CISM Practice Test

CISM Practice Test practice questions, page 5 of 50, with answer review and explanations.

Question 21

Over the last year, an information security manager has performed risk assessments on multiple third-party vendors. Which of the following criteria would be MOST helpful in determining the associated level of risk applied to each vendor?

  1. Compliance requirements associated with the regulation
  2. Criticality of the service to the organization
  3. Corresponding breaches associated with each vendor
  4. Compensating controls in place to protect information security

Question 22

Which of the following is the MOST important security consideration when developing an incident response strategy with a cloud provider?

  1. Security audit reports
  2. Recovery time objective (RTO)
  3. Technological capabilities
  4. Escalation processes

Question 23

Executive leadership has decided to engage a consulting firm to develop and implement a comprehensive security framework for the organization to allow senior management to remain focused on business priorities. Which of the following poses the GREATEST challenge to the successful implementation of the new security governance framework?

  1. Executive leadership becomes involved in decisions about information security governance.
  2. Executive leadership views information security governance primarily as a concern of the information security management team
  3. Information security staff has little or no experience with the practice of information security governance.
  4. Information security management does not fully accept the responsibility for information security governance.

Question 24

Risk scenarios simplify the risk assessment process by:

  1. covering the full range of possible risk.
  2. ensuring business risk is mitigated.
  3. reducing the need for subsequent risk evaluation.
  4. focusing on important and relevant risk.

Question 25

Which of the following is the MOST important consideration when developing information security objectives?

  1. They are regularly reassessed and reported to stakeholders
  2. They are approved by the IT governance function
  3. They are clear and can be understood by stakeholders
  4. They are identified using global security frameworks and standards