Spring Sale Limited Time 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: 65pass65

CISM Certified Information Security Manager is now Stable and With Pass Result | Test Your Knowledge for Free

CISM Practice Questions

Certified Information Security Manager

Last Update 3 days ago
Total Questions : 1044

Dive into our fully updated and stable CISM practice test platform, featuring all the latest Isaca Certification exam questions added this week. Our preparation tool is more than just a Isaca study aid; it's a strategic advantage.

Our free Isaca Certification practice questions crafted to reflect the domains and difficulty of the actual exam. The detailed rationales explain the 'why' behind each answer, reinforcing key concepts about CISM. Use this test to pinpoint which areas you need to focus your study on.

CISM PDF

CISM PDF (Printable)
$69.65
$199

CISM Testing Engine

CISM PDF (Printable)
$78.75
$225

CISM PDF + Testing Engine

CISM PDF (Printable)
$87.15
$249
Question # 1

Which of the following is the BEST way to help ensure an organization's risk appetite will be considered as part of the risk treatment process?

Options:

A.  

Establish key risk indicators (KRIs).

B.  

Use quantitative risk assessment methods.

C.  

Provide regular reporting on risk treatment to senior management

D.  

Require steering committee approval of risk treatment plans.

Discussion 0
Question # 2

Which of the following roles has the PRIMARY responsibility to ensure the operating effectiveness of IT controls?

Options:

A.  

Risk owner

B.  

Control tester

C.  

IT compliance leader

D.  

Information security manager

Discussion 0
Question # 3

Which of the following is the BEST way to assess the risk associated with using a Software as a Service (SaaS) vendor?

Options:

A.  

Verify that information security requirements are included in the contract.

B.  

Request customer references from the vendor.

C.  

Require vendors to complete information security questionnaires.

D.  

Review the results of the vendor's independent control reports.

Discussion 0
Question # 4

The MOST effective tools for responding to new and advanced attacks are those that detect attacks based on:

Options:

A.  

signature analysis.

B.  

behavior analysis.

C.  

penetration testing.

D.  

data packet analysis.

Discussion 0
Question # 5

Which of the following factors would have the MOST significant impact on an organization's information security governance mode?

Options:

A.  

Outsourced processes

B.  

Security budget

C.  

Number of employees

D.  

Corporate culture

Discussion 0
Question # 6

Which of the following has the GREATEST impact on the effectiveness of an organization’s security posture?

Options:

A.  

Incident metrics are frequently compared against industry benchmarks

B.  

New hires are mandated to attend security training

C.  

Security is embedded in organizational culture

D.  

Senior management has approved and endorsed security practices

Discussion 0
Question # 7

An organization's information security manager reads on social media that a recently purchased vendor product has been compromised and customer data has been posted online. What should the information security manager do FIRST?

Options:

A.  

Perform a business impact analysis (BIA).

B.  

Notify local law enforcement agencies of a breach.

C.  

Activate the incident response program.

D.  

Validate the risk to the organization.

Discussion 0
Question # 8

When conducting a post-implementation review for a security investment, it is MOST important to determine whether the investment:

Options:

A.  

Meets internal requirements

B.  

Complies with industry standards

C.  

Achieves projected financial benefits

D.  

Delivers anticipated risk reduction

Discussion 0
Question # 9

Which of the following is a viable containment strategy for a distributed denial of service (DDoS) attack?

Options:

A.  

Block IP addresses used by the attacker

B.  

Redirect the attacker's traffic

C.  

Disable firewall ports exploited by the attacker.

D.  

Power off affected servers

Discussion 0
Question # 10

Which of the following should be an information security manager's PRIMARY concern when an organization is expanding business to a new country?

Options:

A.  

Compliance with local regulations

B.  

Changes in IT infrastructure

C.  

Cultural differences in the new country

D.  

Ability to gather customer data

Discussion 0
Question # 11

Which of the following would be the BEST way to reduce the risk of disruption resulting from an emergency system change?

Options:

A.  

Confirm the change implementation is scheduled.

B.  

Verify the change request has been approved.

C.  

Confirm rollback plans are in place.

D.  

Notify users affected by the change.

Discussion 0
Question # 12

Which of the following should be given the HIGHEST priority during an information security post-incident review?

Options:

A.  

Documenting actions taken in sufficient detail

B.  

Updating key risk indicators (KRIs)

C.  

Evaluating the performance of incident response team members

D.  

Evaluating incident response effectiveness

Discussion 0
Question # 13

The PRIMARY advantage of single sign-on (SSO) is that it will:

Options:

A.  

increase efficiency of access management

B.  

increase the security of related applications.

C.  

strengthen user passwords.

D.  

support multiple authentication mechanisms.

Discussion 0
Question # 14

Which of the following is the PRIMARY role of an information security manager in a software development project?

Options:

A.  

To enhance awareness for secure software design

B.  

To assess and approve the security application architecture

C.  

To identify noncompliance in the early design stage

D.  

To identify software security weaknesses

Discussion 0
Question # 15

When updating the information security policy to accommodate a new regulation, the information security manager should FIRST:

Options:

A.  

Review key risk indicators (KRIs)

B.  

Perform a gap analysis

C.  

Consult process owners

D.  

Update key performance indicators (KPIs)

Discussion 0
Question # 16

Which of the following is MOST important to the effectiveness of an information security steering committee?

Options:

A.  

The committee has strong regulatory knowledge.

B.  

The committee is comprised of representatives from senior management.

C.  

The committee has cross-organizational representation.

D.  

The committee uses a risk management framework.

Discussion 0
Question # 17

Spoofing should be prevented because it may be used to:

Options:

A.  

gain illegal entry to a secure system by faking the sender's address,

B.  

predict which way a program will branch when an option is presented

C.  

assemble information, track traffic, and identify network vulnerabilities.

D.  

capture information such as passwords traveling through the network

Discussion 0
Question # 18

Senior management wants to thoroughly test a disaster recovery plan (DRP) for a mission-critical system. Which of the following would provide the MOST reliable results?

Options:

A.  

Full interruption test

B.  

Parallel test

C.  

Simulation test

D.  

Structured walk-through

Discussion 0
Question # 19

A project team member notifies the information security manager of a potential security risk that has not been included in the risk register. Which of the following should the information security manager do FIRST?

Options:

A.  

Implement compensating controls.

B.  

Analyze the identified risk.

C.  

Prepare a risk mitigation plan.

D.  

Add the risk to the risk register.

Discussion 0
Question # 20

Who should be responsible for determining the level of data classification required for an application related to a new line of business?

Options:

A.  

Data analyst

B.  

Information security officer (ISO)

C.  

Data custodian

D.  

Data owners

Discussion 0
Get CISM dumps and pass your exam in 24 hours!

Free Exams Sample Questions