CISM 5 Flashcards
- Which of the following is the BEST way to ensure the business continuity plan (BCP) is current?
A. Manage business process changes.
B. Update business impact analyses (BIAs) on a regular basis.
C. Conduct periodic testing.
D. Review and update emergency contact lists.
Answer: C
Explanation:
Conducting periodic testing is the best way to ensure the BCP is current because it can validate the
effectiveness and efficiency of the BCP, identify any gaps or weaknesses, and provide feedback and
recommendations for improvement. Testing can also verify that the BCP reflects the current business
environment, processes, and requirements, and that the BCP team members are familiar with their roles
and responsibilities.
References: The CISM Review Manual 2023 states that “testing is a critical component of the BCP
process” and that “testing can help ensure that the BCP is current, effective, and efficient, and that it meets
the business objectives and expectations” (p. 195). The CISM Review Questions, Answers & Explanations
Manual 2023 also provides the following rationale for this Answer: “Conducting periodic testing is the
correct answer because it is the best way to ensure the BCP is current, as it can evaluate the BCP against
the current business environment, processes, and requirements, and identify any areas for improvement or
update” (p. 98). Additionally, the article Business Continuity Planning: Testing an Organization’s Plan from
the ISACA Journal 2019 states that “testing is essential to ensure that the BCP is current and effective” and
that “testing can provide assurance that the BCP is aligned with the business needs and expectations, and
that the BCP team members are competent and confident in executing their tasks” (p. 1)
- Which of the following is MOST important to determine following the discovery and eradication of a
malware attack?
A. The malware entry path
B. The creator of the malware
C. The type of malware involved
D. The method of detecting the malware
Answer: A
- Which of the following should be an information security manager s MOST important consideration when
determining the priority for implementing security controls?
A. Alignment with industry benchmarks
B. Results of business impact analyses (BIAs)
C. Possibility of reputational loss due to incidents
D. Availability of security budget
Answer: B
Explanation: The priority for implementing security controls should be based on the results of BIAs, which
identify the criticality and recovery requirements of business processes and the supporting information
assets. BIAs help to align security controls with business needs and objectives, and to optimize the
allocation of security resources. Alignment with industry benchmarks, possibility of reputational loss due to
incidents, and availability of security budget are important factors, but they are not the most important
consideration for determining the priority for implementing security
controls. References = CISM Review Manual, 16th Edition, page 971; CISM Review Questions, Answers &
Explanations Manual, 10th Edition, page 2672
- Which of the following is BEST used to determine the maturity of an information security program?
A. Security budget allocation
B. Organizational risk appetite
C. Risk assessment results
D. Security metrics
Answer: D
Explanation:
Security metrics are the best way to determine the maturity of an information security program because
they are quantifiable indicators of the performance and effectiveness of the security controls and processes.
Security metrics help to evaluate the current state of security, identify gaps and weaknesses, measure
progress and improvement, and communicate the value and impact of security to stakeholders. Therefore,
security metrics are the correct answer.
References:
✑ https://www.isac
A.org/resources/isaca-journal/issues/2020/volume-6/keyCertify
For Sure with IT Exam Dumps
The No.1 IT Certification Dumps
384
performance-indicators-for-security-governance-part-1
✑ https://www.gartner.com/en/publications/protect-your-business-assets-withroadmap-
for-maturing-information-security
- During which of the following development phases is it MOST challenging to implement security controls?
A. Post-implementation phase
B. Implementation phase
C. Development phase
D. Design phase
Answer: C
Explanation: The development phase is the stage of the system development life cycle (SDLC) where the
system requirements, design, architecture, and implementation are performed. The development phase is
most challenging to implement security controls because it involves complex and dynamic processes that
may not be well understood or documented. Security controls are essential for ensuring the confidentiality,
integrity, and availability of the system and its data, as well as for complying with regulatory and contractual
obligations. However, security controls may also introduce additional costs, risks, and constraints to the
development process, such as:
✑ Increased complexity and overhead of testing, verification, validation, and
maintenance
✑ Reduced flexibility and agility of changing requirements or design
✑ Increased dependency on external vendors or third parties for security services or products
✑ Increased vulnerability to errors, defects, or vulnerabilities in the code or configuration
✑ Increased difficulty in measuring and reporting on security performance or effectiveness
Therefore, implementing security controls in the development phase requires careful planning, coordination,
communication, and collaboration among all stakeholders involved in the SDLC. It also requires a clear
understanding of the security objectives, scope, criteria, standards, policies, procedures, roles,
responsibilities, and resources for the system. Moreover, it requires a proactive approach to identifying and
mitigating potential threats or risks that may affect the security of the system.
