CERTIFIED INFORMATION SECURITY MANAGER (CISM)
EXAMINATION QUESTIONS AND CORRECT
ANSWER&EXPLANATION|GRADED A+ STUDY GUIDE
SOUTHERN NEW HAMPSHIRE UNIVERSITY
1. The primary focus of CISM is:
A. Technical hacking skills
B. Information security management
C. Programming
D. Hardware repair
Answer: B
Rationale: CISM focuses on governance and management of security programs.
2. CISM is offered by:
A. ISC²
B. ISACA
C. CompTIA
D. Cisco
Answer: B
Rationale: ISACA administers CISM certification.
3. Information security governance ensures:
A. Alignment with business goals
B. Coding standards
C. Hardware upgrades
D. Network speed
Answer: A
Rationale: Security supports business objectives.
4. The CIA triad stands for:
,A. Confidentiality, Integrity, Availability
B. Control, Inspection, Audit
C. Cyber, Internet, Access
D. Communication, Identity, Authorization
Answer: A
Rationale: Core security principles.
5. Confidentiality ensures:
A. Only authorized access to data
B. Data deletion
C. Faster processing
D. Open access
Answer: A
Rationale: Protects sensitive information.
6. Integrity ensures:
A. Data is accurate and unmodified
B. Data is deleted
C. Data is public
D. Data is compressed
Answer: A
Rationale: Prevents unauthorized changes.
7. Availability ensures:
A. Systems are accessible when needed
B. Data is encrypted only
C. Data is deleted
D. Systems are offline
Answer: A
Rationale: Ensures uptime.
8. Risk is defined as:
, A. Likelihood × Impact
B. Hardware failure
C. Software bug
D. Network speed
Answer: A
Rationale: Standard risk calculation.
9. Risk appetite refers to:
A. Level of risk organization accepts
B. Total system risk
C. Number of users
D. Firewall strength
Answer: A
Rationale: Acceptable risk level.
10. Risk tolerance is:
A. Acceptable variation in risk
B. Zero risk
C. Maximum hardware speed
D. Encryption level
Answer: A
Rationale: Allowed deviation.
11. Risk management process begins with:
A. Risk identification
B. Risk acceptance
C. Risk transfer
D. Risk deletion
Answer: A
Rationale: First step is identifying risks.
12. Risk mitigation means:
EXAMINATION QUESTIONS AND CORRECT
ANSWER&EXPLANATION|GRADED A+ STUDY GUIDE
SOUTHERN NEW HAMPSHIRE UNIVERSITY
1. The primary focus of CISM is:
A. Technical hacking skills
B. Information security management
C. Programming
D. Hardware repair
Answer: B
Rationale: CISM focuses on governance and management of security programs.
2. CISM is offered by:
A. ISC²
B. ISACA
C. CompTIA
D. Cisco
Answer: B
Rationale: ISACA administers CISM certification.
3. Information security governance ensures:
A. Alignment with business goals
B. Coding standards
C. Hardware upgrades
D. Network speed
Answer: A
Rationale: Security supports business objectives.
4. The CIA triad stands for:
,A. Confidentiality, Integrity, Availability
B. Control, Inspection, Audit
C. Cyber, Internet, Access
D. Communication, Identity, Authorization
Answer: A
Rationale: Core security principles.
5. Confidentiality ensures:
A. Only authorized access to data
B. Data deletion
C. Faster processing
D. Open access
Answer: A
Rationale: Protects sensitive information.
6. Integrity ensures:
A. Data is accurate and unmodified
B. Data is deleted
C. Data is public
D. Data is compressed
Answer: A
Rationale: Prevents unauthorized changes.
7. Availability ensures:
A. Systems are accessible when needed
B. Data is encrypted only
C. Data is deleted
D. Systems are offline
Answer: A
Rationale: Ensures uptime.
8. Risk is defined as:
, A. Likelihood × Impact
B. Hardware failure
C. Software bug
D. Network speed
Answer: A
Rationale: Standard risk calculation.
9. Risk appetite refers to:
A. Level of risk organization accepts
B. Total system risk
C. Number of users
D. Firewall strength
Answer: A
Rationale: Acceptable risk level.
10. Risk tolerance is:
A. Acceptable variation in risk
B. Zero risk
C. Maximum hardware speed
D. Encryption level
Answer: A
Rationale: Allowed deviation.
11. Risk management process begins with:
A. Risk identification
B. Risk acceptance
C. Risk transfer
D. Risk deletion
Answer: A
Rationale: First step is identifying risks.
12. Risk mitigation means:
