CISM Practice Test

CISM Practice Test practice questions, page 50 of 50, with answer review and explanations.

Question 246

An organization's security policy is to disable access to USB storage devices on laptops and desktops. Which of the following is the STRONGEST justification for granting an exception to the policy?

  1. Users accept the risk of noncompliance.
  2. The benefit is greater than the potential risk.
  3. USB storage devices are enabled based on user roles.
  4. Access is restricted to read-only.

Question 247

Which of the following is an information security manager's FIRST priority after a high-profile system has been compromised?

  1. Implement improvements to prevent recurrence.
  2. Identify the malware that compromised the system.
  3. Restore the compromised system.
  4. Preserve incident-related data.

Question 248

Which of the following has the MOST direct impact on the usability of an organization's asset classification policy?

  1. The granularity of classifications in the hierarchy
  2. The support of IT management for the classification scheme
  3. The frequency of updates to the organization's risk register
  4. The business objectives of the organization

Question 249

A corporate information security program is BEST positioned for success when:

  1. staff is receptive to the program.
  2. senior management supports the program.
  3. security is thoroughly assessed in the program.
  4. the program aligns with industry best practice.

Question 250

Following a significant change to the underlying code of an application, it is MOST important for the information security manager to:

  1. inform senior management.
  2. update the risk assessment.
  3. validate the user acceptance testing (UAT).
  4. modify key risk indicators (KRIs).