CISM Practice Test

CISM Practice Test practice questions, page 34 of 50, with answer review and explanations.

Question 166

An information security manager discovers that newly hired privileged users are not taking necessary steps to protect critical information at their workstations. Which of the following is the BEST way to address this situation?

  1. Publish an acceptable use policy and require signed acknowledgment.
  2. Turn on logging and record user activity.
  3. Communicate the responsibility and provide appropriate training.
  4. Implement a data loss prevention (DLP) solution.

Question 167

Which of the following should be the MOST important consideration when prioritizing risk remediation?

  1. Evaluation of risk
  2. Duration of exposure
  3. Comparison to risk appetite
  4. Impact of compliance

Question 168

To set security expectations across the enterprise, it is MOST important for the information security policy to be regularly reviewed and endorsed by:

  1. security administrators.
  2. senior management.
  3. the chief information security officer (CISO).
  4. the IT steering committee.

Question 169

Senior management wants to provide mobile devices to its sales force. Which of the following should the information security manager do FIRST to support this objective?

  1. Develop an acceptable use policy
  2. Conduct a vulnerability assessment on the devices
  3. Assess risks introduced by the technology
  4. Research mobile device management (MDM) solutions

Question 170

An information security manager needs to ensure security testing is conducted on a new system. Which of the following would provide the HIGHEST level of assurance?

  1. The vendor provides the results of a penetration test and code review.
  2. An independent party is directly engaged to conduct testing.
  3. The internal audit team is enlisted to run a vulnerability assessment against the system.
  4. The security team conducts a self-assessment against a recognized industry framework.