Certified Information Security Manager (CISM) practice questions

Question 1

Unintentional employee behavior caused a major data-loss incident. Which action is the best way for the information security manager to prevent recurrence?

Accepted Answer

Implement compensating controls that address the identified control weakness

Answer

Improve the security-awareness training program

Answer

Communicate consequences for future instances

Answer

Enhance the data loss prevention solution without first confirming the root cause

Question 2

A multi-component identity and access management initiative is too expensive and complex for a single implementation. What is the best basis for prioritizing its components?

Accepted Answer

Reduction in residual risk

Answer

Cost of implementation alone

Answer

Ease of implementation alone

Answer

Direct financial benefit alone

Question 3

To overcome the perception that security is a hindrance to business activities, what should an information security manager do?

Accepted Answer

Promote security’s relevance and contribution to business objectives

Answer

Rely on senior management to enforce security

Answer

Repeatedly state that security is necessary

Answer

Focus communications primarily on compliance

Question 4

What is the primary governance reason for senior management to review information-security reports?

Accepted Answer

To ensure information-security risk is managed cost-effectively in support of business objectives

Answer

To assess individual control-test results

Answer

To confirm that audits occur on a fixed schedule

Answer

To perform operational security staffing decisions

Question 5

Privileged employee access to production servers is approved, but the users’ actions are not logged. What is the greatest concern?

Accepted Answer

Lack of accountability

Answer

Inadequate authentication

Answer

Lack of availability

Answer

Improper authorization

Question 6

Which method best demonstrates whether an information-security program provides appropriate coverage of its requirements?

Accepted Answer

Gap assessment

Answer

Security risk analysis

Answer

Maturity assessment

Answer

Vulnerability scan report

Question 7

Which input is most helpful when determining security-related service-level requirements for an outsourced application?

Accepted Answer

Data classification

Answer

Application capabilities

Answer

The supplier’s existing business continuity plan

Answer

The organization’s general information-security policy

Question 8

Which type of control is most useful during eradication after a cyberattack has been contained?

Accepted Answer

Corrective

Answer

Deterrent

Answer

Detective

Answer

Preventive

Question 9

When properly implemented, secure transmission protocols primarily protect transactions from which threat?

Accepted Answer

Eavesdropping while data is in transit

Answer

Unauthorized access to data stored in the server database

Answer

Malware already running on the client desktop

Answer

Denial-of-service attacks

Question 10

Which element is most important to include in an information-security strategy plan?

Accepted Answer

Clearly defined security priorities aligned with organizational objectives

Answer

Business impact analysis results

Answer

A detailed list of the organization’s most valuable assets

Answer

The security organizational structure

Certified Information Security Manager (CISM) practice questions

Question stream

Discussion

Manage your cookie preferences

Loading subject practice

Loading Brainliest

Loading subject practice

Certified Information Security Manager (CISM) practice questions

Question stream

Discussion

Practice overview