CISM Practice Test

CISM Practice Test practice questions, page 29 of 50, with answer review and explanations.

Question 141

The MOST important objective of security awareness training for business staff is to:

  1. understand intrusion methods.
  2. reduce negative audit findings.
  3. increase compliance.
  4. modify behavior.

Question 142

Which of the following is the PRIMARY responsibility of an information security steering committee?

  1. Setting up password expiration procedures
  2. Drafting security policies
  3. Prioritizing security initiatives
  4. Reviewing firewall rules

Question 143

During a post-incident review, the sequence and correlation of actions must be analyzed PRIMARILY based on:

  1. a consolidated event timeline.
  2. logs from systems involved.
  3. interviews with personnel.
  4. documents created during the incident.

Question 144

Which of the following is the MOST important element in the evaluation of inherent security risks?

  1. Impact to the organization
  2. Control effectiveness
  3. Residual risk
  4. Cost of countermeasures

Question 145

Recovery time objectives (RTOs) are an output of which of the following?

  1. Business continuity plan (BCP)
  2. Business impact analysis (BIA)
  3. Service level agreement (SLA)
  4. Disaster recovery plan (DRP)