DON'T WANT TO MISS A THING?

Certification Exam Passing Tips

Latest exam news and discount info

Curated and up-to-date by our experts

Yes, send me the newsletter

CISM Practice Tests, Mock Tests & Study Resources, Certified Information Security Manager | SPOTO

Prepare for success in the Certified Information Security Manager (CISM) certification exam with SPOTO's comprehensive practice tests, mock tests, and study resources. As an advanced certification, CISM signifies your ability to develop and manage enterprise information security programs effectively. Our practice tests cover a range of exam topics, including information risk management, governance, incident management, and program development. Access free sample questions to assess your knowledge, dive into exam dumps for a deeper understanding, and take mock exams to simulate real testing conditions. Explore our curated exam materials with detailed answers and explanations to reinforce your understanding. Utilize our online exam simulator to practice exam questions, refine your exam strategy, and prepare confidently for the CISM exam.
Take other online exams
Question #1
A common concern with poorly written web applications is that they can allow an attacker to:
A. gain control through a buffer overflow
B. conduct a distributed denial of service (DoS) attack
C. abuse a race condition
D. inject structured query language (SQL) statements
View answer
Correct Answer: D

View The Updated CISM Exam Questions

SPOTO Provides 100% Real CISM Exam Questions for You to Pass Your CISM Exam!

