Get Perfect Results with Premium CISM Dumps Updated 395 Questions
Free CISM Exam Study Guide for the NEW Dumps Test Engine
ISACA CISM: What career benefits can you get?
Holding the CISM certification will support your career growth. If you are an IT Security Architect, an Information Security Analyst, or a Chief Information Security Officer, this certificate will help you significantly get a promotion or find a new job. It demonstrates your knowledge in the information security sphere and makes finding a new job easier.
In addition, you will surely earn more. The average salary for those professionals who have the CISM certification ranges from $52,400 to $243,600 per year. Therefore, if you want to get a pay raise, this certificate is the right choice for you.
NEW QUESTION 218
To integrate security into system development life cycle (SDLC) processes, an organization MUST ensure that security:
- A. is represented on the configuration control board.
- B. roles and responsibilities have been defined.
- C. is a prerequisite for completion of major phases.
- D. performance metrics have been met.
Answer: C
NEW QUESTION 219
Which of the following is the PRIMARY reason for implementing a risk management program?
- A. Assists in incrementing the return on investment (ROD
- B. Satisfies audit and regulatory requirements
- C. Allows the organization to eliminate risk
- D. Is a necessary part of management's due diligence
Answer: D
Explanation:
Explanation
The key reason for performing risk management is that it is part of management's due diligence. The elimination of all risk is not possible. Satisfying audit and regulatory requirements is of secondary importance.
A risk management program may or may not increase the return on investment (ROD.
NEW QUESTION 220
Which of the following is MOST appropriate for inclusion in an information security strategy?
- A. Firewall rule sets, network defaults and intrusion detection system (IDS) settings
- B. Security processes, methods, tools and techniques
- C. Budget estimates to acquire specific security tools
- D. Business controls designated as key controls
Answer: B
Explanation:
Section: INFORMATION SECURITY GOVERNANCE
Explanation:
A set of security objectives, processes, methods, tools and techniques together constitute a security strategy. Although IT and business governance are intertwined, business controls may not be included in a security strategy. Budgets will generally not be included in an information security strategy. Additionally, until information security strategy is formulated and implemented, specific tools will not be identified and specific cost estimates will not be available. Firewall rule sets, network defaults and intrusion detection system (IDS) settings are technical details subject to periodic change, and are not appropriate content for a strategy document.
NEW QUESTION 221
Which of the following is MOST effective in preventing the introduction of a code modification that may reduce the security of a critical business application?
- A. Security metrics
- B. Patch management
- C. Version control
- D. Change management
Answer: D
Explanation:
Explanation/Reference:
Explanation:
Change management controls the process of introducing changes to systems. Failure to have good change management may introduce new weaknesses into otherwise secure systems. Patch management corrects discovered weaknesses by applying a correction to the original program code. Security metrics provide a means for measuring effectiveness. Version control is a subset of change management.
NEW QUESTION 222
An organization is considering the adoption of cloud service providers for its expanding global business operations. Which of the following is MOST important for the information security manager to review with regard to data protection?
- A. Organizational requirements
- B. Data privacy policy
- C. Security policy and standards
- D. Local laws and regulations
Answer: D
NEW QUESTION 223
When a security standard conflicts with a business objective, the situation should be resolved by:
- A. performing a risk analysis.
- B. changing the business objective.
- C. authorizing a risk acceptance.
- D. changing the security standard.
Answer: A
Explanation:
Explanation
Conflicts of this type should be based on a risk analysis of the costs and benefits of allowing or disallowing an exception to the standard. It is highly improbable that a business objective could be changed to accommodate a security standard, while risk acceptance* is a process that derives from the risk analysis.
NEW QUESTION 224
An organization has to comply with recently published industry regulatory requirements-compliance that potentially has high implementation costs. What should the information security manager do FIRST?
- A. Implement a security committee.
- B. Implement compensating controls.
- C. Perform a gap analysis.
- D. Demand immediate compliance.
Answer: C
Explanation:
Since they are regulatory requirements, a gap analysis would be the first step to determine the level of compliance already in place. Implementing a security committee or compensating controls would not be the first step. Demanding immediate compliance would not assess the situation.
NEW QUESTION 225
Which of the following is the MOST important consideration when securing customer credit card data acquired by a point-of-sale (POS) cash register?
- A. Nonrepudiation
- B. Hardening
- C. Encryption
- D. Authentication
Answer: C
Explanation:
Section: INFORMATION SECURITY PROGRAM DEVELOPMENT
Explanation:
Cardholder data should be encrypted using strong encryption techniques. Hardening would be secondary in importance, while nonrepudiation would not be as relevant. Authentication of the point-of-sale (POS) terminal is a previous step to acquiring the card information.
NEW QUESTION 226
Which of the following function is the MOST critical when initiating the removal of system access for terminated employees?
- A. Information security
- B. Help desk
- C. Legal
- D. Human resources
Answer: A
NEW QUESTION 227
Which of the following is the BEST approach for determining the maturity level of an information security program?
- A. Evaluate key performance indicators (KPls).
- B. Review internal audit results.
- C. Perform a self-assessment.
- D. Engage a third-party review.