References = CISM Manual1, Chapter 3: Information Security Program Development (ISPD), Section 3.1:
System Development Life Cycle (SDLC)2
1: https://store.isac
A.org/s/store#/store/browse/cat/a2D4w00000Ac6NNEAZ/tiles 2:
https://store.isac
A.org/s/store#/store/browse/cat/a2D4w00000Ac6NNEAZ/tiles
- Which of the following eradication methods is MOST appropriate when responding to an incident resulting
in malware on an application server?
A. Disconnect the system from the network.
B. Change passwords on the compromised system.
C. Restore the system from a known good backup.
D. Perform operation system hardening.
Answer: C
Explanation:
Restoring the system from a known good backup is the most appropriate eradication method when
responding to an incident resulting in malware on an application server, as it ensures that the system is free
of any malicious code and that the data and applications are consistent with the expected state.
Disconnecting the system from the network may prevent further spread of the malware, but it does not
eradicate it from the system. Changing passwords on the compromised system may reduce the risk of
unauthorized access, but it does not remove the malware from the system. Performing operation system
hardening may improve the security configuration of the system, but it does not guarantee that the malware
is eliminated from the system.
References = CISM Review Manual 2022, page 3131; CISM Exam Content Outline, Domain 4, Task 4.4
- An organization provides notebook PCs, cable wire locks, smartphone access, and virtual private network
(VPN) access to its remote employees. Which of the following is MOST important for the information
security manager to ensure?
A. Employees use smartphone tethering when accessing from remote locations.
B. Employees physically lock PCs when leaving the immediate are
A.
C. Employees are trained on the acceptable use policy.
D. Employees use the VPN when accessing the organization’s online resources.
Answer: D
Explanation:
Using the VPN when accessing the organization’s online resources is the most important thing to ensure,
as it provides a secure and encrypted connection between the remote employees and the organization’s
network, and protects the data and systems from unauthorized access, interception, or tampering. VPNs
also help to comply with the organization’s security policies and standards, and to prevent data leakage or
breaches. References = CISM Review Manual 2022, page 3081; CISM Exam Content Outline, Domain 4,
Knowledge Statement 4.92; CISM 2020: Remote Access Security; How to Secure Remote Workers with
VPN
- A penetration test against an organization’s external web application shows several vulnerabilities. Which
of the following presents the GREATEST concern?
A. A rules of engagement form was not signed prior to the penetration test
B. Vulnerabilities were not found by internal tests
C. Vulnerabilities were caused by insufficient user acceptance testing (UAT)
D. Exploit code for one of the vulnerabilities is publicly available
Answer: D
Explanation:
Exploit code for one of the vulnerabilities is publicly available presents the greatest concern because it
means that anyone can easily exploit the vulnerability and compromise the web application. This increases
the risk of data breach, denial of service, or other malicious attacks. Therefore, exploit code for one of the
vulnerabilities is publicly available is the correct answer.
References:
✑ https://www.imperv
A.com/learn/application-security/penetration-testing/
✑ https://www.netspi.com/blog/technical/web-application-penetration-testing/are-youtesting-
your-web-application-for-vulnerabilities/
- Which of the following provides the MOST useful information for identifying security control gaps on an
application server?
A. Risk assessments
B. Threat models
C. Penetration testing
D. Internal audit reports
Answer: C
Explanation: Penetration testing is the most useful method for identifying security control gaps on an
application server because it simulates real-world attacks and exploits the vulnerabilities and weaknesses
of the application server. Penetration testing can reveal the actual impact and risk of the security control
gaps, and provide recommendations for remediation and improvement.
References: The CISM Review Manual 2023 defines penetration testing as “a method of evaluating the
security of an information system or network by simulating an attack from a malicious source” and states
that “penetration testing can help identify security control gaps and provide evidence of the potential impact
and risk of the gaps” (p. 185). The CISM Review Questions, Answers & Explanations Manual 2023 also
provides the following rationale for this Answer: “Penetration testing is the correct answer because it is the
most useful method for identifying security control gaps on an application server, as it simulates real-world
attacks and exploits the vulnerabilities and weaknesses of the application server, and provides
recommendations for remediation and improvement” (p. 95). Additionally, the web search result 4 states
that “penetration testing is a valuable tool for discovering security gaps in your application server and
network infrastructure” and that “penetration testing can help you assess the effectiveness and efficiency of
your security controls, and identify the areas that need improvement or enhancement” (p. 1).
