CISM Practice Test

CISM Practice Test practice questions, page 35 of 50, with answer review and explanations.

Question 171

An organization performed a risk analysis and found a large number of assets with low-impact vulnerabilities. The NEXT action of the information security manager should be to:

  1. transfer the risk to a third party.
  2. determine appropriate countermeasures.
  3. report to management.
  4. quantify the aggregated risk.

Question 172

Organization A offers e-commerce services and uses secure transport protocol to protect Internet communication. To confirm communication with Organization A, which of the following would be the BEST for a client to verify?

  1. The URL of the e-commerce server
  2. The certificate of the e-commerce server
  3. The IP address of the e-commerce server
  4. The browser's indication of SSL use

Question 173

Which of the following provides the MOST useful information for identifying security control gaps on an application server?

  1. Risk assessments
  2. Penetration testing
  3. Threat models
  4. Internal audit reports

Question 174

Which of the following components of an information security risk assessment is MOST valuable to senior management?

  1. Residual risk
  2. Return on investment (ROI)
  3. Mitigation actions
  4. Threat profile

Question 175

Which of the following is the PRIMARY benefit of implementing a maturity model for information security management?

  1. Gaps between current and desirable levels will be addressed.
  2. Information security management costs will be optimized.
  3. Information security strategy will be in line with industry best practice.
  4. Staff awareness of information security compliance will be promoted.