CISM Exam Dumps - Certified Information Security Manager

Zero-day attacks exploit unknown vulnerabilities for which patches and signatures do not yet exist. Therefore, behavior anomaly detection (C) is the most effective approach because it focuses on abnormal system behavior, not known attack patterns. USB controls (A) address a specific threat vector but do not broadly mitigate zero-day risks. Automated antivirus updates (B) and patching programs (D) are essential baseline controls, but they are reactive and ineffective against unknown exploits. CISM emphasizes a risk-based, layered defense strategy, where advanced detection capabilities are used to identify and respond to emerging threats that bypass traditional controls. Behavior-based detection improves resilience against evolving and unknown attack techniques.

The correct answer is A because an untested business continuity plan creates immediate uncertainty about whether the organization can continue or recover critical operations during a disruption. For an e-commerce business, downtime can quickly affect revenue, customer trust, regulatory obligations, and service availability. Testing validates whether recovery procedures, people, technologies, communications, dependencies, and recovery objectives are realistic and achievable. A recovery test exceeding budget expectations is a concern, but it does not necessarily mean the organization cannot recover. A delayed business impact analysis is important because BIA supports continuity planning, but the immediate operational concern is that the plan has not been validated. A lack of recent audit may reduce assurance, but an audit is not a substitute for testing. In CISM, continuity and recovery capabilities must be tested to confirm readiness and identify weaknesses before a real incident occurs. Therefore, the absence of recent BCP testing is the most immediate concern.

The correct answer is B because a documented incident response plan provides the structured guidance needed for effective and timely response. The plan defines roles, responsibilities, escalation paths, communication procedures, severity classifications, containment strategies, evidence handling, notification requirements, and recovery coordination. Without a documented plan, response activities may be delayed, inconsistent, duplicated, or incomplete. Involving internal and external stakeholders is important, but stakeholder involvement must be organized through the incident response plan. Appointing a forensic specialist may be necessary for certain investigations, but not every incident requires forensic expertise. A SIEM solution is useful for monitoring and detection, but technology alone does not ensure that people know how to respond. CISM incident management principles emphasize preparation, documented procedures, communication, role clarity, and repeatable response processes. A documented plan enables responders to act quickly and consistently under pressure. Therefore, having a documented incident response plan in place best supports effective and timely incident response.

According to the web search results, a cloud access security broker (CASB) is a software solution that stands between the cloud service provider and the cloud service user to enforce security controls. One of the most important benefits of using a CASB when migrating to a cloud environment is enhanced data governance, as it helps to protect sensitive information from unauthorized access, sharing, or loss. A CASB can also provide data classification, encryption, data loss prevention (DLP), and other features that enable organizations to manage and secure their data in the cloud.

References = What Is a Cloud Access Security Broker (CASB)?, A beginner’s guide to cloud access security brokers

The results of a risk assessment would best enable an informed decision by senior management when developing a business case to justify an information security investment. A risk assessment will help to identify and prioritize the threats and vulnerabilities that affect the organization’s assets and processes, as well as the potential impact and likelihood of occurrence. A risk assessment will also provide a basis for selecting and evaluating the effectiveness of controls to mitigate the risks. According to CISA, developing a business case for security will be based on an in-depth understanding of organizational vulnerabilities, operational priorities, and return on investment1. The information security strategy, losses due to security incidents, and security investment trends in the industry are possible inputs or outputs of a risk assessment, but they are not sufficient to enable an informed decision by senior management. References: 1: The Business Case for Security - CISA 2: The Business Case for Security | CISA 3: #HowTo: Build a Business Case for Cybersecurity Investment 4: Making the Business Case for Information Security

The correct answer is D because effective recovery from many security incidents depends on the ability to restore reliable data and systems. Offsite backups are especially important when primary systems or data are corrupted, encrypted, destroyed, or otherwise unavailable. Security incidents such as ransomware, destructive malware, insider misuse, or system compromise may require restoration from clean backups. Response team cross-training improves operational flexibility, but it does not directly restore lost or damaged data. Network architecture reviews may improve security design and reduce future exposure, but they are not the most important recovery enabler. Penetration testing helps identify weaknesses before an incident occurs, but it does not support restoration after an incident. CISM incident management includes recovery as a key phase, and recovery requires tested, available, and protected backup capabilities aligned with recovery objectives. Offsite backups reduce dependence on compromised local infrastructure and support business resilience. Therefore, offsite data backups are the most important recovery enabler.