- An organization is about to purchase a rival organization. The PRIMARY reason for performing information
security due diligence prior to making the purchase is to:
A. determine the security exposures.
B. assess the ability to integrate the security department operations.
C. ensure compliance with international standards.
D. evaluate the security policy and standards.
Answer: A
Explanation:
Information security due diligence is the process of assessing the current state of information security in an
organization, identifying any gaps, risks, or vulnerabilities, and estimating the costs and efforts required to
remediate them. Performing information security due diligence prior to making the purchase is important to
determine the security exposures that may affect the value, reputation, or liability of the organization, as
well as the feasibility and compatibility of integrating the security systems and processes of the two
organizations.
References = CISM Review Manual 2022, page 361; CISM Exam Content Outline, Domain 1, Task 1.22;
Information Security Due Diligence Questionnair
- Which of the following is MOST important to have in place for an organization’s information security
program to be effective?
A. Documented information security processes
B. A comprehensive IT strategy
C. Senior management support
D. Defined and allocated budget
Answer: C
Explanation: Senior management support is the most important factor to have in place for an organization’s
information security program to be effective because it helps to establish the vision, direction, and goals of
the program, as well as to allocate the necessary resources and authority to implement and maintain it.
Senior management support also helps to foster a security culture within the organization, where security is
seen as a shared responsibility and a business enabler. Senior management support also helps to ensure
compliance with internal and external security policies and standards, as well as to communicate the value
and impact of security to stakeholders. Therefore, senior management support is the correct answer.
References:
✑ https://www.isac
A.org/resources/isaca-journal/issues/2020/volume-6/keyperformance-
indicators-for-security-governance-part-1
✑ https://www.ffiec.gov/press/PDF/FFIEC_IT_Handbook_Information_Security_Book let.pdf
✑ https://www.cdse.edu/Portals/124/Documents/student-guides/IF011-
guide.pdf?ver=UA7IDZRN_y066rLB8oAW_w%3d%3d
- An information security program is BEST positioned for success when it is closely aligned with:
A. information security best practices.
B. recognized industry frameworks.
C. information security policies.
D. the information security strategy.
Answer: D
Explanation: An information security program is best positioned for success when it is closely aligned with
the information security strategy, which defines the organization’s vision, mission, goals, objectives, and
risk appetite for information security. The information security strategy provides the direction and guidance
for developing and implementing the information security program, ensuring that it supports the
organization’s business processes and objectives. The information security strategy also helps to establish
the scope, boundaries, roles, responsibilities, and resources for the information security program.
References = CISM Manual, Chapter 3: Information Security Program Development (ISPD), Section 3.1:
Information Security Strategy1
1: https://store.isac
A.org/s/store#/store/browse/cat/a2D4w00000Ac6NNEAZ/tiles
- Which of the following is the MOST effective way to detect security incidents?
A. Analyze recent security risk assessments.
B. Analyze security anomalies.
C. Analyze penetration test results.
D. Analyze vulnerability assessments.
Answer: B
Explanation: Analyzing security anomalies is the most effective way to detect security incidents, as it
involves comparing the current state of the information system and network with the expected or normal
state, and identifying any deviations or irregularities that may
indicate a security breach or compromise. Security anomalies can be detected by using various tools and
techniques, such as security information and event management (SIEM) systems, intrusion detection and
prevention systems (IDS/IPS), log analysis, network traffic analysis, and behavioral analysis. (From CISM
Review Manual 15th Edition)
References: CISM Review Manual 15th Edition, page 181, section 4.3.2.4; CISM: Information Security
Incident Management Part 11, section recognize security anomalies.
- Which of the following should include contact information for representatives of equipment and software
vendors?
A. Information security program charter
B. Business impact analysis (BIA)
C. Service level agreements (SLAs)
D. Business continuity plan (BCP)
Answer: D
Explanation: The document that should include contact information for representatives of equipment and
software vendors is the business continuity plan (BCP) because it provides the guidance and procedures
for restoring the organization’s critical business functions and operations in the event of a disruption or
disaster, and may require contacting external parties such as vendors for assistance or support.
Information security program charter is not a good document for this purpose because it does not provide
any guidance or procedures for business continuity or disaster recovery. Business impact analysis (BIA) is
not a good document for this purpose because it does not provide any guidance or procedures for business
continuity or disaster recovery. Service level agreements (SLAs) are not good documents for this purpose
because they do not provide any guidance or procedures for business continuity or disaster recovery.
