CISM Practice Test

CISM Practice Test practice questions, page 18 of 50, with answer review and explanations.

Question 86

Senior management has just accepted the risk of noncompliance with a new regulation. What should the information security manager do NEXT?

  1. Report the decision to the compliance officer.
  2. Reassess the organization's risk tolerance.
  3. Update details within the risk register.
  4. Assess the impact of the regulation.

Question 87

Which of the following BEST provides an information security manager with sufficient assurance that a service provider complies with the organization's information security requirements?

  1. A live demonstration of the third-party supplier's security capabilities
  2. The ability to audit the third-party supplier's IT systems and processes
  3. Third-party security control self-assessment results
  4. An independent review report indicating compliance with industry standards

Question 88

Which of the following is the MOST essential element of an information security program?

  1. Prioritizing program deliverables based on available resources
  2. Benchmarking the program with global standards for relevance
  3. Involving functional managers in program development
  4. Applying project management practices used by the business

Question 89

Which of the following is BEST to include in a business case when the return on investment (ROI) for an information security initiative is difficult to calculate?

  1. Projected increase in maturity level
  2. Estimated increase in efficiency
  3. Projected costs over time
  4. Estimated reduction in risk

Question 90

If the inherent risk of a business activity is higher than the acceptable risk level, the information security manager should FIRST:

  1. transfer risk to a third party to avoid cost of impact.
  2. recommend that management avoid the business activity.
  3. assess the gap between current and acceptable level of risk.
  4. implement controls to mitigate the risk to an acceptable level.