CISM Practice Test

CISM Practice Test practice questions, page 17 of 50, with answer review and explanations.

Question 81

Which of the following is the MOST effective way for an organization to ensure its third-party service providers are aware of information security requirements and expectations?

  1. Including information security clauses within contracts
  2. Auditing the service delivery of third-party providers
  3. Providing information security training to third-party personnel
  4. Requiring third parties to sign confidentiality agreements

Question 82

The MOST important reason to use a centralized mechanism to identify information security incidents is to:

  1. comply with corporate policies
  2. detect threats across environments
  3. prevent unauthorized changes to networks
  4. detect potential fraud

Question 83

Which of the following should be done FIRST when establishing security measures for personal data stored and processed on a human resources management system?

  1. Conduct a vulnerability assessment.
  2. Move the system into a separate network.
  3. Conduct a privacy impact assessment (PIA).
  4. Evaluate data encryption technologies.

Question 84

An information security manager has been informed of a new vulnerability in an online banking application, and a patch to resolve this issue is expected to be released in the next 72 hours. Which of the following should the information security manager do FIRST?

  1. Implement mitigating controls.
  2. Perform a business impact analysis (BIA).
  3. Perform a risk assessment.
  4. Notify senior management.

Question 85

Which of the following is MOST relevant for an information security manager to communicate to the board of directors?

  1. The level of exposure
  2. Vulnerability assessments
  3. The level of inherent risk
  4. Threat assessments