References: https://www.isac
A.org/resources/isaca-journal/issues/2017/volume-2/business-continuitymanagement-
lifecycle https://www.isac
A.org/resources/isaca-journal/issues/2016/volume-
4/business-impact-analysis
- The PRIMARY advantage of performing black-box control tests as opposed to white-box control tests is
that they:
A. cause fewer potential production issues.
B. require less IT staff preparation.
C. simulate real-world attacks.
D. identify more threats.
Answer: C
Explanation: The primary advantage of performing black-box control tests as opposed to white-box control
tests is that they simulate real-world attacks. Black-box control tests are a software testing methodology in
which the tester analyzes the functionality of an application without a thorough knowledge of its internal
design. Conversely, in white-box control tests, the tester is knowledgeable of the internal design of the
application and analyzes it during testing. By performing black-box control tests, the tester can mimic the
perspective and behavior of an external attacker who does not have access to the source code or the
implementation details of the application. This way, the tester can evaluate how the application responds to
different inputs and scenarios, and identify any vulnerabilities or errors that may affect its functionality or
security. The other options are not the primary advantage of performing black-box control tests, although
they may be some benefits or drawbacks depending on the context. Causing fewer potential production
issues is not necessarily true, as black-box control tests may still introduce errors or disruptions to the
application if not performed carefully. Requiring less IT staff preparation is not always true, as black-box
control tests may still require a lot of planning and documentation to ensure adequate test coverage and
quality. Identifying more threats is not necessarily true, as black-box control tests may miss some threats
that are hidden in the internal logic or structure of the application.
- An organization implemented a number of technical and administrative controls to mitigate risk associated
with ransomware. Which of the following is MOST important to present to senior management when
reporting on the performance of this initiative?
A. The total cost of the investment
B. The cost and associated risk reduction
C. The number and severity of ransomware incidents
D. Benchmarks of industry peers impacted by ransomware
Answer: B
Explanation:
The most important information to present to senior management when reporting on the performance of the
initiative to mitigate risk associated with ransomware is the cost and associated risk reduction, which
means showing the value and effectiveness of the technical and administrative controls in terms of reducing
the likelihood and impact of ransomware incidents and data extortion, and comparing them with the
investment and resources required to implement and maintain them. The cost and associated risk reduction
can help senior management to evaluate the return on investment (ROI) and the alignment with the
business objectives and risk appetite of the initiative.
References = Ransomware Risk Management - NIST, #StopRansomware Guide | CISA
- An incident response team has established that an application has been breached. Which of the following
should be done NEXT?
A. Maintain the affected systems in a forensically acceptable state
B. Conduct a risk assessment on the affected application
C. Inform senior management of the breach.
D. Isolate the impacted systems from the rest of the network
Answer: D
Explanation:
The next thing an incident response team should do after establishing that an application has been
breached is to isolate the impacted systems from the rest of the network, which means disconnecting them
from the internet or other network connections to prevent further spread of the attack or data exfiltration.
Isolating the impacted systems can help to contain the breach and limit its impact on the organization. The
other options, such as maintaining the affected systems in a forensically acceptable state, conducting a risk
assessment, or informing senior management, may be done later in the incident response process, after
isolating the impacted systems. References:
✑ https://www.crowdstrike.com/cybersecurity-101/incident-response/
✑ https://learn.microsoft.com/en-us/security/operations/incident-response-playbooks
✑ https://www.invicti.com/blog/web-security/incident-response-steps-web- application-security/
- Which type of plan is PRIMARILY intended to reduce the potential impact of security events that may
occur?
A. Security awareness plan
B. Business continuity plan (BCP)
C. Disaster recovery plan (DRP)
D. Incident response plan
Answer: D
- Which of the following is the BEST defense against a brute force attack?
A. Time-of-day restrictions
B. Mandatory access control
C. Discretionary access control
D. Multi-factor authentication (MFA)
Answer: D
- The ULTIMATE responsibility for ensuring the objectives of an information security framework are being
met belongs to:
A. the internal audit manager.
B. the information security officer.
C. the steering committee.
D. the board of directors.
Answer: D
Explanation: The board of directors is the ultimate authority and accountability for ensuring the objectives of
an information security framework are being met, as they are responsible for setting the strategic direction,
approving the policies, overseeing the performance, and ensuring the compliance of the organization. The
board of directors also delegates the authority and resources to the information security officer, the steering
committee, and the internal audit manager, who are involved in the design, implementation, monitoring, and
improvement of the information security framework.
References = CISM Review Manual, 27th Edition, Chapter 4, Section 4.1.1, page 2131; CISM Online
Review Course, Module 4, Lesson 1, Topic 12; CISM domain 1: Information security governance
Updated 2022
- An organization’s research department plans to apply machine learning algorithms on a large data set
containing customer names and purchase history. The risk of personal data leakage is considered high
impact. Which of the following is the BEST risk treatment option in this situation?
