CISM Practice Test

CISM Practice Test practice questions, page 37 of 50, with answer review and explanations.

Question 181

Which of the following is MOST important to include when reporting information security risk to executive leadership?

  1. Key performance objectives and budget trends
  2. Security awareness training participation and residual risk exposures
  3. Risk analysis results and key risk indicators (KRIs)
  4. Information security risk management plans and control compliance

Question 182

During which of the following development phases is it MOST challenging to implement security controls?

  1. Implementation phase
  2. Post-implementation phase
  3. Design phase
  4. Development phase

Question 183

An employee is found to be using an external cloud storage service to share corporate information with a third-party consultant, which is against company policy. Which of the following should be the information security manager's FIRST course of action?

  1. Block access to the cloud storage service
  2. Determine the classification level of the information
  3. Seek business justification from the employee
  4. Inform higher management of a security breach

Question 184

Which of the following is the MOST effective method of determining security priorities?

  1. Vulnerability assessment
  2. Gap analysis
  3. Threat assessment
  4. Impact analysis

Question 185

A measure of the effectiveness of the incident response capabilities of an organization is the:

  1. number of incidents detected.
  2. number of employees receiving incident response training.
  3. reduction of the annual loss expectancy (ALE).
  4. time to closure of incidents.