CISM by ISACA Actual Free Exam Q&As

Question 1

Which of the following provides the BEST indication of the return on information security investment?

A. Increased annualized loss expectancy (ALE) B. Decreased number of reported incidents C. Increased number of reported incidents D. Reduced annualized loss expectancy (ALE)

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 2

Which of the following is MOST important to have in place for an organization ' s information security program to be effective?

A. Defined and allocated budget B. Documented information security processes C. A comprehensive IT strategy D. Senior management support

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 3

Which of the following BEST enables an organization to operate smoothly with reduced capacities when service has been disrupted?

A. Business continuity plan (BCP) B. Crisis management plan C. Incident response plan D. Disaster recovery plan (DRP)

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 4

Which of the following is MOST important to have in place to help ensure an organization ' s cybersecurity program meets the needs of the business?

A. Information security metrics B. Risk assessment program C. Information security governance D. Information security awareness training

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 5

Which of the following is the BEST course of action when confidential information is inadvertently disseminated outside the organization?

A. Communicate the exposure. B. Review compliance requirements. C. Declare an incident. D. Change the encryption keys.

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 6

When updating the information security policy to accommodate a new regulation, the information security manager should FIRST:

A. Perform a gap analysis B. Review key risk indicators (KRIs) C. Consult process owners D. Update key performance indicators (KPIs)

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 7

Which of the following defines the MOST comprehensive set of security requirements for a newly developed information system?

A. Key risk indicators (KRIs) B. Risk assessment results C. Audit findings D. Baseline controls

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 8

Which of the following is the MOST effective approach when reporting on the security program to business leadership?

A. Linking security to business strategy B. Outlining security audit results by line of business C. Reporting on industry security benchmarks D. Providing comprehensive security statistics

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 9

Which of the following BEST facilitates recovery of data lost as a result of a cybersecurity incident?

A. Disaster recovery plan (DRP) B. Removable storage media C. Encrypted data drives D. Offsite data backups

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 10

The MOST appropriate time to conduct a disaster recovery test would be after:

A. major business processes have been redesigned. B. the business continuity plan (BCP) has been updated. C. the security risk profile has been reviewed D. noncompliance incidents have been filed.

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 11

Which of the following should be the KEY consideration when creating an information security communication plan with industry peers?

A. Notifying the legal department whenever incident-related information is shared B. Reducing the costs associated with information sharing by automating the process C. Balancing the benefits of information sharing with the drawbacks of sharing sensitive information D. Ensuring information is detailed enough to be of use to other organizations

Discussion 0

Correct Answer: C Vote an answer

Question 12

Which of the following documents should contain the INITIAL prioritization of recovery of services?

A. Business impact analysis (BIA) B. IT risk analysis C. Threat assessment D. Business process map

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 13

Which of the following is MOST important for an information security manager to consider when identifying information security resource requirements?

A. Information security strategy B. Availability of potential resources C. Current resourcing levels D. Information security incidents

Discussion 0

Correct Answer: C Vote an answer

ISACA Certified Information Security Manager - CISM Exam Practice Test