Regular Free Updates CISM Dumps Real Exam Questions Test Engine Mar 12, 2026
Practice Test Questions Verified Answers As Experienced in the Actual Test!
NEW QUESTION # 160
The BEST way to integrate information security governance with corporate governance is to ensure:
- A. the information security steering committee monitors compliance with security policies.
- B. awareness programs include industry best practice for information security governance.
- C. the information security program is included in regular external audits.
- D. management teams embed information security into business processes.
Answer: D
Explanation:
The best way to integrate information security governance with corporate governance is for management teams to embed information security into business processes. The CISM Review Manual explains that aligning security objectives and activities with organizational goals and business processes ensures that security is a core part of business operations and strategy, not an isolated activity.
Reference:ISACA CISM Review Manual, 16th Edition, Page 38-39, "Integration of Information Security with Business Processes".
NEW QUESTION # 161
Which of the following is MOST important to include in security incident escalation procedures?
- A. Notification criteria
- B. Containment procedures
- C. Recovery procedures
- D. Key objectives of the security program
Answer: A
Explanation:
Explanation
The most important thing to include in security incident escalation procedures is notification criteria. This is because notification criteria define who needs to be informed of an incident, when, and how, depending on the severity, impact, and nature of the incident. Notification criteria help to ensure that the appropriate stakeholders are aware of the incident and can take the necessary actions to respond, mitigate, and recover from it. Notification criteria also help to comply with legal and regulatory requirements for reporting incidents to external parties, such as customers, authorities, or media.
Notification criteria define who needs to be informed of an incident, when, and how, depending on the severity, impact, and nature of the incident. (From CISM Manual or related resources) References = CISM Review Manual 15th Edition, Chapter 4, Section 4.2.2, page 2121; CISM Review Questions, Answers & Explanations Manual 9th Edition, Question 1, page 1
NEW QUESTION # 162
Of the following, which is the MOST important aspect of forensic investigations?
- A. Timely intervention
- B. The independence of the investigator
- C. Chain of custody
- D. Identifying the perpetrator
Answer: C
Explanation:
Section: INCIDENT MANAGEMENT AND RESPONSE
Explanation:
Establishing the chain of custody is one of the most important steps in conducting forensic investigations since it preserves the evidence in a manner that is admissible in court. The independence of the investigator may be important, but is not the most important aspect. Timely intervention is important for containing incidents, but not as important for forensic investigation. Identifying the perpetrator is important, but maintaining the chain of custody is more important in order to have the perpetrator convicted in court.
NEW QUESTION # 163
The PRIMARY reason to create and externally store the disk hash value when performing forensic data acquisition from a hard disk is to:
- A. reinstate original data when accidental changes occur.
- B. provide backup in case of media failure.
- C. validate the integrity during analysis.
- D. validate the confidentiality during analysis.
Answer: C
Explanation:
Explanation
The main purpose of creating and storing an external disk hash value when performing forensic data acquisition from a hard disk is to validate the integrity of the data during the analysis. This is done by comparing the original hash value of the disk to the hash value created during the acquisition process, which can be used to ensure that the data has not been tampered with or corrupted in any way. Additionally, by creating a hash value of the disk, it can be used to quickly verify the integrity of any data that is accessed from the disk in the future.
NEW QUESTION # 164
Secure customer use of an e-commerce application can BEST be accomplished through:
- A. data encryption.
- B. two-factor authentication.
- C. strong passwords.
- D. digital signatures.
Answer: A
Explanation:
Explanation
Encryption would be the preferred method of ensuring confidentiality in customer communications with an e-commerce application. Strong passwords, by themselves, would not be sufficient since the data could still be intercepted, while two-factor authentication would be impractical. Digital signatures would not provide a secure means of communication. In most business-to-customer (B-to-C) web applications, a digital signature is also not a practical solution.
NEW QUESTION # 165
Which of the following is the MOST important process that an information security manager needs to negotiate with an outsource service provider?
- A. The right to conduct independent security reviews
- B. A legally binding data protection agreement
- C. Encryption between the organization and the provider
- D. A joint risk assessment of the system
Answer: A
Explanation:
Explanation
A key requirement of an outsource contract involving critical business systems is the establishment of the organization's right to conduct independent security reviews of the provider's security controls. A legally binding data protection agreement is also critical, but secondary to choice A, which permits examination of the actual security controls prevailing over the system and. as such, is the more effective risk management tool.
Network encryption of the link between the organization and the provider may well be a requirement, but is not as critical since it would also be included in choice
A. A joint risk assessment of the system in conjunction with the outsource provider may be a compromise solution, should the right to conduct independent security reviews of the controls related to the system prove contractually difficult.
NEW QUESTION # 166
Which of the following should an information security manager do FIRST when creating an organization's disaster recovery plan (DRP)?
- A. Identify the response and recovery learns.
- B. Review the communications plan.
- C. Develop response and recovery strategies.
