CISM Practice Test

CISM Practice Test practice questions, page 22 of 50, with answer review and explanations.

Question 106

Which of the following is the BEST way for an information security manager to justify ongoing annual maintenance fees associated with an intrusion prevention system (IPS)?

  1. Establish and present appropriate metrics that track performance.
  2. Perform industry research annually and document the overall ranking of the IPS.
  3. Perform a penetration test to demonstrate the ability to protect.
  4. Provide yearly competitive pricing to illustrate the value of the IPS.

Question 107

An organization wants to enable digital forensics for a business-critical application. Which of the following will BEST help to support this objective?

  1. Install biometric access control.
  2. Develop an incident response plan.
  3. Define data retention criteria.
  4. Enable activity logging.

Question 108

An employee clicked on a link in a phishing email, triggering a ransomware attack. Which of the following should be the information security manager's FIRST step?

  1. Notify internal legal counsel.
  2. Isolate the impacted endpoints.
  3. Wipe the affected system.
  4. Notify senior management.

Question 109

A recent audit found that an organization's new user accounts are not set up uniformly. Which of the following is MOST important for the information security manager to review?

  1. Security policies
  2. Automated controls
  3. Guidelines
  4. Standards

Question 110

Which of the following metrics is the BEST measure of the effectiveness of an information security program?

  1. Reduction in the amount of risk exposure in an organization
  2. Reduction in the number of threats to an organization
  3. Reduction in the cost of risk remediation for an organization
  4. Reduction in the number of vulnerabilities in an organization