Get CISM Practice Test
Question #2
Which of the following should be of MOST concern to an information security manager reviewing an organization’s data classification program?
A. The program allows exceptions to be granted
B. Labeling is not consistent throughout the organization
C. Data retention requirement are not defined
D. The classifications do not follow industry best practices
View answer
Correct Answer: A
Question #3
Which of the following would be the MOST important factor to be considered in the loss of mobile equipment with unencrypted data?
A. Disclosure of personal information
B. Sufficient coverage of the insurance policy for accidental losses
C. Intrinsic value of the data stored on the equipment
D. Replacement cost of the equipment
View answer
Correct Answer: C
Question #4
Which of the following controls is MOST effective in providing reasonable assurance of physical access compliance to an unmanned server room controlled with biometric devices?
A. Regular review of access control lists
B. Security guard escort of visitors
C. Visitor registry log at the door
D. A biometric coupled with a PIN
View answer
Correct Answer: A
Question #5
An e-commerce order fulfillment web server should generally be placed on which of the following?
A. Internal network
B. Demilitarized zone (DMZ)
C. Database server
D. Domain controller
View answer
Correct Answer: B
Question #6
The BEST strategy for risk management is to:
A. achieve a balance between risk and organizational goals
B. reduce risk to an acceptable level
C. ensure that policy development properly considers organizational risks
D. ensure that all unmitigated risks are accepted by management
View answer
Correct Answer: B
Question #7
When application-level security controlled by business process owners is found to be poorly managed, which of the following could BEST improve current practices?
A. Centralizing security management
B. Implementing sanctions for noncompliance
C. Policy enforcement by IT management
D. Periodic compliance reviews
View answer
Correct Answer: A
Question #8
Following a significant change to the underlying code of an application, it is MOST important for the information security manager to:
A. inform senior management
B. update the risk assessment
C. validate the user acceptance testing
D. modify key risk indicators
View answer
Correct Answer: A
Question #9
The PRIMARY reason for establishing a data classification scheme is to identify:
A. data ownership
B. data-retention strategy
C. appropriate controls
D. recovery priorities
View answer
Correct Answer: A
Question #10
An information security manager uses security metrics to measure the:
A. performance of the information security program
B. performance of the security baseline
C. effectiveness of the security risk analysis
D. effectiveness of the incident response team
View answer
Correct Answer: A
Question #11
Which of the following is the PRIMARY reason to conduct periodic business impact assessments?
A. Improve the results of last business impact assessment
B. Update recovery objectives based on new risks
C. Decrease the recovery times
D. Meet the needs of the business continuity policy
View answer
Correct Answer: D
Question #12
What is the BEST course of action when an information security manager finds an external service provider has not implemented adequate controls for safeguarding the organization’s critical data?
A. Assess the impact of the control gap
B. Initiate contract renegotiations
C. Purchase additional insurance
D. Conduct a controls audit of the provider
View answer
Correct Answer: B
Question #13
A message* that has been encrypted by the sender's private key and again by the receiver's public key achieves:
A. authentication and authorization
B. confidentiality and integrity
C. confidentiality and nonrepudiation
D. authentication and nonrepudiation
View answer
Correct Answer: C
Question #14
The MOST important objective of monitoring key risk indicators (KRIs) related to information security is to:
A. identify change in security exposures
B. reduce risk management costs
C. meet regulatory compliance requirements
D. minimize the loss from security incidents
View answer
Correct Answer: A
Question #15
The PRIMARY benefit of performing an information asset classification is to:
A. link security requirements to business objectives
B. identify controls commensurate to risk
C. define access rights
A.
D. establish ownership
View answer
Correct Answer: B
Question #16
What is the BEST way to determine the level of risk associated with information assets processed by an IT application?
A. Evaluate the potential value of information for an attacker
B. Calculate the business value of the information assets
C. Review the cost of acquiring the information assets for the business
D. Research compliance requirements associated with the information
View answer
Correct Answer: B
Question #17
Which of the following is the BEST course of action for the information security manager when residual risk is above the acceptable level of risk?
A. Perform cost-benefit analysis
B. Recommend additional controls
C. Carry out risk assessment
D. Defer to business management
View answer
Correct Answer: B
Question #18
An information security manager has been asked to create a strategy to protect the organization’s information from a variety of threat vectors. Which of the following should be done FIRST?
A. Perform a threat modeling exercise
B. Develop a risk profile
C. Design risk management processes
D. Select a governance framework
View answer
Correct Answer: B
Question #19
The implementation of a capacity plan would prevent:
A. file system overload arising from distributed denial-of-service attacks
B. system downtime for scheduled security maintenance
C. software failures arising from exploitation of buffer capacity vulnerabilities
D. application failures arising from insufficient hardware resources
View answer
Correct Answer: D
Question #20
To effectively manage an organization’s information security risk, it is MOST important to:
