CISM Practice Test

CISM Practice Test practice questions, page 26 of 50, with answer review and explanations.

Question 126

Who should determine data access requirements for an application hosted at an organization's data center?

  1. Information security manager
  2. Business owner
  3. Data custodian
  4. Systems administrator

Question 127

Which of the following is the MOST important objective of testing a security incident response plan?

  1. Ensure the thoroughness of the response plan.
  2. Verify the response assumptions are valid.
  3. Confirm that systems are recovered in the proper order.
  4. Validate the business impact analysis (BIA).

Question 128

Which of the following is the MOST important reason for performing a cost-benefit analysis when implementing a security control?

  1. To ensure that the mitigation effort does not exceed the asset value
  2. To ensure that benefits are aligned with business strategies
  3. To present a realistic information security budget
  4. To justify information security program activities

Question 129

An information security manager wants to document requirements detailing the minimum security controls required for user workstations. Which of the following resources would be MOST appropriate for this purpose?

  1. Policies
  2. Standards
  3. Procedures
  4. Guidelines

Question 130

Which of the following information BEST supports risk management decision making?

  1. Results of a vulnerability assessment
  2. Estimated savings resulting from reduced risk exposure
  3. Average cost of risk events
  4. Quantification of threats through threat modeling