- D. Conduct a business impact analysis (BIA)
Answer: D
Explanation:
Conducting a business impact analysis (BIA) is the first step when creating an organization's disaster recovery plan (DRP) because it helps to identify and prioritize the critical business functions or processes that need to be restored after a disruption, and determine their recovery time objectives (RTOs) and recovery point objectives (RPOs)2. Identifying the response and recovery teams is not the first step, but rather a subsequent step that involves assigning roles and responsibilities for executing the DRP. Reviewing the communications plan is not the first step, but rather a subsequent step that involves defining the communication channels and protocols for notifying and updating the stakeholders during and after a disruption. Developing response and recovery strategies is not the first step, but rather a subsequent step that involves selecting and implementing the appropriate solutions and procedures for restoring the critical business functions or processes. References:
2 https://www.isaca.org/resources/isaca-journal/issues/2018/volume-3/business-impact-analysis-bia-and- disaster-recovery-planning-drp
NEW QUESTION # 167
An information security manager should begin a business continuity planning (BCP) process by:
- A. defining the recovery point objectives (RPOs).
- B. Identifying alternative processing sites.
- C. performing a business impact analysis (BIA).
- D. defining the business objectives.
Answer: C
NEW QUESTION # 168
Prior to conducting a forensic examination, an information security manager should:
- A. shut down and relocate the server.
- B. create an image of the original data on new media.
- C. boot the original hard disk on a clean system.
- D. duplicate data from the backup media.
Answer: B
Explanation:
Explanation
Prior to conducting a forensic examination, an information security manager should create an image of the original data on new media. This is done in order to preserve the evidence, as making changes to the original data could potentially alter or destroy the evidence. Creating an image of the data also helps to ensure that the data remains intact and free from any interference or tampering.
NEW QUESTION # 169
Which of the following should an information security manager do NEXT after creating a roadmap to execute the strategy for an information security program?
- A. Review alignment with business goals.
- B. Define organizational risk tolerance.
- C. Develop a project plan to implement the strategy.
- D. Obtain consensus on the strategy from the executive board.
Answer: C
NEW QUESTION # 170
Which of the following is an example of risk mitigation?
- A. Purchasing insurance
- B. Performing a cost-benefit analysis
- C. Improving security controls
- D. Discontinuing the activity associated with the risk
Answer: C
Explanation:
Improving security controls is an example of risk mitigation, which is the process of reducing the likelihood or impact of a risk. Risk mitigation can be achieved by implementing various strategies, such as purchasing insurance, discontinuing the activity associated with the risk, or improving security controls. Purchasing insurance is a form of risk transfer, which is the process of shifting the responsibility or burden of a risk to another party. Discontinuing the activity associated with the risk is a form of risk avoidance, which is the process of eliminating or avoiding a potential source of harm. Performing a cost-benefit analysis is a form of risk evaluation, which is the process of assessing the costs and benefits of different options to manage a risk. References = CISM Review Manual, 16th Edition, page 1741; CISM Review Questions, Answers & Explanations Manual, 10th Edition, page 802
NEW QUESTION # 171
Which of the following is MOST important to consider when determining the criticality and sensitivity of an information asset?
- A. Business functions supported by the asset
- B. Investment required to protect the asset
- C. Results of business continuity testing
- D. Number of threats that can impact the asset
Answer: A
NEW QUESTION # 172
Company A, a cloud service provider, is in the process of acquiring Company B to gain new benefits by incorporating their technologies within its cloud services.
Which of the following should be the PRIMARY focus of Company A's information security manager?
- A. Company A's security architecture
- B. The cost to align to Company A's security policies
- C. The organizational structure of Company B
- D. Company B's security policies
Answer: A
Explanation:
Company A's security architecture is the PRIMARY focus of Company A's information security manager, because it defines the overall security design and controls for the cloud services that Company A provides to its customers. The information security manager should ensure that the security architecture is aligned with the business objectives and requirements of Company A, and that it can accommodate the integration of Company B's technologies without compromising the security, performance, and availability of the cloud services.
References =
CISM Review Manual, 16th Edition, ISACA, 2020, p. 67: "Security architecture is the design of the security controls that are applied to the information assets and the relationships among those assets." CISM Review Manual, 16th Edition, ISACA, 2020, p. 68: "The information security manager should ensure that the security architecture is aligned with the enterprise's business objectives and requirements and supports the information security strategy and program." CISM Review Manual, 16th Edition, ISACA, 2020, p. 69: "The information security manager should consider the impact of changes in the enterprise environment, such as mergers and acquisitions, on the security architecture and identify the necessary modifications or enhancements to maintain the security posture of the enterprise."
NEW QUESTION # 173
During a post-incident review, it was determined that a known vulnerability was exploited in order to gain access to a system. The vulnerability was patched as part of the remediation on the offending system. Which of the following should be done NEXT?
- A. Report the root cause of the vulnerability to senior management.
- B. Review the vulnerability management process.