A. periodically identify and correct new systems vulnerabilities
B. assign risk management responsibility to end users
C. benchmark risk scenarios against peer organizations
D. establish and communicate risk tolerance
View answer
Correct Answer: A
Question #21
Which of the following types of information would the information security manager expect to have the LOWEST level of security protection in a large, multinational enterprise?
A. Strategic business plan
B. Upcoming financial resultsCustomer personal information
C.
D. Previous financial results
View answer
Correct Answer: D
Question #22
Which of the following is the MOST appropriate course of action when the risk occurrence rate is low but the impact is high?
A. Risk transfer
B. Risk acceptance
C. Risk mitigation
D. Risk avoidance
View answer
Correct Answer: D
Question #23
Which of the following is MOST important to consider when developing a business case to support the investment in an information security program?
A. Senior management support
B. Results of a cost-benefit analysis
C. Results of a risk assessment
D. Impact on the risk profile
View answer
Correct Answer: D
Question #24
When establishing an information security governance framework, it is MOST important for an information security manager to understand:
A. the regulatory environment
B. information security best practices
C. the corporate culture
D. risk management techniques
View answer
Correct Answer: A
Question #25
Which of the following steps should be performed FIRST in the risk assessment process?
A. Staff interviews
B. Threat identification
C. Asset identification and valuation
D. Determination of the likelihood of identified risks
View answer
Correct Answer: C
Question #26
Which of the following is a PRIMARY responsibility of an information security governance committee?
A. Analyzing information security policy compliance reviews
B. Approving the purchase of information security technologies
C. Reviewing the information security strategy
D. Approving the information security awareness training strategy
View answer
Correct Answer: C
Question #27
Which of the following would BEST help to ensure the alignment between information security and business functions?
A. Developing information security polices
B. Establishing an information security governance committee
C. Establishing a security awareness program
D. Providing funding for information security efforts
View answer
Correct Answer: B
Question #28
Which of the following BEST demonstrates alignment between information security governance and corporate governance?
A. Average number of security incidents across business units
B. Security project justifications provided in terms of business value
C. Number of vulnerabilities identified for high-risk information assets
D. Mean time to resolution for enterprise-wide security incidents
View answer
Correct Answer: B
Question #29
A core business unit relies on an effective legacy system that does not meet the current security standards and threatens the enterprise network. Which of the following is the BEST course of action to address the situation?
A. Document the deficiencies in the risk register
B. Disconnect the legacy system from the rest of the network
C. Require that new systems that can meet the standards be implemented
D. Develop processes to compensate for the deficiencies
View answer
Correct Answer: A
Question #30
Which of the following is the MOST effective way of ensuring that business units comply with an information security governance framework?
A. Integrating security requirements with processes
B. Performing security assessments and gap analysis
C. Conducting a business impact analysis (BIA)
D. Conducting information security awareness training
View answer
Correct Answer: B
Question #31
Risk identification, analysis, and mitigation activities can BEST be integrated into business life cycle processes by linking them to:
A. compliance testing
B. configuration management
C. continuity planning
D. change management
View answer
Correct Answer: B
Question #32
Quantitative risk analysis is MOST appropriate when assessment data:
A. include customer perceptions
B. contain percentage estimates
D. contain subjective information
View answer
Correct Answer: B
Question #33
An organization is developing a disaster recovery plan for a data center that hosts multiple applications. The application recovery sequence would BEST be determined through an analysis of:
A. Key performance indicators (KPIs)
B. Recovery time objectives (RTOs)
C. Recovery point objectives (RPOs)
D. The data classification scheme
View answer
Correct Answer: S
Question #34
When developing an information security governance framework, which of the following should be the FIRST activity?
A. Integrate security within the system’s development life-cycle process
B. Align the information security program with the organization’s other risk and control activities
C. Develop policies and procedures to support the framework
D. Develop response measures to detect and ensure the closure of security breaches
View answer
Correct Answer: B
Question #35
An organization wants to enable digital forensics for a business-critical application. Which of the following will BEST help to support this objective?
A. Install biometric access control
B. Develop an incident response plan
C. Define data retention criteria
D. Enable activity logging
View answer
Correct Answer: A
Question #36
Before final acceptance of residual risk, what is the BEST way for an information security manager to address risk factors determined to be lower than acceptable risk levels?
A. Evaluate whether an excessive level of control is being applied
B. Ask senior management to increase the acceptable risk levels
C. Implement more stringent countermeasures
D. Ask senior management to lower the acceptable risk levels
View answer
Correct Answer: A
Question #37
Which of the following should be the PRIMARY goal of an information security manager when designing information security policies?