A. Accept the risk, as the benefits exceed the potential consequences.
B. Mitigate the risk by applying anonymization on the data set.
C. Transfer the risk by purchasing insurance.
D. Mitigate the risk by encrypting the customer names in the data set.
Answer: B
- Which of the following is MOST important to consider when choosing a shared alternate location for
computing facilities?
A. The organization’s risk tolerance
B. Resource availability
C. The organization’s mission
D. Incident response team training
Answer: A
Explanation: The organization’s risk tolerance is the most important factor to consider when choosing a
shared alternate location for computing facilities, because it determines
the acceptable level of risk exposure and the required recovery time objectives (RTOs) and recovery point
objectives (RPOs) for the organization’s critical business processes and information assets. Resource
availability, the organization’s mission, and incident response team training are also important
considerations, but they are secondary to the risk tolerance.
References = CISM Review Manual, 16th Edition, page 290
- Communicating which of the following would be MOST helpful to gain senior management support for risk
treatment options?
A. Quantitative loss
B. Industry benchmarks
C. Threat analysis
D. Root cause analysis
Answer: A
Explanation: communicating the quantitative loss associated with the risk scenarios and the risk treatment
options would be the most helpful to gain senior management support, as it helps to demonstrate the value
and effectiveness of the risk treatment options in terms of reducing the likelihood and impact of the risk.
Quantitative loss also helps to compare the cost and benefit of the risk treatment options and to prioritize
the most critical risks. Industry benchmarks, threat analysis, and root cause analysis may be useful for
understanding and assessing the risk, but they do not directly measure the performance of the risk
treatment options.
References = Five Key Considerations When Developing Information Security Risk Treatment Plans,
CISM Domain 2: Information Risk Management (IRM) [2022 update]
- Which of the following is MOST important when designing security controls for new cloud- based services?
A. Evaluating different types of deployment models according to the associated risks
B. Understanding the business and IT strategy for moving resources to the cloud
C. Defining an incident response policy to protect data moving between onsite and cloud applications
D. Performing a business impact analysis (BIA) to gather information needed to develop recovery
strategies
Answer: B
Explanation:
The most important factor when designing security controls for new cloud-based services is to understand
the business and IT strategy for moving resources to the cloud. This will help to align the security controls
with the business objectives, requirements, and risks, and to select the appropriate cloud service delivery
and deployment models. The security controls should also be based on the shared responsibility model,
which defines the roles and responsibilities of the cloud service provider and the cloud customer in ensuring
the security of the cloud environment. Evaluating different types of deployment models, defining an incident
response policy, and performing a business impact analysis are also important activities, but they should be
done after understanding the business and IT strategy.
References = CISM Review Manual, 16th Edition eBook1, Chapter 3: Information Security Program
Development and Management, Section: Information Security Program Management, Subsection: Cloud
Computing, Page 141-142.
- When implementing a security policy for an organization handling personally identifiable information (Pll);
the MOST important objective should be:
A. strong encryption
B. regulatory compliance.
C. data availability.
D. security awareness training
Answer: B
Explanation: Regulatory compliance is the most important objective when implementing a security policy for
an organization handling personally identifiable information (PII) because it helps to ensure that the
organization meets the legal and ethical obligations to protect the privacy and security of PII. PII is any
information that can be used to identify, contact, or locate an individual, such as name, address, email,
phone number, social security number, etc. PII is subject to various laws and regulations in different
jurisdictions, such as the General Data Protection Regulation (GDPR) in the European Union, the California
Consumer Privacy Act (CCPA) in the United States, or the Personal Information Protection and Electronic
Documents Act (PIPEDA) in Canad
A. Failing to comply with these regulations can result in fines, lawsuits,
reputational damage, or loss of trust. Therefore, regulatory compliance is the correct answer.
References:
✑ https://www.iso.org/obp/ui/en/#iso:std:iso-iec:27018:ed-2:v1:en
✑ https://www.digitalguardian.com/blog/how-secure-personally-identifiableinformation-
against-loss-or-compromise
✑ https://blog.rsisecurity.com/how-to-make-a-personally-identifiable-information- policy/
- Which of the following would provide the MOST effective security outcome in an organizations contract
management process?
