CISM Practice Test

CISM Practice Test practice questions, page 32 of 50, with answer review and explanations.

Question 156

During which stage of the software development life cycle (SDLC) should application security controls FIRST be addressed?

  1. Software code development
  2. Configuration management
  3. Requirements gathering
  4. Application system design

Question 157

Which of the following should be of MOST concern to an information security manager reviewing an organization's data classification program?

  1. The classifications do not follow industry best practices.
  2. Labeling is not consistent throughout the organization.
  3. The program allows exceptions to be granted.
  4. Data retention requirements are not defined.

Question 158

Which of the following is PRIMARILY influenced by a business impact analysis (BIA)?

  1. Recovery strategy
  2. Risk mitigation strategy
  3. Security strategy
  4. IT strategy

Question 159

The MAIN purpose of influenced by a business impact guideline for use within a large, international organization is to:

  1. explain the organization's preferred practices for security.
  2. ensure that all business units have the same strategic security goals.
  3. ensure that all business units implement identical security procedures.
  4. provide evidence for auditors that security practices are adequate.

Question 160

Which of the following is an information security manager's BEST course of action upon discovering an organization with budget constraints lacks several important security capabilities?

  1. Suggest the deployment of open-source security tools to mitigate identified risks.
  2. Establish a business case to demonstrate return on investment (ROI) of a security tool.
  3. Recommend that the organization avoid the most severe risks.
  4. Review the most recent audit report and request funding to address the most serious finding.