CISM Practice Test practice questions, page 8 of 50, with answer review and explanations.
Question 36
An organization's CIO has tasked the information security manager with drafting the charter for an information security steering committee. The committee will be comprised of the CIO, the IT shared services manager, the vice president of marketing, and the information security manager. Which of the following is the MOST significant issue with the development of this committee?
The committee consists of too many senior executives.
The committee lacks sufficient business representation.
There is a conflict of interest between the business and IT.
The CIO is not taking charge of the committee.
Question 37
What is the PRIMARY purpose of an unannounced disaster recovery exercise?
To provide metrics to senior management
To evaluate how personnel react to the situation
To assess service level agreements (SLAs)
To estimate the recovery time objective (RTO)
Question 38
Labeling information according to its security classification:
reduces the need to identify baseline controls for each classification.
reduces the number and type of countermeasures required.
enhances the likelihood of people handling information securely.
affects the consequences if information is handled insecurely.
Question 39
Which of the following is the MOST effective approach for determining whether an organization's information security program supports the information security strategy?
Ensure resources meet information security program needs
Audit the information security program to identify deficiencies
Identify gaps impacting information security strategy
Develop key performance indicators (KPIs) of information security
Question 40
When drafting the corporate privacy statement for a public web site, which of the following MUST be included?