©PREP4EXAMS 2024/2025 REAL EXAM DUMPS Tuesday, August 6, 2024 10,57 AM
CISM practice test questions and answers (100% pass)
An information security manager wants to improve the ability to identify changes
in risk levels affecting the organization's systems. Which of the following is the
BEST method to achieve this objective?
A. Performing business impact analysis (BIA)
B. Monitoring key goal indicators (KGIs)
C. Monitoring key risk indicators (KRIs)
D. Updating the risk register - Answer✔️✔️-C
When developing an escalation process for an incident response plan, the
information security manager should PRIMARILY consider the:
A. Affected stakeholders
B. Incident response team
C. Availability of technical resources
D. Media coverage - Answer✔️✔️-A
1
,©PREP4EXAMS 2024/2025 REAL EXAM DUMPS Tuesday, August 6, 2024 10,57 AM
Which of the following should be an information security managers MOST
important consideration when determining if an information asset has been
classified appropriately?
A. Value to the business
B. Security policy requirements
C. Ownership of information
D. Level of protection - Answer✔️✔️-A
The effectiveness of an incident response team will be GREATEST when:
A. The incident response process is updated based on lessons learned
B. The incident response team members are trained security personnel
C. The incident response team meets on a regular basis to review log files
D. Incidents are identified using a security information and event monitoring
(SIEM) system - Answer✔️✔️-A
An information security manager MUST have an understanding of the
organizational business goals to:
A. Relate information security to change management
B. Develop an information security strategy
2
,©PREP4EXAMS 2024/2025 REAL EXAM DUMPS Tuesday, August 6, 2024 10,57 AM
C. Develop operational procedures
D. Define key performance indicators (KPIs) - Answer✔️✔️-D
An information security manager MUST have an understanding of an information
security program?
A. Understanding current and emerging technologies
B. Establishing key performance indicators (KPIs)
C. Conducting periodic risk assessments
D. Obtaining stakeholder input - Answer✔️✔️-D
An attacker was able to gain access to an organizational perimeter firewall and
made changes to allow wider external access and to steal data. Which of the
following would have BEST provided timely identification of this incident?
A. Implementing a data loss prevention (DLP) suite
B. Deploying an intrusion prevention system (IPS)
C. Deploying a security information and event managing system (SIEM)
D. Conducting regular system administrator awareness training - Answer✔️✔️-C
When establishing metrics for an information security program, the BEST
approach is to identify indicators that:
3
, ©PREP4EXAMS 2024/2025 REAL EXAM DUMPS Tuesday, August 6, 2024 10,57 AM
A. Support major information security initiatives
B. Reflect the corporate risk culture
C. Reduce information security spending
D. Demonstrate the effectiveness of the security program - Answer✔️✔️-D
For an organization that provides web-based services, which of the following
security events would MOST likely initiate an incident response plan and be
escalated to management?
A. Anti-malware alerts on several employees workstations
B. Several port scans of web server
C. Multiple failed login attempts on an employee's workstation
D. Suspicious network traffic originating from the demilitarized zone (DMZ) -
Answer✔️✔️-A
An information security manager is implementing a bring your own device
(BYOD) program. Which of the following would BEST ensure that users adhere to
the security standards?
A. Publish the standards on the internet page
B. Deploy a device management solution
4
CISM practice test questions and answers (100% pass)
An information security manager wants to improve the ability to identify changes
in risk levels affecting the organization's systems. Which of the following is the
BEST method to achieve this objective?
A. Performing business impact analysis (BIA)
B. Monitoring key goal indicators (KGIs)
C. Monitoring key risk indicators (KRIs)
D. Updating the risk register - Answer✔️✔️-C
When developing an escalation process for an incident response plan, the
information security manager should PRIMARILY consider the:
A. Affected stakeholders
B. Incident response team
C. Availability of technical resources
D. Media coverage - Answer✔️✔️-A
1
,©PREP4EXAMS 2024/2025 REAL EXAM DUMPS Tuesday, August 6, 2024 10,57 AM
Which of the following should be an information security managers MOST
important consideration when determining if an information asset has been
classified appropriately?
A. Value to the business
B. Security policy requirements
C. Ownership of information
D. Level of protection - Answer✔️✔️-A
The effectiveness of an incident response team will be GREATEST when:
A. The incident response process is updated based on lessons learned
B. The incident response team members are trained security personnel
C. The incident response team meets on a regular basis to review log files
D. Incidents are identified using a security information and event monitoring
(SIEM) system - Answer✔️✔️-A
An information security manager MUST have an understanding of the
organizational business goals to:
A. Relate information security to change management
B. Develop an information security strategy
2
,©PREP4EXAMS 2024/2025 REAL EXAM DUMPS Tuesday, August 6, 2024 10,57 AM
C. Develop operational procedures
D. Define key performance indicators (KPIs) - Answer✔️✔️-D
An information security manager MUST have an understanding of an information
security program?
A. Understanding current and emerging technologies
B. Establishing key performance indicators (KPIs)
C. Conducting periodic risk assessments
D. Obtaining stakeholder input - Answer✔️✔️-D
An attacker was able to gain access to an organizational perimeter firewall and
made changes to allow wider external access and to steal data. Which of the
following would have BEST provided timely identification of this incident?
A. Implementing a data loss prevention (DLP) suite
B. Deploying an intrusion prevention system (IPS)
C. Deploying a security information and event managing system (SIEM)
D. Conducting regular system administrator awareness training - Answer✔️✔️-C
When establishing metrics for an information security program, the BEST
approach is to identify indicators that:
3
, ©PREP4EXAMS 2024/2025 REAL EXAM DUMPS Tuesday, August 6, 2024 10,57 AM
A. Support major information security initiatives
B. Reflect the corporate risk culture
C. Reduce information security spending
D. Demonstrate the effectiveness of the security program - Answer✔️✔️-D
For an organization that provides web-based services, which of the following
security events would MOST likely initiate an incident response plan and be
escalated to management?
A. Anti-malware alerts on several employees workstations
B. Several port scans of web server
C. Multiple failed login attempts on an employee's workstation
D. Suspicious network traffic originating from the demilitarized zone (DMZ) -
Answer✔️✔️-A
An information security manager is implementing a bring your own device
(BYOD) program. Which of the following would BEST ensure that users adhere to
the security standards?
A. Publish the standards on the internet page
B. Deploy a device management solution
4
