CISM EXAM PREP UPDATED ACTUAL QUESTIONS AND
CORRECT ANSWERS
Question:
1. Information security governance is primarily driven by:
Answer:
Business strategy
Question:
2. Who should drive the risk analysis for an organization?
Answer:
the Security Manager
Question:
3. Who should be responsible for enforcing access rights to application data?
Answer:
Security administrators
Question:
4. The MOST important component of a privacy policy is:
Answer:
notifications
Question:
5. Investment in security technology and processes should be based on:
Answer:
clear alignment with the goals and objectives of the organization
Question:
6. Define information security governance
Answer:
1. A set of policies and procedures that establishes a framework of information security strategies
2. A practice area that ensures efficient utilization of information resources
Question:
7. The main purpose of information security governance
Answer:
to ensure the safety of information including its Confidentiality, Integrity and Availability. Information
security governance protects information from loss, misuse, unauthorized usage, and destruction during its
life cycle or the time it is being used in an organization.
Question:
8. Benefits of information security governance
, Answer:
- accountability for protecting information during important business activities
- reduction of the impact of security incidents
- reduction in risks to tolerable limits
- protection from civil and legal liabilities
- enhancement of trust in customer relationships
- assurance of policy compliance
- protection of company reputation
Question:
9. In order to be effective, information security governance needs to provide 6 basic outcomes:
Answer:
- strategic alignment
- value delivery
- risk management
- performance measurement
- resource management
- integration
Question:
10. Should information security investments be optimized or minimized?
Answer:
Optimized so that they support business objectives.
Question:
11. Primary goals of resource management:
Answer:
- keeping a record of security practices and processes
- acquiring knowledge and making it accessible
- building a security architecture that identifies and uses infrastructure resources properly
Question:
12. What is Corporate Governance?
Answer:
Corporate governance is a set of procedures and duties performed by the board of directors and executive
management to direct and control the organization. Corporate governance helps the board of directors to
• ensure that business objectives are met
• provide strategic direction for business activities
• verify the efficient use of the organization's resources, and ensure proper handling of business risks
Question:
13. Information Security Governance
CORRECT ANSWERS
Question:
1. Information security governance is primarily driven by:
Answer:
Business strategy
Question:
2. Who should drive the risk analysis for an organization?
Answer:
the Security Manager
Question:
3. Who should be responsible for enforcing access rights to application data?
Answer:
Security administrators
Question:
4. The MOST important component of a privacy policy is:
Answer:
notifications
Question:
5. Investment in security technology and processes should be based on:
Answer:
clear alignment with the goals and objectives of the organization
Question:
6. Define information security governance
Answer:
1. A set of policies and procedures that establishes a framework of information security strategies
2. A practice area that ensures efficient utilization of information resources
Question:
7. The main purpose of information security governance
Answer:
to ensure the safety of information including its Confidentiality, Integrity and Availability. Information
security governance protects information from loss, misuse, unauthorized usage, and destruction during its
life cycle or the time it is being used in an organization.
Question:
8. Benefits of information security governance
, Answer:
- accountability for protecting information during important business activities
- reduction of the impact of security incidents
- reduction in risks to tolerable limits
- protection from civil and legal liabilities
- enhancement of trust in customer relationships
- assurance of policy compliance
- protection of company reputation
Question:
9. In order to be effective, information security governance needs to provide 6 basic outcomes:
Answer:
- strategic alignment
- value delivery
- risk management
- performance measurement
- resource management
- integration
Question:
10. Should information security investments be optimized or minimized?
Answer:
Optimized so that they support business objectives.
Question:
11. Primary goals of resource management:
Answer:
- keeping a record of security practices and processes
- acquiring knowledge and making it accessible
- building a security architecture that identifies and uses infrastructure resources properly
Question:
12. What is Corporate Governance?
Answer:
Corporate governance is a set of procedures and duties performed by the board of directors and executive
management to direct and control the organization. Corporate governance helps the board of directors to
• ensure that business objectives are met
• provide strategic direction for business activities
• verify the efficient use of the organization's resources, and ensure proper handling of business risks
Question:
13. Information Security Governance
