CISM Practice Test

CISM Practice Test practice questions, page 49 of 50, with answer review and explanations.

Question 241

Which of the following is the PRIMARY reason that an information security manager would contract with an external provider to perform penetration testing?

  1. To obtain an independent network security certification
  2. To mitigate gaps in technical skills
  3. To obtain an independent view of vulnerabilities
  4. To obtain the full list of system vulnerabilities

Question 242

An organization has decided to outsource its disaster recovery function. Which of the following is the MOST important consideration when drafting the service level agreement (SLA)?

  1. Testing requirements
  2. Authorization chain
  3. Recovery time objectives (RTOs)
  4. Recovery point objectives (RPOs)

Question 243

What is the PRIMARY objective of implementing standard security configurations?

  1. Maintain a flexible approach to mitigate potential risk to unsupported systems.
  2. Minimize the operational burden of managing and monitoring unsupported systems.
  3. Compare configurations between supported and unsupported systems.
  4. Control vulnerabilities and reduce threats from changed configurations.

Question 244

Which of the following is MOST important to ensure when considering exceptions to an information security policy?

  1. Exceptions are approved by executive management.
  2. Exceptions undergo regular review.
  3. Exceptions reflect the organizational risk appetite.
  4. Exceptions are based on data classification.

Question 245

An external security audit has reported multiple instances of control noncompliance. Which of the following is MOST important for the information security manager to communicate to senior management?

  1. The impact of noncompliance on the organization's risk profile
  2. An accountability report to initiate remediation activities
  3. Control owner responses based on a root cause analysis
  4. A plan for mitigating the risk due to noncompliance