaluate the findings

Ensure vulnerabilities found are resolved within acceptable timeframes

Request funding needed to resolve the top vulnerabilities

Report findings to senior management

228. Which of the following BEST demonstrates the added value of an information security program?

Security baselines

A gap analysis

A SWOT analysis

A balanced scorecard

229. Which of the following is the MOST effective way to convey information security responsibilities across an organization?

Implementing security awareness programs

Documenting information security responsibilities within job descriptions

Developing a skills matrix

Defining information security responsibilities in the security policy

230. An investigation of a recent security incident determined that the root cause was negligent handing of incident alerts by system admit manager to address this issue?

Conduct a risk assessment and share the result with senior management.

Revise the incident response plan-to align with business processes.

Provide incident response training to data custodians.

Provide incident response training to data owners.

Page 24 of 29

231. When integrating security risk management into an organization it is MOST important to ensure:

business units approve the risk management methodology.

the risk treatment process is defined.

information security policies are documented and understood.

the risk management methodology follows an established framework.

232. Which of the following is MOST important for guiding the development and management of a comprehensive information security program?

Adopting information security program management best practices

Implementing policies and procedures to address the information security strategy

Aligning the organization's business objectives with IT objectives

Establishing and maintaining an information security governance framework

233. Which of the following is the BEST tool to monitor the effectiveness of information security governance?

Key performance indicators (KPIs)

Balanced scorecard

Business impact analysis (BIA)

Risk profile

234. If the investigation of an incident is not completed within the time allocated in the incident response plan, which of the following actions should be taken by the incident response team?

Initiate the escalation process.

Continue the investigation.

Invoke the business continuity plan (BCP).

Engage the crisis management team.

235. 1.The MAIN benefit of implementing a data loss prevention (DLP) solution is to:

enhance the organization's antivirus controls.

eliminate the risk of data loss.

complement the organization's detective controls.

reduce the need for a security awareness program.

236. Which of the following is an information security manager's BEST recommendation to senior management following a breach at the organization's Software as a Service (SaaS) vendor?

Update the vendor risk assessment.

Engage legal counsel.

Renegotiate the vendor contract.

Terminate the relationship with the vendor.

237. Labeling information according to its security classification:

enhances the likelihood of people handling information securely.

reduces the number and type of countermeasures required.

reduces the need to identify baseline controls for each classification.

affects the consequences if information is handled insecurely.

238. To effectively manage an organization's information security risk, it is MOST important to:

assign risk management responsibility to an experienced consultant.

periodically identify and correct new systems vulnerabilities.

establish and communicate risk tolerance.

benchmark risk scenarios against peer organizations.

239. Which of the following analyses will BEST identify the external influences to an organization's information security?

Business impact analysis (BIA)

Gap analysis

Threat analysis

Vulnerability analysis

240. Of the following, who is BEST positioned to be accountable for risk acceptance decisions based on risk appetite?

Information security manager

Chief risk officer (CRO)

Information security steering committee

Risk owner

Page 25 of 29

241. Which of the following is the BEST course of action when an information security manager identifies that systems are vulnerable to emerging threats?

Frequently update systems and monitor the threat landscape.

Monitor the network containing the affected systems for malicious traffic.

Increase awareness of the threats among employees who work with the systems.

Notify senior management and key stakeholders of the threats.

242. A new information security reporting requirement will soon become effective.

Which of the following should be the information security manager's FIRST action?

Conduct a cost-benefit analysis related to noncompliance with the new requirement.

Perform a gap assessment against the new requirement.

Investigate to determine whether the new requirement applies to the business.

Inform senior management of the new requirement.

243. Which of the following is the MOST critical consideration when shifting IT operations to an Infrastructure as a Service (laaS) model hosted in a foreign country?

Labeling of data may help to ensure data is assigned to the correct cloud type.

Laws and regulations of the origin country may not be applicable.

There may be liabilities and penalties in the event of a security breach.

Data may be stored in unknown locations and may not be easily retrievable.

244. An organization's information security team presented the risk register at a recent information security steering committee meeting.

Which of the following should be of MOST concern to the committee?

No owners were identified for some risks.

Business applications had the highest number of risks.

Risk mitigation action plans had no timelines.

Risk mitigation action plan milestones were delayed.

245. The BEST way to integrate information security governance with corporate governance is to ensure:

the information security steering committee monitors compliance with security policies.

management teams embed information security into business processes.

awareness programs include industry best practice for information security governance.

the information security program is included in regular external audits.

246. An information security manager wants to document requirements detailing the minimum security controls required for user workstations.

Which of the following resources would be MOST appropriate for this purposed?

