2024 CISM Practice Questions and Answers (100% Pass)

2024 CISM Practice Questions and Answers (100% Pass) What would be the BEST security measure we could use to prevent data disclosure and data exfiltration? A) User authentication in all applications. B) Use very strong encryption. C) Use very strong key storage. D) Use very complex firewall rules. - Answer️️ -C) Use very strong key storage. Explanation We would want a very strong key storage, if the attackers can get to our encryption keys, most of the other security measures are irrelevant. Most encryption today is strong enough to not be breakable with current technologies, making it stronger ©PREP4EXAMS 2024/2025 REAL EXAM DUMPS Tuesday, August 6, 2024 10,57 AM 2 does often not make it significantly more secure. Complex firewall rules do not mean more secure, and in this example is a distractor. We would want user authentication in all applications, but not relevant for this question. What is the MOST important reason we have Information Security review our contracts throughout the enterprise? A) To ensure that both parties can perform their contractual promises. B) To ensure the right to audit is a requirement. C) To ensure appropriate controls are included. D) To ensure no confidential information is included in the contract. - Answer️️ - C) To ensure appropriate controls are included. As an IT auditor, Trisha is conducting a compliance review. Which of these is she MOST likely to be performing? ©PREP4EXAMS 2024/2025 REAL EXAM DUMPS Tuesday, August 6, 2024 10,57 AM 3 A) Performing job activity analysis B) Performing program activity analysis C) Performing system aging analysis D) Determine whether program changes are approved - Answer️️ -D) Determine whether program changes are approved Explanation Compliance reviews determine whether the controls are enforcing the regulations and include ensuring there are no unauthorized changes to the production environment. The other answers are part of a substantive review, that verify the accuracy and reasonableness of reported information. Of these options, when is the BEST time to have penetration tests conducted? A) After a high staff turnover. ©PREP4EXAMS 2024/2025 REAL EXAM DUMPS Tuesday, August 6, 2024 10,57 AM 4 B) After significant system changes. C) After an attempted intrusion. D) After an audit has found weaknesses in our security controls. - Answer️️ -B) After significant system changes. At which phase of our systems or software development lifecycle should risk assessments be built in to ensure risks are addressed in the project development? A) The specifications phase. B) The programming phase. C) The user testing phase. ©PREP4EXAMS 2024/2025 REAL EXAM DUMPS Tuesday, August 6, 2024 10,57 AM 5 D) The feasibility phase. - Answer️️ -D) The feasibility phase. Explanation We should address risk as early on in the project as possible, of the phases listed here that would be feasibility. In the programming or the user testing phase is way too late, if the feasibility phase was not an option, then we would do it in specifications, but feasibility is much better. Our organization has just finished a companywide Information Security user awareness training effort and we are going to try to social engineer our employees to gauge how effective the training was. Which of these is NOT a ty