A. Performing vendor security benchmark analyses at the request-for-proposal (RFP) stage
B. Ensuring security requirements are defined at the request-for-proposal (RFP) stage
C. Extending security assessment to cover asset disposal on contract termination
D. Extending security assessment to include random penetration testing
Answer: B
Explanation: Ensuring security requirements are defined at the request-for-proposal (RFP) stage is the
most effective security outcome in an organization’s contract management process because it establishes
and communicates the security expectations and obligations for both parties, and enables the organization
to evaluate and select the most suitable and secure vendor or service provider. Performing vendor security
benchmark analyses at the RFP stage is not an effective security outcome, but rather a possible security
activity that involves comparing and ranking different vendors or service providers based on their security
capabilities or performance. Extending security assessment to cover asset disposal on contract termination
is not an effective security outcome, but rather a possible security activity that involves verifying and
validating that any assets or data belonging to the organization are securely disposed of by the vendor or
service provider at the end of the contract. Extending security assessment to include random penetration
testing is not an effective security outcome, but rather a possible security activity that involves testing and
auditing the vendor’s or service provider’s security controls or systems at random intervals during the
contract. References: https://www.isac
A.org/resources/isacajournal/
issues/2017/volume-1/data-ownership-and-custodianship-in-the-cloud
https://www.isac
A.org/resources/isaca-journal/issues/2016/volume-4/integrating-assurance- functions
- Which is following should be an information security manager’s PRIMARY focus during the development of
a critical system storing highly confidential data?
A. Reducing the number of vulnerabilities detected
B. Ensuring the amount of residual risk is acceptable
C. Avoiding identified system threats
D. Complying with regulatory requirements
Answer: B
Explanation: The information security manager’s primary focus during the development of a critical system
storing highly confidential data should be ensuring the amount of residual risk is acceptable. Residual risk is
the level of cyber risk remaining after all the security controls are accounted for, any threats have been
addressed and the organization is meeting security standards. It’s the risk that slips through the cracks of
the system. For a critical system storing highly confidential data, the residual risk should be as low as
possible, and within the organization’s risk appetite and tolerance. The information security manager should
monitor and review the residual risk throughout the system development life cycle, and ensure that it is
communicated and approved by the appropriate stakeholders. The other options are not the primary focus,
although they may be part of the security objectives and activities. Reducing the number of vulnerabilities
detected is a desirable outcome, but it does not necessarily mean that the residual risk is acceptable, as
some vulnerabilities may have a higher impact or likelihood than others. Avoiding identified system threats
is a preventive measure, but it does not account for unknown or emerging threats that may pose a residual
risk to the system. Complying with regulatory requirements is a mandatory obligation, but it does not
guarantee that the residual risk is acceptable, as regulations may not cover all aspects of security or reflect
the specific context and needs of the organization.
- After the occurrence of a major information security incident, which of the following will BEST help an
information security manager determine corrective actions?
A. Calculating cost of the incident
B. Conducting a postmortem assessment
C. Performing an impact analysis
D. Preserving the evidence
Answer: B
Explanation: The best way to determine corrective actions after a major information security incident is to
conduct a postmortem assessment, which is a systematic and structured review of the incident, its causes,
its impacts, and its lessons learned. A postmortem assessment can help to identify the root causes of the
incident, the strengths and weaknesses of the incident response process, the gaps and deficiencies in the
security controls, and the opportunities for improvement and remediation. A postmortem assessment can
also help to document the recommendations and action plans for preventing or minimizing the recurrence
of similar incidents in the future.
References = CISM Review Manual, 16th Edition eBook1, Chapter 4: Information Security Incident
Management, Section: Incident Response, Subsection: Postincident Activities, Page 211.
- Regular vulnerability scanning on an organization’s internal network has identified that many user
workstations have unpatched versions of software. What is the BEST way for the information security
manager to help senior management understand the related risk?
A. Include the impact of the risk as part of regular metrics.
B. Recommend the security steering committee conduct a review.
C. Update the risk assessment at regular intervals
D. Send regular notifications directly to senior managers
Answer: A
Explanation: Including the impact of the risk as part of regular metrics is the best way for the information
security manager to help senior management understand the related risk of
having many user workstations with unpatched versions of software because it quantifies and
communicates the potential consequences and likelihood of such a risk in terms of business objectives and
performance indicators. Recommending the security steering committee conduct a review is not a good
way because it does not provide any specific information or analysis about the risk or its impact. Updating
the risk assessment at regular intervals is not a good way because it does not ensure that senior
management is aware or informed about the risk or its impact. Sending regular notifications directly to
senior managers is not a good way because it may be perceived as intrusive or annoying, and may not
convey the severity or urgency of the risk or its impact. References:
https://www.isac
A.org/resources/isaca-journal/issues/2015/volume-6/measuring-the-valueCertify
For Sure with IT Exam Dumps
The No.1 IT Certification Dumps
400
of-information-security-investments
https://www.isac
A.org/resources/isaca-journal/issues/2017/volume-3/how-to-measure-the-effectiveness-ofyour-
information-security-management-system
- Which of the following is MOST important when defining how an information security budget should be
allocated?
