CISM Practice Test

CISM Practice Test practice questions, page 30 of 50, with answer review and explanations.

Question 146

Which of the following is the MOST relevant information to include in an information security risk report to facilitate senior management's understanding of impact to the organization?

  1. Detailed assessment of the security risk profile
  2. Risks inherent in new security technologies
  3. Findings from recent penetration testing
  4. Status of identified key security risks

Question 147

Which of the following is MOST important to include in a contract with a critical service provider to help ensure alignment with the organization's information security program?

  1. Escalation paths
  2. Termination language
  3. Key performance indicators (KPIs)
  4. Right-to-audit clause

Question 148

Which of the following is the BEST way to determine if a recent investment in access control software was successful?

  1. Senior management acceptance of the access control software
  2. A comparison of security incidents before and after software installation
  3. A business impact analysis (BIA) of the systems protected by the software
  4. A review of the number of key risk indicators (KRIs) implemented for the software

Question 149

Which of the following is the MOST effective way to mitigate the risk of confidential data leakage to unauthorized stakeholders?

  1. Create a data classification policy.
  2. Implement role-based access controls.
  3. Require the use of login credentials and passwords.
  4. Conduct information security awareness training.

Question 150

Which of the following is the MOST important consideration when reporting the effectiveness of an information security program to key business stakeholders?

  1. Linking security metrics to the business impact analysis (BIA)
  2. Demonstrating a decrease in information security incidents
  3. Demonstrating cost savings of each control
  4. Linking security metrics to business objectives