CISM Practice Test

CISM Practice Test practice questions, page 28 of 50, with answer review and explanations.

Question 136

Which of the following is the MAIN objective of a risk management program?

  1. Reduce corporate liability for information security incidents.
  2. Reduce risk to the level of the organization's risk appetite
  3. Reduce risk to the maximum extent possible
  4. Reduce costs associated with incident response.

Question 137

An information security manager was informed that a planned penetration test could potentially disrupt some services. Which of the following should be the FIRST course of action?

  1. Estimate the impact and inform the business owner.
  2. Accept the risk and document it in the risk register.
  3. Ensure the service owner is available during the penetration test.
  4. Reschedule the activity during an approved maintenance window.

Question 138

The PRIMARY advantage of single sign-on (SSO) is that it will:

  1. support multiple authentication mechanisms.
  2. strengthen user passwords.
  3. increase efficiency of access management.
  4. increase the security of related applications.

Question 139

Which of the following is BEST determined by using technical metrics?

  1. Whether controls are operating effectively
  2. How well security risk is being managed
  3. Whether security resources are adequately allocated
  4. How well the security strategy is aligned with organizational objectives

Question 140

The use of a business case to obtain funding for an information security investment is MOST effective when the business case:

  1. relates the investment to the organization's strategic plan.
  2. realigns information security objectives to organizational strategy.
  3. articulates management's intent and information security directives in clear language.
  4. translates information security policies and standards into business requirements.