A. Reducing organizational security risk
B. Improving the protection of information
C. Minimizing the cost of security controls
D. Achieving organizational objectives
View answer
Correct Answer: A
Question #38
The PRIMARY objective of a risk management program is to: minimize inherent risk.
B. eliminate business risk
C. implement effective controls
D. minimize residual risk
View answer
Correct Answer: D
Question #39
Which of the following is the BEST way for information security manager to identify compliance with information security policies within an organization?
A. Analyze system logs
B. Conduct security awareness testing
C. Perform vulnerability assessments
D. Conduct periodic audits
View answer
Correct Answer: D
Question #40
Which of the following would be MOST helpful in determining an organization’s current capacity to mitigate risk?
A. Capability maturity model
B. Business impact analysis
C. IT security risk and exposure
D. Vulnerability assessment
View answer
Correct Answer: A
Question #41
A large organization is considering a policy that would allow employees to bring their own smartphones into the organizational environment. The MOST important concern to the information security manager should be the:
A. higher costs in supporting end users
B. impact on network capacity
C. decrease in end user productivity
D. lack of a device management solution
View answer
Correct Answer: D
Question #42
Which of the following is the MOST effective way to communicate information security risk to senior management?
A. Business impact analysis
B. Balanced scorecard
C. Key performance indicators (KPIs)
D. Heat map
View answer
Correct Answer: A
Question #43
Which of the following is the BEST method to determine whether an information security program meets an organization’s business objectives?
A. Implement performance measures
B. Review against international security standards
C. Perform a business impact analysis (BIA)
D. Conduct an annual enterprise-wide security evaluation
View answer
Correct Answer: D
Question #44
Which of the following should be PRIMARILY included in a security training program for business process owners?
A. Impact of security risks
B. Application vulnerabilities
C. Application recovery time List of security incidents reported A A CIO has asked the organization’s information security manager to provide both one-year and five-year plans for the information security program
A. To create formal requirements to meet projected security needs for the future
B. To create and document a consistent progression of security capabilities
C. To prioritize risks on a longer scale than the one-year plan
D. To facilitate the continuous improvement of the IT organization
View answer
Correct Answer: B
Question #45
Which of the following is the MOST important consideration for designing an effective information security governance framework?
A. Defined metrics
B. Continuous audit cycle
C. Security policy provisions
D. Security controls automation
View answer
Correct Answer: A
Question #46
When developing a disaster recovery plan, which of the following would be MOST helpful in prioritizing the order in which systems should be recovered?
A. Performing a business impact analysis
B. Measuring the volume of data in each system
C. Reviewing the information security policy
D. Reviewing the business strategy
View answer
Correct Answer: D
Question #47
Which of the following is MOST helpful in integrating information security governance with corporate governance?
A. Assigning the implementation of information security governance to the steering committee
B. Including information security processes within operational and management processes
C. Providing independent reports of information security efficiency and effectiveness to the board
D. Aligning the information security governance to a globally accepted framework
View answer
Correct Answer: B
Question #48
A global financial institution has decided not to take any further action on a denial of service (DoS) risk found by the risk assessment team. The MOST likely reason they made this decision is that:
A. there are sufficient safeguards in place to prevent this risk from happening
B. the needed countermeasure is too complicated to deploy
View answer
Correct Answer: C
Question #49
A risk management program will be MOST effective when:
A. risk appetite is sustained for a long period
B. risk assessments are repeated periodically
C. risk assessments are conducted by a third party
D. business units are involved in risk assessments
View answer
Correct Answer: D
Question #50
Which of the following would be MOST helpful to the information security manager tasked with enforcing enhanced password standards?
A. Conducting password strength testing
B. Reeducating end users on creating strong complex passwords
C. Implementing a centralized identity management system
D. Implementing technical password controls to include strong complexity
View answer
Correct Answer: A
Question #51
During a security assessment, an information security manager finds a number of security patches were not installed on a server hosting a critical business application. The application owner did not approve the patch installation to avoid interrupting the application. Which of the following should be the information security manager’s FIRST course of action?
A. Escalate the risk to senior management
B. Communicate the potential impact to the application owner
C. Report the risk to the information security steering committee
D. Determine mitigation options with IT management
View answer
Correct Answer: D

View The Updated ISACA Exam Questions

SPOTO Provides 100% Real ISACA Exam Questions for You to Pass Your ISACA Exam!

Get ISACA Practice Test

View Answers after Submission

Please submit your email and WhatsApp to get the answers of questions.

Note: Please make sure your email ID and Whatsapp are valid so that you can get the correct exam results.

Email:
Whatsapp/phone number:


Copyright © 2024. Designer by SPOTO Official Website. All Rights Reserved.