CISM Practice Test practice questions, page 4 of 50, with answer review and explanations.
Question 16
The PRIMARY reason for defining the information security roles and responsibilities of staff throughout an organization is to:
comply with security policy.
increase corporate accountability.
enforce individual accountability.
reinforce the need for training.
Question 17
Threat and vulnerability assessments are important PRIMARILY because they are:
used to establish security investments.
needed to estimate risk.
the basis for setting control objectives.
elements of the organization's security posture.
Question 18
Which of the following should be an information security managers PRIMARY focus during the development of a critical system storing highly confidential data?
Ensuring the amount of residual risk is acceptable
Reducing the number of vulnerabilities detected
Avoiding identified system threats
Complying with regulatory requirements
Question 19
When evaluating vendors for sensitive data processing, which of the following should be the FIRST step to ensure the correct level of information security is provided?
Develop metrics for vendor performance.
Include information security criteria as part of vendor selection.
Review third-party reports of potential vendors.
Include information security clauses in the vendor contract.
Question 20
An information security team is investigating an alleged breach of an organization's network. Which of the following would be the BEST single source of evidence to review?
File integrity monitoring (FIM) software
Security information and event management (SIEM) tool