Answer: D
NEW QUESTION 228
In a large organization, defining recovery time objectives (RTOs) is PRIMARILY the responsibility of;
- A. the business unit manager.
- B. the information security manager.
- C. the IT manager
- D. senior management
Answer: A
NEW QUESTION 229
To BEST improve the alignment of the information security objectives in an organization, the chief information security officer (CISO) should:
- A. evaluate a balanced business scorecard.
- B. revise the information security program.
- C. conduct regular user awareness sessions.
- D. perform penetration tests.
Answer: A
Explanation:
Section: INFORMATION SECURITY PROGRAM DEVELOPMENT
Explanation:
The balanced business scorecard can track the effectiveness of how an organization executes it information security strategy and determine areas of improvement. Revising the information security program may be a solution, but is not the best solution to improve alignment of the information security objectives. User awareness is just one of the areas the organization must track through the balanced business scorecard.
Performing penetration tests does not affect alignment with information security objectives.
NEW QUESTION 230
Authorization can BEST be accomplished by establishing:
- A. the ownership of the data
- B. whether users are who they say they are
- C. how users identify themselves to information systems.
- D. who users can do when they are granted system access.
Answer: D
NEW QUESTION 231
During the initiation phase of the system development life cycle (SDLC) for a software project, information security activities should address:
- A. security objectives.
- B. cost-benefit analyses.
- C. benchmarking security metrics.
- D. baseline security controls.
Answer: A
Explanation:
Section: INFORMATION SECURITY PROGRAM MANAGEMENT
NEW QUESTION 232
In business critical applications, where shared access to elevated privileges by a small group is necessary, the BEST approach to implement adequate segregation of duties is to:
- A. implement role-based access control in the application.
- B. create service accounts that can only be used by authorized team members.
- C. ensure access to individual functions can be granted to individual users only.
- D. enforce manual procedures ensuring separation of conflicting duties.
Answer: A
Explanation:
Role-based access control is the best way to implement appropriate segregation of duties. Roles will have to be defined once and then the user could be changed from one role to another without redefining the content of the role each time. Access to individual functions will not ensure appropriate segregation of duties. Giving a user access to all functions and implementing, in parallel, a manual procedure ensuring segregation of duties is not an effective method, and would be difficult to enforce and monitor. Creating service accounts that can be used by authorized team members would not provide any help unless their roles are properly segregated.
NEW QUESTION 233
Which of the following is the BEST metric for evaluating the effectiveness of security awareness twining?
The number of:
- A. password resets.
- B. access rule violations.
- C. incidents resolved.
- D. reported incidents.
Answer: D
Explanation:
Explanation/Reference:
Explanation:
Reported incidents will provide an indicator of the awareness level of staff. An increase in reported incidents could indicate that the staff is paying more attention to security. Password resets and access rule violations may or may not have anything to do with awareness levels. The number of incidents resolved may not correlate to staff awareness.
NEW QUESTION 234
Which of the following BEST indicates an effective vulnerability management program?
- A. Controls are managed proactively.
- B. Risks are managed within acceptable limits
- C. Threats are identified accurately
- D. Security incidents are reported in a timely manner
Answer: B
NEW QUESTION 235
Which of the following are likely to be updated MOST frequently?
- A. Standards for document retention and destruction
- B. Standards for password length and complexity
- C. Policies addressing information security governance
- D. Procedures for hardening database servers
Answer: D
Explanation:
Explanation
Policies and standards should generally be more static and less subject to frequent change. Procedures on the other hand, especially with regard to the hardening of operating systems, will be subject to constant change; as operating systems change and evolve, the procedures for hardening will have to keep pace.
NEW QUESTION 236
Which of the following is the MOST effective way of ensuring that business units comply with an information security governance framework?
- A. Performing security assessments and gap analyses
- B. Conducting a business impact analysis (BIA)
- C. Conducting information security awareness training
- D. Integrating security requirements with processes
Answer: A
NEW QUESTION 237
......
Isaca CISM Practice Test Questions, Isaca CISM Exam Practice Test Questions
Certified Information Security Manager (CISM) is a sought-after certification offered by ISACA. ISACA is a non-profit independent association that helps those professionals who are involved in risk management, information security, assurance, and governance. The exam that you need to pass for this certificate evaluates if you are experienced and has the knowledge for the management of the information security program.
ISACA CISM: What requirements should you meet?
The ISACA CISM certificate is available for those individuals who have technical and IS/IT experience and are ready to become a Manager. It validates your expertise in risk management, incident management, security governance, as well as program management and development. This certification proves your knowledge in the following domains:
- Information Security Governance.
- Information Security Program Development & Management;
- Information Risk Management;
- Information Security Incident Management;
ISACA recommends all the potential candidates to have at least 5 years of experience in the IS management. To become eligible for this certification, you also need to pass one exam.
CISM PDF Dumps Extremely Quick Way Of Preparation: https://www.surepassexams.com/CISM-exam-bootcamp.html
Download CISM Dumps (2022) - Free PDF Exam Demo: https://drive.google.com/open?id=19KXUEqvperlyZaNSnB85jESCA3e6Gr9M