A. Regulatory compliance standards
B. Information security strategy
C. Information security policy
D. Business impact assessment
Answer: B
Explanation: Information security strategy is the most important factor when defining how an information
security budget should be allocated because it helps to align the security objectives and initiatives with the
business goals and priorities. An information security strategy is a high-level plan that defines the vision,
mission, scope, and direction of the security program, as well as the roles and responsibilities, governance
structures, policies and standards, risk management approaches, and performance measurement methods.
An information security strategy helps to identify and prioritize the security needs and requirements of the
organization, as well as to allocate the resources and funding accordingly. An information security strategy
also helps to communicate the value and benefits of security to the stakeholders and justify the security
investments. Therefore, information security strategy is the correct answer.
References:
✑ https://www.techtarget.com/searchsecurity/tip/Cybersecurity-budget-breakdown- and-best-practices
✑ https://www.csoonline.com/article/3671108/how-2023-cybersecurity-budgetallocations-
are-shaping-up.html
✑ https://www.statist
A.com/statistics/1319677/companies-it-budget-allocated-to- security-worldwide/
- Which of the following should be done FIRST when implementing a security program?
A. Perform a risk analysis
B. Implement data encryption.
C. Create an information asset inventory.
D. Determine the value of information assets.
Answer: A
Explanation: Performing a risk analysis is the first step when implementing a security program because it
helps to identify and prioritize the potential threats and vulnerabilities that may affect the organization’s
assets, processes, or objectives, and determine their impact and likelihood. Implementing data encryption
is not the first step, but rather a possible subsequent step that involves applying a specific security control
or technique to protect data from unauthorized access or modification. Creating an information asset
inventory is not the first step, but rather a possible subsequent step that involves identifying and classifying
the organization’s assets based on their value and sensitivity. Determining the value of information assets
is not the first step, but rather a possible subsequent step that involves estimating and quantifying the worth
of information assets to the organization. References:
https://www.isac
A.org/resources/isaca-journal/issues/2015/volume-
6/measuring-the-value-of-information-security-investments
https://www.isac
A.org/resources/isaca-journal/issues/2017/volume-3/how-to-measure-theeffectiveness-
of-your-information-security-management-system
- Which of the following would be MOST effective in reducing the impact of a distributed denial of service
(DDoS) attack?
A. Impose state limits on servers.
B. Spread a site across multiple ISPs.
C. Block the attack at the source.
D. Harden network security.
Answer: B
Explanation:
The answer to the question is B. Spread a site across multiple ISPs. This is because spreading a site
across multiple Internet service providers (ISPs) can help to reduce the impact of a distributed denial of
service (DDoS) attack by increasing the bandwidth and redundancy of the site, and making it harder for the
attacker to target and overwhelm a single point of failure. Spreading a site across multiple ISPs can also
help to distribute the traffic load and balance the performance of the site, and to mitigate the effects of
regional or network-specific outages or disruptions. Spreading a site across multiple ISPs can be done by
using various techniques, such as anycast routing, content delivery networks (CDNs), or cloud-based
services12.
Spreading a site across multiple ISPs can help to reduce the impact of a DDoS attack by increasing the
bandwidth and redundancy of the site, and making it harder for the attacker to target and overwhelm a
single point of failure. (From CISM Manual or related resources) References = CISM Review Manual 15th
Edition, Chapter 4, Section 4.2.1, page 2091; DDoS Attacks—A Cyberthreat and Possible Solutions2
- A recent audit found that an organization’s new user accounts are not set up uniformly. Which of the
following is MOST important for the information security manager to review?
A. Automated controls
B. Security policies
C. Guidelines
D. Standards
Answer: D
Explanation:
Standards are the most important thing to review, as they define the specific and mandatory requirements
for setting up new user accounts, such as the naming conventions, access rights, password policies, and
expiration dates. Standards help to ensure consistency, security, and compliance across the organization’s
information systems and users. If the standards are not followed, the organization may face increased
risks of unauthorized access, data breaches, or audit failures.
References = CISM Review Manual 2022, page 341; CISM Exam Content Outline, Domain 1, Knowledge
Statement 1.32; CISM 2020: IT Security Policies; Information Security Policy, Standards, and Guidelines
- To help users apply appropriate controls related to data privacy regulation, what is MOST important to
communicate to the users?