- C. Scan to determine whether the vulnerability is present on other systems.
- D. Install patches on all existing systems.
Answer: C
NEW QUESTION # 174
Which of the following should be an information security manager s MOST important consideration when conducting a physical security review of a potential outsourced data center?
- A. Distance of the data center from the corporate office
- B. Availability of network circuit connections
- C. Proximity to law enforcement
- D. Environmental factors of the surrounding location
Answer: A
NEW QUESTION # 175
Which of the following would BEST help to ensure compliance with an organization's information security requirements by an IT service provider?
- A. Requiring regular reporting frame the IT service provider
- B. Defining information security requirements with internal IT
- C. Requiring an external security audit of the IT service provider
- D. Defining the business recovery plan with the IT service provider
Answer: C
NEW QUESTION # 176
Which of the following is the MOST important prerequisite to performing an information security risk assessment?
- A. Assessing threats and vulnerabilities
- B. Reviewing the business impact analysis (BIA)
- C. Classifying assets
- D. Determining risk tolerance
Answer: C
NEW QUESTION # 177
A critical server for a hospital has been encrypted by ransomware. The hospital is unable to function effectively without this server Which of the following would MOST effectively allow the hospital to avoid paying the ransom?
- A. A continual server replication process
- B. Employee training on ransomware
- C. A properly tested offline backup system
- D. A properly configured firewall
Answer: C
Explanation:
Explanation
The most effective way to avoid paying the ransom in a ransomware attack is to have a properly tested offline backup system. A ransomware attack is a type of cyberattack that encrypts the victim's data or systems and demands a payment for the decryption key. A properly tested offline backup system is a method of storing copies of the data or systems in a separate location that is not connected to the network or the internet. By having a properly tested offline backup system, the hospital can restore its critical server from the backup without paying the ransom or losing any data. The other options are not the most effective way to avoid paying the ransom in a ransomware attack, although they may be some preventive or detective measures. Employee training on ransomware is a preventive measure that can help raise awareness and reduce the likelihood of falling victim to phishing or other social engineering techniques that may deliver ransomware. However, it does not guarantee that employees will always follow best practices or that ransomware will not enter the network through other means. A continual server replication process is a method of creating copies of the server data or systems in real time or near real time. However, it may not be effective against ransomware, as the replication process may also copy the encrypted data or systems, making them unusable. A properly configured firewall is a preventive measure that can help block malicious network traffic and prevent unauthorized access to the server. However, it does not guarantee that ransomware will not bypass the firewall through other channels, such as email attachments or removable media.
NEW QUESTION # 178
Which of the following would BEST assist an information security manager in measuring the existing level of development of security processes against their desired state?
- A. Balanced scorecard
- B. Capability maturity model (CMM)
- C. Security audit reports
- D. Systems and business security architecture
Answer: B
Explanation:
Section: INFORMATION SECURITY PROGRAM MANAGEMENT
Explanation:
The capability maturity model (CMM) grades each defined area of security processes on a scale of 0 to 5 based on their maturity, and is commonly used by entities to measure their existing state and then determine the desired one. Security audit reports offer a limited view of the current state of security. Balanced scorecard is a document that enables management to measure the implementation of their strategy and assists in its translation into action. Systems and business security architecture explain the security architecture of an entity in terms of business strategy, objectives, relationships, risks, constraints and enablers, and provides a business-driven and business-focused view of security architecture.
NEW QUESTION # 179
What is the GREATEST risk when there is an excessive number of firewall rules?
- A. Performance degradation of the whole network
- B. The firewall may not support the increasing number of rules due to limitations
- C. The firewall may show abnormal behavior and may crash or automatically shut down
- D. One rule may override another rule in the chain and create a loophole
Answer: D
Explanation:
Explanation
If there are many firewall rules, there is a chance that a particular rule may allow an external connection although other associated rules are overridden. Due to the increasing number of rules, it becomes complex to test them and. over time, a loophole may occur.
NEW QUESTION # 180
......
To be eligible to take the CISM certification exam, candidates must have at least five years of experience in information security, with at least three years in information security management. Alternatively, candidates can substitute up to two years of experience with a relevant degree, such as a bachelor's or master's degree in information security, information technology, or a related field. Additionally, candidates must adhere to the ISACA Code of Professional Ethics and pass a background check.
The CISM certification exam covers four domains: Information Security Governance, Information Risk Management, Information Security Program Development and Management, and Information Security Incident Management. CISM exam consists of 150 multiple-choice questions and is administered over four hours. To be eligible to take the exam, candidates must have at least five years of experience in information security management, with three years of experience in the CISM domains.
Pass ISACA CISM Exam in First Attempt Easily: https://www.pass4leader.com/ISACA/CISM-exam.html
The Most Efficient CISM Pdf Dumps For Assured Success : https://drive.google.com/open?id=1_wtB8E4ZN_khPVly2PtfJo14pkpOfTIM