DON'T WANT TO MISS A THING?

Certification Exam Passing Tips

Latest exam news and discount info

Curated and up-to-date by our experts

Yes, send me the newsletter

Premium CISM Practice Tests & Real Exam Simulations, Certified Information Security Manager | SPOTO

Prepare thoroughly for the ISACA CISM exam with our premium practice tests and real exam simulations. Our meticulously crafted materials cover essential topics including information security governance, risk management, incident management, and regulatory compliance. Gain confidence with our mock exams and sample questions, designed to mimic the format and difficulty level of the actual test. Access our comprehensive exam preparation resources, including exam questions and answers, to refine your skills and knowledge. With our exam simulator, you can experience the exam environment firsthand, ensuring you're fully prepared on exam day. Say goodbye to unreliable exam dumps and embrace a reliable, effective method for mastering the CISM exam. Try our free test today and elevate your exam practice to the next level.
Take other online exams
Question #1
When performing a qualitative risk analysis, which of the following will BEST produce reliable results?
A. Estimated productivity losses
B. Possible scenarios with threats and impacts
C. Value of information assets
D. Vulnerability assessment
View answer
Correct Answer: C
Question #2
Which of the following types of information would the information security manager expect to have the LOWEST level of security protection in a large, multinational enterprise?
A. Strategic business plan
B. Upcoming financial results
C. Customer personal information
D. Previous financial results
View answer
Correct Answer: B
Question #3
An information security manager is advised by contacts in law enforcement that there is evidence that his/ her company is being targeted by a skilled gang of hackers known to use a variety of techniques, including social engineering and network penetration. The FIRST step that the security manager should take is to:
A. perform a comprehensive assessment of the organization's exposure to the hacker's technique
B. initiate awareness training to counter social engineerin
C. immediately advise senior management of the elevated ris
D. increase monitoring activities to provide early detection of intrusio
View answer
Correct Answer: D
Question #4
Who is responsible for ensuring that information is classified?
A. Senior management
B. Security manager
C. Data owner
D. Custodian
View answer
Correct Answer: D
Question #5
An information security manager at a global organization that is subject to regulation by multiple governmental jurisdictions with differing requirements should:
A. bring all locations into conformity with the aggregate requirements of all governmental jurisdiction
B. establish baseline standards for all locations and add supplemental standards as require
C. bring all locations into conformity with a generally accepted set of industry best practice
D. establish a baseline standard incorporating those requirements that all jurisdictions have in commo
View answer
Correct Answer: B
Question #6
Which of the following is the MAIN reason for performing risk assessment on a continuous basis'?
A. Justification of the security budget must be continually mad
B. New vulnerabilities are discovered every da
C. The risk environment is constantly changin
D. Management needs to be continually informed about emerging risk
View answer
Correct Answer: D
Question #7
Which of the following techniques MOST clearly indicates whether specific risk-reduction controls should be implemented?
A. Countermeasure cost-benefit analysis
B. Penetration testing
C. Frequent risk assessment programs
D. Annual loss expectancy (ALE) calculation
View answer
Correct Answer: D
Question #8
Which of the following would be MOST relevant to include in a cost-benefit analysis of a two-factor authentication system?
A. Annual loss expectancy (ALE) of incidents
B. Frequency of incidents
C. Total cost of ownership (TCO)
D. Approved budget for the project
View answer
Correct Answer: D
Question #9
The systems administrator did not immediately notify the security officer about a malicious attack. An information security manager could prevent this situation by:
A. periodically testing the incident response plan
B. regularly testing the intrusion detection system (IDS)
C. establishing mandatory training of all personne
D. periodically reviewing incident response procedure
View answer
Correct Answer: C
Question #10
Which of the following is the MOST appropriate use of gap analysis?
A. Evaluating a business impact analysis (BIA)
B. Developing a balanced business scorecard
C. Demonstrating the relationship between controls
D. Measuring current state v
E. desired future state
View answer
Correct Answer: A
Question #11
When a security standard conflicts with a business objective, the situation should be resolved by:
A. changing the security standar
B. changing the business objectiv
C. performing a risk analysi
D. authorizing a risk acceptanc
View answer
Correct Answer: C
Question #12
Which of the following would be the BEST metric for the IT risk management process?
A. Number of risk management action plans
B. Percentage of critical assets with budgeted remedial
C. Percentage of unresolved risk exposures
D. Number of security incidents identified
View answer
Correct Answer: A
Question #13
Which of the following is MOST important to the success of an information security program?
A. Security' awareness training
B. Achievable goals and objectives
C. Senior management sponsorship
D. Adequate start-up budget and staffing
View answer
Correct Answer: A
Question #14
The MOST important component of a privacy policy is:
A. notification
B. warrantie
C. liabilitie
D. geographic coverag
View answer
Correct Answer: A
Question #15
Which of the following represents the MAJOR focus of privacy regulations?
A. Unrestricted data mining
B. Identity theft
C. Human rights protection
D. Identifiable personal data
View answer
Correct Answer: D
Question #16
To achieve effective strategic alignment of security initiatives, it is important that:
A. Steering committee leadership be selected by rotatio
B. Inputs be obtained and consensus achieved between the major organizational unit
C. The business strategy be updated periodicall
D. Procedures and standards be approved by all departmental head
View answer
Correct Answer: B
Question #17
A company's mail server allows anonymous file transfer protocol (FTP) access which could be exploited. What process should the information security manager deploy to determine the necessity for remedial action?
A. A penetration test
B. A security baseline review
C. A risk assessment
D. A business impact analysis (BIA)
View answer
Correct Answer: B
Question #18
In assessing the degree to which an organization may be affected by new privacy legislation, information security management should FIRST:
A. develop an operational plan for achieving compliance with the legislatio
B. identify systems and processes that contain privacy component
C. restrict the collection of personal information until complian
D. identify privacy legislation in other countries that may contain similar requirement
View answer
Correct Answer: C
Question #19
Data owners must provide a safe and secure environment to ensure confidentiality, integrity and availability of the transaction. This is an example of an information security:
A. baselin
B. strateg
C. procedur
D. polic
View answer
Correct Answer: D
Question #20
When implementing security controls, an information security manager must PRIMARILY focus on:
A. minimizing operational impact
B. eliminating all vulnerabilitie
C. usage by similar organization
D. certification from a third part
View answer
Correct Answer: B

View Answers after Submission

Please submit your email and WhatsApp to get the answers of questions.

Note: Please make sure your email ID and Whatsapp are valid so that you can get the correct exam results.

Email:
Whatsapp/phone number:


Copyright © 2024. Designer by SPOTO Official Website. All Rights Reserved.