CISM Practice Test

CISM Practice Test practice questions, page 46 of 50, with answer review and explanations.

Question 226

Which of the following would provide the BEST evidence to senior management that security control performance has improved?

  1. Demonstrated return on security investment
  2. Review of security metrics trends
  3. Results of an emerging threat analysis
  4. Reduction in inherent risk

Question 227

An information security manager has identified the organization is not in compliance with new legislation that will soon be in effect. Which of the following is MOST important to consider when determining additional controls to be implemented?

  1. The information security strategy
  2. The organization's risk appetite
  3. The cost of noncompliance
  4. The information security policy

Question 228

The PRIMARY benefit of a centralized time server is that it:

  1. decreases the likelihood of an unrecoverable systems failure.
  2. reduces individual time-of-day requests by client applications.
  3. allows decentralized logs to be kept in synchronization.
  4. is required by password synchronization programs.

Question 229

Which of the following is MOST appropriate to communicate to senior management regarding information risk?

  1. Risk profile changes
  2. Vulnerability scanning progress
  3. Defined risk appetite
  4. Emerging security technologies

Question 230

A new information security manager finds that the organization tends to use short-term solutions to address problems. Resource allocation and spending are not effectively tracked, and there is no assurance that compliance requirements are being met. What should be done FIRST to reverse this bottom-up approach to security?

  1. Implement an information security awareness training program.
  2. Conduct a threat analysis.
  3. Establish an audit committee.
  4. Create an information security steering committee.