A. Data storage procedures
B. Data classification policy
C. Results of penetration testing
D. Features of data protection products
Answer: B
- Which of the following is MOST important to include in an information security strategy?
A. Stakeholder requirements
B. Risk register
C. Industry benchmarks
D. Regulatory requirements
Answer: A
Explanation:
Stakeholder requirements are the most important to include in an information security strategy, as they
reflect the business needs, objectives, and expectations of the organization and its key stakeholders.
Stakeholder requirements also help to align the information security strategy with the enterprise
governance and the organizational culture. Risk register, industry benchmarks, and regulatory
requirements are important inputs for the information security strategy, but they are not the most important
to include.
References = CISM Review Manual 2022, page 321; CISM Exam Content Outline, Domain 1, Task 1.12
- While responding to a high-profile security incident, an information security manager observed several
deficiencies in the current incident response plan. When would be the BEST time to update the plan?
A. While responding to the incident
B. During a tabletop exercise
C. During post-incident review
D. After a risk reassessment
Answer: C
Explanation:
During post-incident review is the best time to update the incident response plan after observing several
deficiencies in the current plan while responding to a high-profile security incident. A post-incident review is
a process of analyzing and evaluating the incident response activities, identifying the lessons learned, and
documenting the recommendations and action items for improvement. Updating the incident response plan
during post-incident review helps to ensure that the plan reflects the current best practices, addresses the
gaps and weaknesses, and incorporates the feedback and suggestions from the incident response team
and other stakeholders. Therefore, during post-incident review is the correct answer.
References:
✑ https://www.cis
A.gov/sites/default/files/publications/Incident-Response-Plan- Basics_508c.pdf
✑ https://www.techtarget.com/searchsecurity/feature/5-critical-steps-to-creating-aneffective-
incident-response-plan
✑ https://www.integrify.com/blog/posts/incident-response-plan-need-an-update/
- Which of the following would provide the BEST evidence to senior management that security control
performance has improved?
A. Demonstrated return on security investment
B. Reduction in inherent risk
C. Results of an emerging threat analysis
D. Review of security metrics trends
Answer: D
Explanation:
Review of security metrics trends is the best evidence to senior management that security control
performance has improved because it helps to measure and demonstrate the effectiveness and efficiency
of the security controls over time. Security metrics are quantitative or qualitative indicators that provide
information about the security status or performance of an organization, system, process, or activity.
Security metrics can be used to evaluate the implementation, operation, and outcome of security controls,
such as the number of vulnerabilities detected and remediated, the time to respond and recover from
incidents, the compliance level with security policies and standards, or the return on security investment.
Review of security metrics trends helps to identify and communicate the progress, achievements, and
challenges of the security program, as well as to support decision making and continuous improvement.
Therefore, review of security metrics trends is the correct answer.
References:
✑ https://www.bitsight.com/blog/importance-continuous-improvement-security- performance-management
✑ https://www.isac
A.org/resources/isaca-journal/issues/2020/volume-6/keyperformance-
indicators-for-security-governance-part-2
✑ https://www.nist.gov/news-events/news/2021/09/dhs-nist-coordinate-releasingpreliminary-
cybersecurity-performance-goals.
- The PRIMARY goal of a post-incident review should be to:
A. establish the cost of the incident to the business.
B. determine why the incident occurred.
C. identify policy changes to prevent a recurrence.
D. determine how to improve the incident handling process.
Answer: D
- After updating password standards, an information security manager is alerted by various application
administrators that the applications they support are incapable of enforcing these standards. The
information security manager’s FIRST course of action should be to:
A. determine the potential impact.
B. reevaluate the standards.
C. implement compensating controls.
D. evaluate the cost of replacing the applications.
Answer: A
- An organization’s information security team presented the risk register at a recent information security
steering committee meeting. Which of the following should be of MOST concern to the committee?
A. No owners were identified for some risks.
B. Business applications had the highest number of risks.
C. Risk mitigation action plans had no timelines.
D. Risk mitigation action plan milestones were delayed.
Answer: A
Explanation: The most concerning issue for the information security steering committee should be that no
owners were identified for some risks in the risk register. This means that there is no clear accountability
and responsibility for managing and mitigating those risks, and that the risks may not be properly
addressed or monitored. The risk owners are the persons who have the authority and ability to implement
the risk treatment options and to accept the residual risk. The risk owners should be identified and assigned
for each risk in the risk register, and they should report the status and progress of the risk management
activities to the information security steering committee.
References = CISM Review Manual, 16th Edition eBook1, Chapter 2: Information Risk Management,
Section: Risk Management, Subsection: Risk Register, Page 104.