Guidelines

Policies

Procedures

Standards

247. How does an incident response team BEST leverage the results of a business impact analysis (BIA)?

Assigning restoration priority during incidents

Determining total cost of ownership (TCO)

Evaluating vendors critical to business recovery

Calculating residual risk after the incident recovery phase

248. Meeting which of the following security objectives BEST ensures that information is protected

against unauthorized disclosure?

Integrity

Authenticity

Confidentiality

Nonrepudiation

249. The business value of an information asset is derived from:

the threat profile.

its criticality.

the risk assessment.

its replacement cost.

250. Which of the following is the MOST important objective when planning an incident response program?

Managing resources

Ensuring IT resiliency

Recovering from a disaster

Minimizing business impact

Page 26 of 29

251. Which of the following BEST enables an information security manager to demonstrate the effectiveness of the information security and risk program to senior management?

Updated risk assessments

Counts of information security incidents

Audit reports

Monthly metrics

252. Which of the following is the PRIMARY objective of testing security controls within a critical infrastructure?

Ensuring the continued resilience and security of IT services

Decreasing the percentage of security deployments that cause failures in production

Reducing the number of control assessments to optimize resources

Identifying and addressing security team performance issues

253. Which of the following would MOST effectively ensure that a new server is appropriately secured?

Performing secure code reviews

Enforcing technical security standards

Conducting penetration testing

Initiating security scanning

254. Which of the following is the BEST course of action when an online company discovers a network attack in progress?

Dump all event logs to removable media

Isolate the affected network segment

Enable trace logging on ail events

Shut off all network access points

255. Which of the following is an example of a change to the external threat landscape?

The information security program has been outsourced.

A commonly used encryption algorithm has been compromised.

Industry security standards have been modified.

The organization has been purchased by another entity.

256. Which of the following is the PRIMARY purpose of a business impact analysis (BIA)?

To define security roles and responsibilities

To determine return on investment (ROI)

To establish incident severity levels

To determine the criticality of information assets

257. Which of the following should be of GREATEST concern to an information security manager when evaluating a cloud service provider?

Data retention policies are not documented

There is no right to audit the security of the provider

The provider is new to the market and lacks references

Security controls offered by the provider are inadequate

258. A risk owner has accepted a large amount of risk due to the high cost of controls.

Which of the following should be the information security manager's PRIMARY focus in this situation?

Establishing a strong ongoing risk monitoring process

Presenting the risk profile for approval by the risk owner

Conducting an independent review of risk responses

Updating the information security standards to include the accepted risk

259. Which of the following should be the PRIMARY area of focus when mitigating security risks associated with emerging technologies?

Compatibility with legacy systems

Application of corporate hardening standards

Integration with existing access controls

Unknown vulnerabilities

260. Which of the following is MOST useful to an information security manager when determining the need to escalate an incident to senior?

Incident management procedures

Incident management policy

System risk assessment

Organizational risk register

Page 27 of 29

261. Which of the following is the BEST way to determine the effectiveness of an incident response plan?

Reviewing previous audit reports

Conducting a tabletop exercise

Benchmarking the plan against best practices

Performing a penetration test

262. Which of the following is the PRIMARY reason to conduct a post-incident review?

To aid in future risk assessments

To improve the response process

To determine whether digital evidence is admissible

To notify regulatory authorities

263. A user reports a stolen personal mobile device that stores sensitive corporate dat a.

Which of the following will BEST minimize the risk of data exposure?

Prevent the user from using personal mobile devices.

Report the incident to the police.

Wipe the device remotely.

Remove user's access to corporate data.

264. Which of the following should be done FIRST when establishing an information security governance framework?

Evaluate information security tools and skills relevant for the environment.

Gain an understanding of the business and cultural attributes.

Contract a third party to conduct an independent review of the program.

Conduct a cost-benefit analysis of the framework.

265. Which of the following should be done FIRST when a SIEM flags a potential event?

Validate the event is not a false positive.

Initiate the incident response plan.

Escalate the event to the business owner.

Implement compensating controls.

266. Which of the following is MOST important to have in place as a basis for developing an effective information security program that supports the organization's business goals?

Metrics to drive the information security program

Information security policies

A defined security organizational structure

An information security strategy

267. The PRIMARY reason for creating a business case when proposing an information security project is to:

articulate inherent risks.

provide demonstrated return on investment (ROI).

establish the value of the project in relation to business objectives.

gain key business stakeholder engagement.

268. Which of the following is the MOST effective way to determine the alignment of an information security program with the business strategy?

Evaluate the results of business continuity testing.

Review key performance indicators (KPIs).

Evaluate the business impact of incidents.

Engage business process owners.

269. During the selection of a Software as a Service (SaaS) vendor for a business process, the vendor provides evidence of a globally accepted information security certification.

Which of the following is the MOST important consideration?

The certification includes industry-recognized security controls.

The certification was issued within the last five years.

The certification is issued for the specific scope.

The certification is easily verified.

270. Which type of system is MOST effective for prioritizing cyber incidents based on impact and tracking them until they are closed?

Security information and event management (SIEM)

Extended detection and response (XDR)

Endpoint detection and response (EDR)

Network intrusion detection system (NIDS)

Page 28 of 29

271. ACISO learns that a third-party service provider did not notify the organization of a data breach that affected the service provider's data center.

Which of the following should the CISO do FIRST?

Recommend canceling the outsourcing contract.

Request an independent review of the provider's data center.

Notify affected customers of the data breach.

Determine the extent of the impact to the organization.

272. Who is accountable for ensuring proper controls are in place to address the confidentiality and availability of an information system?

Senior management

Information owner

Business manager

Information security manager

273. During the implementation of a new system, which of the following processes proactively minimizes the likelihood of disruption, unauthorized alterations, and errors?

Configuration management

Password management

Change management

Version management

274. An information security manager has learned of an increasing trend in attacks that use phishing emails impersonating an organization's CEO in an attempt to commit wire transfer fraud.

Which of the following is the BEST way to reduce the risk associated with this type of attack?

Temporarily suspend wire transfers for the organization.

Provide awareness training to the CEO for this type of phishing attack.

Provide awareness training to staff responsible for wire transfers.

Disable emails for staff responsible for wire transfers.

275. Which of the following BEST supports investments in an information security program?

Business cases

Business impact analysis (BIA)

Gap analysis results

Risk assessment results

276. Which of the following defines the triggers within a business continuity plan (BCP)?

Needs of the organization

Disaster recovery plan (DRP)

Information security policy

Gap analysis

277. Which of the following should be the PRIMARY basis for establishing metrics that measure the effectiveness of an information security program?

Residual risk

Regulatory requirements

Risk tolerance

Control objectives

278. A PRIMARY benefit of adopting an information security framework is that it provides:

credible emerging threat intelligence.

security and vulnerability reporting guidelines.

common exploitability indices.

standardized security controls.

279. Which of the following is MOST important for an information security manager to consider when developing a business continuity plan (BCP) for ransomware attacks?

Backups are maintained offline and regularly tested.

Impacted networks can be detached at the network switch level.

Production data is continuously replicated between primary and secondary sites.

Backups are maintained on multiple sites and regularly reviewed.

280. An information security manager learns that business unit leaders are encouraging increased use of social media platforms to reach customers.

Which of the following should be done FIRST to help mitigate the risk of confidential information being disclosed by employees on social media?

Establish an organization-wide social media policy.

Develop sanctions for misuse of social media sites.

Monitor social media sites visited by employees.

Restrict social media access on corporate devices.

Page 29 of 29

281. The PRIMARY benefit of integrating information security activities into change management processes is to:

protect the organization from unauthorized changes.

ensure required controls are included in changes.

provide greater accountability for security-related changes in the business.

protect the business from collusion and compliance threats.

282. Which of the following is the BEST starting point for a newly hired information security manager who has been tasked with identifying and addressing network vulnerabilities?

Controls analysis

Emerging risk review

Penetration testing

Traffic monitoring

283. Which of the following processes BEST supports the evaluation of incident response effectiveness?

Root cause analysis

Post-incident review

Chain of custody

Incident logging

284. Which of the following is MOST helpful in determining whether a phishing email is malicious?

Security awareness training

Reverse engineering

Threat intelligence

Sandboxing

285. Which of the following is the BEST indication of an effective information security program?

A. Risk is treated to an acceptable level.

B. The number of security incidents reported by staff has increased.

C. Key risk indicators (KRIs) are established.

D. Policies are reviewed and approved by senior management.

TAGS:

CISM, CISM exam dumps

Notify of

Label

Name*

Email*

Website

Label

Name*

Email*

Website

0 Comments

Oldest

Newest Most Voted

Inline Feedbacks

View all comments

Get CISM Dumps Full Version

Q&As: 966
Versions: PDF and Software Download Now

About Dumpsinfo

Dumpsinfo is a good platform providing the latest exam information and dumps questions for all IT certification exams. You can study all the latest exam dumps questions online.

[email protected]

Mon - Sat 9:00am - 6:00pm

CISM Exam Dumps – Reliable Way to Pass and Get Certified

Related

Posts

AAIA Exam Dumps – Reliable Way to Pass and Get Certified

Advance Your Career by Using Online COBIT Design and Implementation Dumps

Test Online CCOA Dumps Questions to Be Certified

CRISC Exam Dumps – Reliable Way to Pass and Get Certified

About Us

EMAIL

Services

Opening Hours