INFORMATION SECURITY MANAGEMENT CERTIFICATION – QUESTIONS AND CORRECT
ANSWERS (VERIFIED ANSWERS) PLUS RATIONALES 2026 Q&A | INSTANT DOWNLOAD PDF.
Core Domains
Information Security Governance
Risk Management
Information Security Program Development
Information Security Incident Management
Information Security Operations
Compliance and Legal Regulations
Security Architecture and Engineering
Data Privacy and Protection
Introduction
, *This assessment serves as a comprehensive tool to evaluate a professional's proficiency in managi
SECTION ONE: QUESTIONS 1–100
Question 1
Which of the following best describes the primary purpose of information security governance?
A. Implementing
technical controls to prevent unauthorized access.
B. Aligning security activities with business objectives and legal requirements.
C. Monitoring system performance to ensure maximum uptime.
D. Performing daily backups to ensure data availability.
🟢B
🔴 RATIONALE: Governance ensures that security strategy supports the business mission, manages
risk, and ensures compliance, rather than focusing purely on operational tasks.
Question 2
A company is implementing a new cloud-based CRM. Who holds the ultimate accountability for the
security of data stored in this system?
A. The Cloud Service Provider (CSP).
B. The Chief Information Officer (CIO).
C. The Data Owner within the organization.
D. The Security Operations Center (SOC) manager.
🟢C
🔴 RATIONALE: Regardless of where data is stored, the data owner within the organization remains
accountable for the classification, protection, and oversight of their data.
Question 3
Which risk management component involves identifying and quantifying potential loss events?
A. Risk assessment.
,B. Risk mitigation.
C. Risk avoidance.
D. Risk transfer.
🟢A
🔴 RATIONALE: Risk assessment is the process of identifying threats and vulnerabilities and determining
the impact and likelihood of those risks to the organization.
Question 4
An organization decides to purchase cyber insurance to address potential data breach costs. This is an
example of:
A. Risk acceptance.
B. Risk reduction.
C. Risk transfer.
D. Risk avoidance.
🟢C
🔴 RATIONALE: Transferring risk involves shifting the financial burden of a potential loss to a third party,
such as an insurance provider.
Question 5
What is the primary goal of the principle of least privilege?
A. To reduce the number of administrative accounts.
B. To ensure users have all access rights needed for their entire career.
C. To limit user access to only the resources necessary to perform their job function.
D. To simplify identity management across the enterprise.
🟢C
🔴 RATIONALE: Least privilege restricts access rights to the bare minimum required for a user to
complete their specific tasks, thereby minimizing the impact of potential account compromise.
Question 6
Which of the following is a detective control?
, A. Firewall rules.
B. Intrusion Detection System (IDS).
C. Encryption of data at rest.
D. Security awareness training.
🟢B
🔴 RATIONALE: An IDS is designed to detect and alert on suspicious activity, identifying threats after
they have occurred or are in progress.
Question 7
When classifying data, which category is typically assigned to information that, if disclosed, would cause
minimal damage to the organization?
A. Public.
B. Confidential.
C. Restricted.
D. Top Secret.
🟢A
🔴 RATIONALE: Public data is information intended for general release, where unauthorized disclosure
poses no risk to the organization's operations or reputation.
Question 8
Which component of the CIA triad is most directly impacted by a distributed denial-of-service (DDoS)
attack?
A. Confidentiality.
B. Integrity.
C. Availability.
D. Authenticity.
🟢C
🔴 RATIONALE: DDoS attacks aim to overwhelm system resources, making services or information
inaccessible to authorized users, which is a breach of availability.
ANSWERS (VERIFIED ANSWERS) PLUS RATIONALES 2026 Q&A | INSTANT DOWNLOAD PDF.
Core Domains
Information Security Governance
Risk Management
Information Security Program Development
Information Security Incident Management
Information Security Operations
Compliance and Legal Regulations
Security Architecture and Engineering
Data Privacy and Protection
Introduction
, *This assessment serves as a comprehensive tool to evaluate a professional's proficiency in managi
SECTION ONE: QUESTIONS 1–100
Question 1
Which of the following best describes the primary purpose of information security governance?
A. Implementing
technical controls to prevent unauthorized access.
B. Aligning security activities with business objectives and legal requirements.
C. Monitoring system performance to ensure maximum uptime.
D. Performing daily backups to ensure data availability.
🟢B
🔴 RATIONALE: Governance ensures that security strategy supports the business mission, manages
risk, and ensures compliance, rather than focusing purely on operational tasks.
Question 2
A company is implementing a new cloud-based CRM. Who holds the ultimate accountability for the
security of data stored in this system?
A. The Cloud Service Provider (CSP).
B. The Chief Information Officer (CIO).
C. The Data Owner within the organization.
D. The Security Operations Center (SOC) manager.
🟢C
🔴 RATIONALE: Regardless of where data is stored, the data owner within the organization remains
accountable for the classification, protection, and oversight of their data.
Question 3
Which risk management component involves identifying and quantifying potential loss events?
A. Risk assessment.
,B. Risk mitigation.
C. Risk avoidance.
D. Risk transfer.
🟢A
🔴 RATIONALE: Risk assessment is the process of identifying threats and vulnerabilities and determining
the impact and likelihood of those risks to the organization.
Question 4
An organization decides to purchase cyber insurance to address potential data breach costs. This is an
example of:
A. Risk acceptance.
B. Risk reduction.
C. Risk transfer.
D. Risk avoidance.
🟢C
🔴 RATIONALE: Transferring risk involves shifting the financial burden of a potential loss to a third party,
such as an insurance provider.
Question 5
What is the primary goal of the principle of least privilege?
A. To reduce the number of administrative accounts.
B. To ensure users have all access rights needed for their entire career.
C. To limit user access to only the resources necessary to perform their job function.
D. To simplify identity management across the enterprise.
🟢C
🔴 RATIONALE: Least privilege restricts access rights to the bare minimum required for a user to
complete their specific tasks, thereby minimizing the impact of potential account compromise.
Question 6
Which of the following is a detective control?
, A. Firewall rules.
B. Intrusion Detection System (IDS).
C. Encryption of data at rest.
D. Security awareness training.
🟢B
🔴 RATIONALE: An IDS is designed to detect and alert on suspicious activity, identifying threats after
they have occurred or are in progress.
Question 7
When classifying data, which category is typically assigned to information that, if disclosed, would cause
minimal damage to the organization?
A. Public.
B. Confidential.
C. Restricted.
D. Top Secret.
🟢A
🔴 RATIONALE: Public data is information intended for general release, where unauthorized disclosure
poses no risk to the organization's operations or reputation.
Question 8
Which component of the CIA triad is most directly impacted by a distributed denial-of-service (DDoS)
attack?
A. Confidentiality.
B. Integrity.
C. Availability.
D. Authenticity.
🟢C
🔴 RATIONALE: DDoS attacks aim to overwhelm system resources, making services or information
inaccessible to authorized users, which is a breach of availability.
