CISM Practice Test

CISM Practice Test practice questions, page 2 of 50, with answer review and explanations.

Question 6

What would be an information security manager's BEST recommendation upon learning that an existing contract with a third party does not clearly identify requirements for safeguarding the organization's critical data?

  1. Cancel the outsourcing contract.
  2. Transfer the risk to the provider.
  3. Create an addendum to the existing contract.
  4. Initiate an external audit of the provider's data center.

Question 7

An organization has purchased a security information and event management (SIEM) tool. Which of the following is MOST important to consider before implementation?

  1. Controls to be monitored
  2. Reporting capabilities
  3. The contract with the SIEM vendor
  4. Available technical support

Question 8

Which of the following is MOST likely to be included in an enterprise security policy?

  1. Definitions of responsibilities
  2. Retention schedules
  3. System access specifications
  4. Organizational risk

Question 9

Which of the following should an information security manager do FIRST when a legacy application is not compliant with a regulatory requirement, but the business unit does not have the budget for remediation?

  1. Develop a business case for funding remediation efforts.
  2. Advise senior management to accept the risk of noncompliance.
  3. Notify legal and internal audit of the noncompliant legacy application.
  4. Assess the consequences of noncompliance against the cost of remediation.

Question 10

Which of the following is the MOST effective way to address an organization's security concerns during contract negotiations with a third party?

  1. Review the third-party contract with the organization's legal department.
  2. Communicate security policy with the third-party vendor.
  3. Ensure security is involved in the procurement process.
  4. Conduct an information security audit on the third-party vendor.