CISM Exam Dumps - Certified Information Security Manager
Which of the following is the BEST way for an organization to determine the maturity level of its information security program?
Executive leadership becomes involved in decisions about information security governance.
Executive leadership views information security governance primarily as a concern of the information security management team. What should be an information security manager's MOST important consideration when reviewing a proposed upgrade to a business unit's production database?
Which of the following is the PRIMARY responsibility of an information security manager in an organization that is implementing the use of company-owned mobile devices in its operations?
Management has expressed concerns to the information security manager that shadow IT may be a risk to the organization. What is the FIRST step the information security manager should take?
The MOST effective way to continuously monitor an organization's cybersecurity posture is to evaluate its:
Which of the following should an information security manager do FIRST to address complaints that a newly implemented security control has slowed business operations?
An information security manager wants to improve the ability to identify changes in risk levels affecting the organization's systems. Which of the following is the BEST method to achieve this objective?
The MOST important objective of security awareness training for business staff is to:
Which of the following should be determined FIRST when preparing a risk communication plan?
Which of the following BEST prepares a computer incident response team for a variety of information security scenarios?
Which of the following should be an information security manager's.
MOST important consideration when determining if an information asset has been classified appropriately?
Which of the following is the GREATEST benefit of integrating information security program requirements into vendor management?
What is the PRIMARY objective of implementing standard security configurations?
An organization's ClO has tasked the information security manager with drafting the charter for an information security steering committee. The committee will be comprised of the C/O, the IT shared services manager, the vice president of marketing, and the information security manager. Which of the following is the MOST significant issue with the development of this committee?
Which of the following provides the MOST relevant information to determine the overall effectiveness of an information security program and underlying business processes?
For an organization that is experiencing outages due to malicious code, which of the following is the BEST index of the effectiveness of countermeasures?
An employee clicked on a link in a phishing email, triggering a ransomware attack. Which of the following should be the information security manager's FIRST step?
Which of the following is MOST relevant for an information security manager to communicate to the board of directors?
The PRIMARY goal of the eradication phase in an incident response process is to:
When determining an acceptable risk level, which of the following is the MOST important consideration?
Which of the following is MOST important to ensure when an organization is moving portions of its sensitive database to the cloud?
An anomaly-based intrusion detection system (IDS) operates by gathering data on:
Who should an information security manager contact FIRST upon discovering that a cloud-based payment system used by the organization may be infected with malware?
Which of the following would be MOST effective in changing the security culture and behavior of staff?
Which of the following would BEST help to ensure an organization's security program is aligned with business objectives?
Which of the following provides the MOST comprehensive information related to an organization's current risk profile?
Which of the following is MOST likely to be included in an enterprise security policy?
Which of the following is the MOST effective way to prevent information security incidents?
Which of the following is the BEST method for determining whether a firewall has been configured to provide a comprehensive perimeter defense?
An organization is concerned with the potential for exploitation of vulnerabilities in its server systems. Which of the following is the BEST control to mitigate the associated risk?
Which of the following is an information security manager's BEST course of action to gain approval for investment in a technical control?
An organization's information security manager reads on social media that a recently purchased vendor product has been compromised and customer data has been posted online. What should the information security manager do FIRST?
Which of the following should be the PRIMARY goal of an information security manager when designing information security policies?
An intrusion has been detected and contained. Which of the following steps represents the BEST practice for ensuring the system?
Internal audit has reported a number of information security issues that are not in compliance with regulatory requirements. What should the information security manager do FIRST?
A financial company executive is concerned about recently increasing cyberattacks and needs to take action to reduce risk. The organization would BEST respond by:
Which of the following is the MOST effective approach to ensure IT processes are performed in compliance with the information security policies?
After an Information security incident has been detected and its priority established, which of the following should be the NEXT course of action?
Which of the following should be the MOST important consideration of business continuity management?
Company A, a cloud service provider, is in the process of acquiring Company B to gain new benefits by incorporating their technologies within its cloud services. Which of the following should be the PRIMARY focus of Company A's information security manager?
Which of the following is the MOST effective way to address an organization's security concerns during contract negotiations with a third party?
Which of the following would be the MOST effective countermeasure against malicious programming that rounds down transaction amounts and transfers them to the perpetrator’s account?
An attacker was able to gain access to an organization's perimeter firewall and made changes to allow wider external access and to steal data, Which of the following would have BEST provided timely
identification of this incident?
An organization wants to integrate information security into its human resource management processes. Which of the following should be the FIRST step?
A recent audit found that an organization's new user accounts are not set up uniformly. Which of the following is MOST important for the information security manager to review?
Which of the following is MOST important to include when reporting information security risk to executive leadership?
Which of the following is the PRIMARY responsibility of an information security steering committee composed of management representation from business units?
Which of the following is the MAIN benefit of performing an assessment of existing incident response processes?
Threat and vulnerability assessments are important PRIMARILY because they are:
A measure of the effectiveness of the incident response capabilities of an organization is the:
What is the BEST reason to keep information security policies separate from procedures?
An organization has identified an increased threat of external brute force attacks in its environment. Which of the following is the MOST effective way to mitigate this risk to the organization's critical systems?
The use of a business case to obtain funding for an information security investment is MOST effective when the business case: