New 2022 CISM exam questions Welcome to download the newest PracticeVCE CISM PDF dumps (1340 Q&As)
P.S. Free 2022 Isaca Certification CISM dumps are available on Google Drive shared by PracticeVCE
NEW QUESTION 497
A company recently developed a breakthrough technology. Since this technology could give this company a significant competitive edge, which of the following would FIRST govern how this information is to be protected?
- A. Data classification policy
- B. Access control policy
- C. Acceptable use policy
- D. Encryption standards
Answer: A
Explanation:
Data classification policies define the level of protection to be provided for each category of data. Without this mandated ranking of degree of protection, it is difficult to determine what access controls or levels of encryption should be in place. An acceptable use policy is oriented more toward the end user and, therefore, would not specifically address what controls should be in place to adequately protect information.
NEW QUESTION 498
Which of the following is the MOST critical activity to ensure the ongoing security of outsourced IT services?
- A. Conduct regular security reviews of the third-party provider
- B. Request that the third-party provider comply with the organization's information security policy
- C. Provide security awareness training to the third-party provider's employees
- D. Include security requirements in the service contract
Answer: A
Explanation:
Explanation/Reference:
Explanation:
Regular security audits and reviews of the practices of the provider to prevent potential information security damage will help verify the security of outsourced services. Depending on the type of services outsourced, security awareness may not be necessary. Security requirements should be included in the contract, but what is most important is verifying that the requirements are met by the provider. It is not necessary to require the provider to fully comply with the policy if only some of the policy is related and applicable.
NEW QUESTION 499
From an information security perspective, legal issues associated with a transborder flow of technology- related items are MOST often related to:
- A. software patches and corporate data.
- B. website transactions and taxation.
- C. encryption tools and personal data.
- D. lack of competition and free trade.
Answer: C
Explanation:
Section: INFORMATION SECURITY PROGRAM MANAGEMENT
NEW QUESTION 500
Senior management commitment and support for information security will BEST be attained by an information security manager by emphasizing:
- A. security needs.
- B. the responsibilities of organizational units.
- C. organization wide metrics.
- D. organizational risk.
Answer: D
Explanation:
Information security exists to help the organization meet its objectives. The information security manager should identify information security needs based on organizational needs. Organizational or business risk should always take precedence. Involving each organizational unit in information security and establishing metrics to measure success will be viewed favorably by senior management after the overall organizational risk is identified.
NEW QUESTION 501
Senior management has decided to accept a significant risk within a security remediation plan.
Which of the following is the information security manager's BEST course of action?
- A. Update the risk register with the risk acceptance.
- B. Communicate the remediation plan to the board of directors.
- C. Report the risk acceptance to regulatory agencies.
- D. Remediate the risk and document the rationale.
Answer: B
Explanation:
Section: INFORMATION RISK MANAGEMENT
NEW QUESTION 502
Implementing a strong password policy is part of an organization's information security strategy for the year.
A business unit believes the strategy may adversely affect a client's adoption of a recently developed mobile application and has decided not to implement the policy.
Which of the following is the information security manager's BEST course of action?
- A. Benchmark with similar mobile applications to identify gaps.
- B. Escalate non-implementation of the policy to senior management.
- C. Analyze the risk and impact of not implementing the policy.
- D. Develop and implement a password policy for the mobile application.
Answer: B
Explanation:
Section: INFORMATION SECURITY PROGRAM DEVELOPMENT
NEW QUESTION 503
A border router should be placed on which of the following?
- A. IDS server
- B. Domain boundary
- C. Web server
- D. Screened subnet
Answer: B
Explanation:
Section: INFORMATION SECURITY PROGRAM DEVELOPMENT
Explanation:
A border router should be placed on a (security) domain boundary. Placing it on a web server or screened subnet, which is a demilitarized zone (DMZ) would not provide any protection. Border routers are positioned on the boundary of the network, but do not reside on a server.
NEW QUESTION 504
Which of the following is the PRIMARY purpose of data classification?
- A. To ensure integrity of data
- B. To provide a basis for protecting data
- C. To select encryption technology
- D. To determine access rights to data
Answer: B
NEW QUESTION 505
Which of the following is MOST important to consider when developing a business continuity plan (BCP)?
- A. Business impact analysis (BIA)
- B. Disaster recovery plan (DRP)
- C. Incident management requirements
- D. Business communication plan
Answer: A
Explanation:
Section: INFORMATION SECURITY PROGRAM DEVELOPMENT
NEW QUESTION 506
Which of the following is the MOST important action to take when engaging third-party consultants to conduct an attack and penetration test?
- A. Provide clear directions to IT staff
- B. Monitor intrusion detection system (IDS) and firewall logs closely
- C. Establish clear rules of engagement
- D. Request a list of the software to be used
Answer: C
Explanation:
Explanation/Reference:
Explanation:
It is critical to establish a clear understanding on what is permissible during the engagement. Otherwise, the tester may inadvertently trigger a system outage or inadvertently corrupt files. Not as important, but still useful, is to request a list of what software will be used. As for monitoring the intrusion detection system (IDS) and firewall, and providing directions to IT staff, it is better not to alert those responsible for monitoring (other than at the management level), so that the effectiveness of that monitoring can be accurately assessed.
NEW QUESTION 507
Which of the following will BEST ensure that possible security incidents are correctly distinguished from typical help desk requests?
- A. Updating the help desk manual
- B. Periodic training of help desk personnel
- C. Establishing a security incident hotline
- D. Reviewing the help desk log
Answer: B
NEW QUESTION 508
When the inherent risk of a business activity is lower than the acceptable risk level, the BEST course of action would be to:
- A. monitor for business changes
- B. report compliance to management
- C. review the residual risk level
- D. implement controls to mitigate the risk
Answer: C
Explanation:
Section: INFORMATION RISK MANAGEMENT
NEW QUESTION 509
The PRIMARY purpose of establishing an information security governance framework should be to:
- A. establish the business case for strategic integration of information security in organizational efforts.
- B. align information security strategy and investments to support organizational activities.
- C. align corporate governance, activities, and investments to information security goals.
- D. document and communicate how the information security program functions within the organization.
Answer: B
NEW QUESTION 510
Which of the following is MOST helpful in identifying external and internal factors that could influence the organization's future information security posture?
- A. Penetration testing
- B. SWOT analysis
- C. IT balanced scorecard
- D. Current risk tolerance
Answer: B
NEW QUESTION 511
The MAIN reason for continuous monitoring of a security strategy is to:
- A. optimize resource allocation.
- B. confirm benefits are being realized.
- C. evaluate the implementation of the strategy.
- D. allocate funds for information security
Answer: C
NEW QUESTION 512
An organization with a maturing incident response program conducts post-incident reviews for all major information security incidents. The PRIMARY goal of these reviews should be to:
- A. identify security program gaps or systemic weaknesses that need correction.
- B. identify who should be held accountable for the security incidents.
- C. prepare properly vetted notifications regarding the incidents to external parties.
- D. document and report the root cause of the incidents for senior management.
Answer: D
NEW QUESTION 513
Which of the following would be helpful in determining an organization's current capacity to mitigate risk?
- A. Capability maturity model
- B. Vulnerability assessment
- C. Business impact analysis
- D. IT security risk and exposure
Answer: A
NEW QUESTION 514
A penetration test was conducted by an accredited third party. Which of the following should be the information security manager's FIRST
- A. Report findings to senior management.
- B. Ensure vulnerabilities found are resolved within acceptable timeframes.
- C. Ensure a risk assessment is performed to evaluate the findings.
- D. Request funding needed to resolve the top vulnerabilities.
Answer: C
NEW QUESTION 515
......
CISM exam questions from PracticeVCE dumps: https://www.practicevce.com/ISACA/CISM-practice-exam-dumps.html (1340 Q&As)
Free 2022 Isaca Certification CISM dumps are available on Google Drive shared by PracticeVCE: https://drive.google.com/open?id=1n5pGzGLFJLNKtPLQyaMcysurL72Wbfwz