Free ISACA CISM Practice Questions & Answers 2026 Part2 | Certified Information Security Manager

Which of the following should an information security manager do FIRST when a legacy application is not compliant with a regulatory requirement, but thebusiness unit does not have the budget for remediation?

Which of the following messages would be MOST effective in obtaining senior management's commitment to information security management?

When an organization hires a new information security manager, which of the following goals should this individual pursue FIRST?

Which of the following is the MOST important information to include in a strategic plan for information security?

Which of the following is MOST important to include in a post-incident review following a databreach?

Which of the following presents the GREATEST challenge to a large multinational organization using an automated identity and access management (IAM) system?

Which of the following BEST indicates that information assets are classified accurately?

An organization has purchased a security information and event management (SIEM) tool. Which of the following is MOST important to consider beforeimplementation?

Senior management commitment and support for information security can BEST be obtained through presentations that:

The cost of implementing a security control should not exceed the:

Which of the following is the MOST important factor when designing information security architecture?

To gain a clear understanding of the impact that a new regulatory requirement will have on an organization's information security controls, an information security manager should FIRST:

Which of the following characteristics is MOST important when looking at prospective candidates for the role of chief information security officer (CISO)?

Which of the following should be the PRIMARY goal of information security?

The chief information security officer (CISO) should ideally have a direct reporting relationship to the:

The MOST appropriate role for senior management in supporting information security is the:

Which of the following should an information security manager do FIRST when a legacy application is not compliant with a regulatory requirement, but the business unit does not have the budget for remediation?

Which of the following is the PRIMARY benefit of implementing a vulnerability assessment process?

During which of the following development phases is it MOST challenging to implement security controls? The development phase is the stage of the system development life cycle (SDLC) where the system requirements, design, architecture, and implementation are performed. The development phase is most challenging to implement security controls because it involves complex and dynamic processes that may not be well understood or documented. Security controls are essential for ensuring the confidentiality, integrity, and availability of the system and its data, as well as for complying with regulatory and contractual obligations. However, security controls may also introduce additional costs, risks, and constraints to the development process, such as: Increased complexity and overhead of testing, verification, validation, and maintenance Reduced flexibility and agility of changing requirements or design Increased dependency on external vendors or third parties for security services or products Increased vulnerability to errors, defects, or vulnerabilities in the code or configuration Increased difficulty in measuring and reporting on security performance or effectiveness Therefore, implementing security controls in the development phase requires careful planning, coordination, communication, and collaboration among all stakeholders involved in the SDLC. It also requires a clear understanding of the security objectives, scope, criteria, standards, policies, procedures, roles, responsibilities, and resources for the system. Moreover, it requires a proactive approach to identifying and mitigating potential threats or risks that may affect the security of the system. Reference= CISM Manual1, Chapter 3: Information Security Program Development (ISPD), Section 3.1: System Development Life Cycle (SDLC)2 1: https://store.isaca.org/s/store#/store/browse/cat/a2D4w00000Ac6NNEAZ/tiles2: https://store.isaca.org/s/store#/store/browse/cat/a2D4w00000Ac6NNEAZ/tiles

Investments in information security technologies should be based on:

An organization has purchased a security information and event management (SIEM) tool. Which of the following is MOST important to consider before implementation?

When management changes the enterprise business strategy, which of the following processes should be used to evaluate the existing information securitycontrols as well as to select new information security controls?

Relationships among security technologies are BEST defined through which of the following?

An enterprise has decided to procure security services from a third-party vendor to support its information security program. Which of the following is MOST important to include in the vendor selection criteria?

Minimum standards for securing the technical infrastructure should be defined in a security:

Senior management commitment and support for information security will BEST be attained by an information security manager by emphasizing:

Senior management commitment and support for information security can BEST be enhanced through:

Implementing the principle of least privilege PRIMARILY requires the identification of:

Which of the following should be the FIRST step in developing an information security plan?

The MOST important reason for an information security manager to be involved in the change management process is to ensure that:

What would be an information security manager's BEST recommendation upon learning that an existing contract with a third party does not clearly identify requirements for safeguarding the organization's critical data?

The PRIMARY goal in developing an information security strategy is to:

Which of the following is the PRIMARY purpose of a business impact analysis (BIA)?

Which of the following roles would represent a conflict of interest for an information security manager?

An information security risk analysis BEST assists an organization in ensuring that:

Which of the following is characteristic of centralized information security management?

An employee who is a remote user has copied financial data from the corporate server to a laptop using virtual private network (VPN) connectivity.

A new risk has been identified in a high availability system. The BEST course of action is to:

When an information security manager is developing a strategic plan for information security, the timeline for the plan should be:

Which of the following is the MOST effective way to address an organization's security concerns during contract negotiations with a third party?

An organization that conducts business globally is planning to utilize a third-party service provider to process payroll information.

Which of the following is the MOST important consideration when establishing an organization'sinformation security governance committee?

Which of the following are seldom changed in response to technological changes?

A business unit has designed a mobile app to provide services to customers. Which of the following is an information security manager's BEST approach when the business resists implementing a strong password policy due to concerns about the user experience?

Which of the following requirements would have the lowest level of priority in information security?

Which of the following is characteristic of decentralized information security management across a geographically dispersed organization?

Which of the following is the BEST way to build a risk-aware culture?

Which of the following is MOST likely to be discretionary?

Who should be responsible for enforcing access rights to application data?

Which of the following is MOST important to complete during the recovery phase of an incident response process before bringing affected systems back online?

Which of the following is the MOST effective way to address an organization's security concerns during contract negotiations with a third party?

Which of the following is the BEST metric to measure the efficiency of an information security program?

Which of the following individuals would be in the BEST position to sponsor the creation of an information security steering group?

Which of the following is MOST appropriate for inclusion in an information security strategy?

An information security manager is assisting in the development of the request for proposal (RFP) for a new outsourced service. This will require the third party to have access to critical business information. The security manager should focus

The PRIMARY purpose for conducting cybersecurity risk assessments is to: