CISM Practice Test

CISM Practice Test practice questions, page 38 of 50, with answer review and explanations.

Question 186

An organization is in the process of adopting a hybrid data infrastructure, transferring all non-core applications to cloud service providers, and maintaining all core business functions in-house. The information security manager has determined a defense in depth strategy should be used. Which of the following BEST describes this strategy?

  1. Separate security controls for applications, platforms, programs, and endpoints
  2. Multi-factor login requirements for cloud service applications, timeouts, and complex passwords
  3. Deployment of nested firewalls within the infrastructure
  4. Strict enforcement of role-based access control (RBAC)

Question 187

Which of the following is an information security manager's BEST approach when selecting cost-effective controls needed to meet business objectives?

  1. Conduct a gap analysis.
  2. Focus on preventive controls.
  3. Align with industry best practice.
  4. Align with the risk appetite.

Question 188

A risk was identified during a risk assessment. The business process owner has chosen to accept the risk because the cost of remediation is greater than the projected cost of a worst-case scenario. What should be the information security manager's NEXT course of action?

  1. Document and schedule a date to revisit the issue.
  2. Document and escalate to senior management.
  3. Shut down the business application.
  4. Determine a lower-cost approach to remediation.

Question 189

An organization wants to integrate information security into its human resource management processes. Which of the following should be the FIRST step?

  1. Identify information security risk associated with the processes
  2. Assess the business objectives of the processes
  3. Evaluate the cost of information security integration
  4. Benchmark the processes with best practice to identify gaps

Question 190

The MOST effective way to continuously monitor an organization's cybersecurity posture is to evaluate its:

  1. compliance with industry regulations.
  2. key performance indicators (KPIs).
  3. level of support from senior management.
  4. timeliness in responding to attacks.