CISM Practice Test

CISM Practice Test practice questions, page 13 of 50, with answer review and explanations.

Question 61

An information security manager wants to improve the ability to identify changes in risk levels affecting the organization's systems. Which of the following is the BEST method to achieve this objective?

  1. Performing business impact analyses (BIA)
  2. Monitoring key goal indicators (KGIs)
  3. Monitoring key risk indicators (KRIs)
  4. Updating the risk register

Question 62

When developing an escalation process for an incident response plan, the information security manager should PRIMARILY consider the:

  1. affected stakeholders.
  2. incident response team.
  3. availability of technical resources.
  4. media coverage

Question 63

Which of the following should be an information security managers MOST important consideration when determining if an information asset has been classified appropriately?

  1. Value to the business
  2. Security policy requirements
  3. Ownership of information
  4. Level of protection

Question 64

The effectiveness of an incident response team will be GREATEST when:

  1. the incident response process is updated based on lessons learned.
  2. the incident response team members are trained security personnel.
  3. the incident response team meets on a regular basis to review log files.
  4. incidents are identified using a security information and event monitoring (SIEM) system.

Question 65

An information security manager MUST have an understanding of the organization's business goals to:

  1. relate information security to change management.
  2. develop an information security strategy.
  3. develop operational procedures
  4. define key performance indicators (KPIs).