CISM Practice Test

CISM Practice Test practice questions, page 20 of 50, with answer review and explanations.

Question 96

An information security manager has identified a major security event with potential noncompliance implications. Who should be notified FIRST?

  1. Internal audit
  2. Public relations team
  3. Senior management
  4. Regulatory authorities

Question 97

Which of the following is the PRIMARY purpose of establishing an information security governance framework?

  1. To proactively address security objectives
  2. To reduce security audit issues
  3. To enhance business continuity planning
  4. To minimize security risks

Question 98

An organization is leveraging tablets to replace desktop computers shared by shift-based staff. These tablets contain critical business data and are inherently at increased risk of theft. Which of the following will BEST help to mitigate this risk?

  1. Implement remote wipe capability.
  2. Create an acceptable use policy.
  3. Conduct a mobile device risk assessment.
  4. Deploy mobile device management (MDM).

Question 99

When scoping a risk assessment, assets need to be classified by:

  1. sensitivity and criticality.
  2. likelihood and impact.
  3. threats and opportunities.
  4. redundancy and recoverability.

Question 100

Which of the following would BEST enable effective decision-making?

  1. Annualized loss estimates determined from past security events
  2. A universally applied list of generic threats, impacts, and vulnerabilities
  3. A consistent process to analyze new and historical information risk
  4. Formalized acceptance of risk analysis by business management