CISM by ISACA Actual Free Exam Q&As

Question 1

An information security manager has completed a risk assessment for a business information system. Of the following, who is BEST positioned to decide on the implementation of mitigating controls?

A. Chief information officer (CIO) B. System administrator C. Risk manager D. System owner

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 2

Which of the following risk assessment findings for an online-only business should be given the HIGHEST priority to address availability concerns?

A. The web server for the online store was found to be vulnerable to distributed denial of service (DDoS) attacks. B. Email authentication through a connector to a single sign-on (SSO) service has a history of failure. C. The back office system that processes payments to providers has slowed. D. The access point for the visitor WiFi network has several unpatched vulnerabilities.

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 3

A department has reported that a security control is no longer effective. Which of the following is the information security manager's BEST course of action?

A. Check for defense in depth. B. Assess the control state. C. Replace the control. D. Report the failure to management.

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 4

Which of the following should be the PRIMARY objective for creating a culture of security within an organization?

A. To obtain resources for information security initiatives B. To reduce risk to acceptable levels C. To demonstrate control effectiveness to senior management D. To prioritize security within the organization

Discussion 0

Correct Answer: B Vote an answer

Question 5

An organization has been adhering to the requirements of stringent cybersecurity legislation in one of its local markets and a change to the legislation has recently occurred. Which of the following should the organization do FIRST?

A. Determine the effectiveness of existing controls. B. Reassess the applicability of the requirements on the business. C. Communicate the changes in requirements to senior management. D. Develop an implementation plan to address compliance gaps.

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 6

Which of the following is MOST important to ensure the alignment of an information security program with the organizational strategy?

A. Adoption of an industry recognized framework B. Benchmarking against industry peers C. Approval from senior management D. Identification of business-specific risk factors

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 7

Which of the following should an information security manager do FIRST when developing an organization's disaster recovery plan (DRP)?

A. Perform a business impact analysis (BIA) B. Conduct a risk assessment C. Identify business requirements D. Document disaster recovery procedures

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 8

Which of the following is the BEST reason to separate short-term from long-term plans within an information security roadmap?

A. To satisfy regulatory requirements B. To allocate resources for initiatives C. To facilitate business plan reporting to management D. To facilitate the engagement of business stakeholders

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 9

An organization received a regulatory fine for failing to report a security incident on time, and the root cause was determined to be the misclassification of the incident. Which of the following is the BEST way to address this issue?

A. Consult with the legal department. B. Increase the sensitivity of security detection and alerting. C. Provide incident identification training for help desk staff. D. Update the incident response plan to include senior management.

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

ISACA Certified Information Security Manager - CISM Exam Practice Test