CISM Practice Test practice questions, page 24 of 50, with answer review and explanations.
Question 116
What is the PRIMARY objective of performing a vulnerability assessment following a business system update?
Improve the change control process.
Update the threat landscape.
Determine operational losses.
Review the effectiveness of controls.
Question 117
Which of the following should an information security manager perform FIRST when an organization's residual risk has increased?
Implement security measures to reduce the risk.
Assess the business impact.
Transfer the risk to third parties.
Communicate the information to senior management.
Question 118
Which of the following is the PRIMARY reason for an information security manager to present the business case for an information security initiative to senior management?
To aid management in the decision-making process for purchasing the solution
To represent stakeholders who will benefit from enhancements in information security
To provide management with the status of the information security program
To demonstrate to management the due diligence involved with selecting the solution
Question 119
During a security assessment, an information security manager finds a number of security patches were not installed on a server hosting a critical business application. The application owner did not approve the patch installation to avoid interrupting the application. Which of the following should be the information security manager's FIRST course of action?
Report the risk to the information security steering committee.
Determine mitigation options with IT management.
Communicate the potential impact to the application owner.
Escalate the risk to senior management.
Question 120
Which of the following BEST indicates an effective vulnerability management program?
Security incidents are reported in a timely manner.