CISM Practice Test

CISM Practice Test practice questions, page 6 of 50, with answer review and explanations.

Question 26

A legacy application does not comply with new regulatory requirements to encrypt sensitive data at rest, and remediating this issue would require significant investment. What should the information security manager do FIRST?

  1. Assess the business impact to the organization.
  2. Present the noncompliance risk to senior management.
  3. Investigate alternative options to remediate the noncompliance.
  4. Determine the cost to remediate the noncompliance.

Question 27

Which of the following BEST enables effective information security governance?

  1. Security-aware corporate culture
  2. Advanced security technologies
  3. Periodic vulnerability assessments
  4. Established information security metrics

Question 28

Application data integrity risk is MOST directly addressed by a design that includes.

  1. strict application of an authorized data dictionary.
  2. reconciliation routines such as checksums, hash totals, and record counts.
  3. application log requirements such as field-level audit trails and user activity logs.
  4. access control technologies such as role-based entitlements.

Question 29

Deciding the level of protection a particular asset should be given is BEST determined by:

  1. the corporate risk appetite.
  2. a risk analysis.
  3. a threat assessment.
  4. a vulnerability assessment.

Question 30

What should be an information security manager's FIRST step when developing a business case for a new intrusion detection system (IDS) solution?

  1. Calculate the total cost of ownership (TCO).
  2. Define the issues to be addressed.
  3. Perform a cost-benefit analysis.
  4. Conduct a feasibility study.