DON'T WANT TO MISS A THING?

Certification Exam Passing Tips

Latest exam news and discount info

Curated and up-to-date by our experts

Yes, send me the newsletter

Prepare Efficiently CISM Exam Questions, Certified Information Security Manager | SPOTO

Prepare efficiently for the Certified Information Security Manager (CISM) exam with SPOTO's comprehensive resources. Our meticulously curated exam questions cover all critical topics, including information security governance, risk management, incident management, and regulatory compliance. Access a variety of exam preparation tools, including sample questions and mock exams, to enhance your understanding and boost your confidence. Say goodbye to unreliable sources and embrace trusted exam practice with SPOTO. Utilize our exam simulator to replicate the exam environment and refine your exam-taking strategies effectively. Whether you're in need of exam materials or online exam questions, SPOTO provides the essential resources for success. Start your exam preparation journey today with our free test and ensure you're fully prepared to pass the CISM exam.
Take other online exams
Question #1
Risk assessment is MOST effective when performed:
A. at the beginning of security program development
B. on a continuous basis
C. while developing the business case for the security program
D. during the business change process
View answer
Correct Answer: C

View The Updated CISM Exam Questions

SPOTO Provides 100% Real CISM Exam Questions for You to Pass Your CISM Exam!

Get CISM Practice Test
Question #2
When an organization is implementing an information security governance program, its board of directors should be responsible for:
A. drafting information security policie
B. reviewing training and awareness program
C. setting the strategic direction of the progra
D. auditing for complianc
View answer
Correct Answer: C
Question #3
Which of the following devices should be placed within a demilitarized zone (DMZ)?
A. Network switch
B. Web server
C. Database server
D. File/print server
View answer
Correct Answer: C
Question #4
Successful social engineering attacks can BEST be prevented through:
A. preemployment screening
B. close monitoring of users' access patterns
C. periodic awareness training
D. efficient termination procedures
View answer
Correct Answer: B
Question #5
The FIRST priority when responding to a major security incident is:
A. documentation
B. monitoring
C. restoration
D. containment
View answer
Correct Answer: A
Question #6
Which of the following is the MOST important action to take when engaging third-party consultants to conduct an attack and penetration test?
A. Request a list of the software to be used
B. Provide clear directions to IT staff
C. Monitor intrusion detection system (IDS) and firewall logs closely
D. Establish clear rules of engagement
View answer
Correct Answer: A
Question #7
Which resource is the MOST effective in preventing physical access tailgating/piggybacking?
A. Card key door locks
B. Photo identification
C. Awareness training
D. Biometric scanners
View answer
Correct Answer: A
Question #8
A newly hired information security manager reviewing an existing security investment plan is MOST likely to be concerned when the plan:
A. is based solely on a review of security threats and vulnerabilities in existing IT systems
B. identifies potential impacts that the implementation may have on business processes
C. focuses on compliance with common international security standards
D. has summarized IT costs for implementation rather than providing detail
View answer
Correct Answer: C
Question #9
To ensure that all information security procedures are functional and accurate, they should be designed with the involvement of:
A. end users
C. operational units
D. audit management
View answer
Correct Answer: A
Question #10
Which of the following is the BEST approach to reduce unnecessary duplication of compliance activities?
A. Automation of controls
B. Documentation of control procedures
C. Integration of assurance efforts
D. Standardization of compliance requirements
View answer
Correct Answer: C
Question #11
As part of an international expansion plan, an organization has acquired a company located in another jurisdiction. Which of the following would be the BEST way to maintain any effective information security program?
A. Ensure information security is included in any change control efforts
B. Merge the two information security programs to establish continuity
C. Determine new factors that could influence the information security strategy
D. Implement the current information security program in the acquired company
View answer
Correct Answer: D
Question #12
Which of the following technologies is utilized to ensure that an individual connecting to a corporate internal network over the Internet is not an intruder masquerading as an authorized user?
A. Intrusion detection system (IDS)
B. IP address packet filtering
C. Two-factor authentication
D. Embedded digital signature
View answer
Correct Answer: C
Question #13
Security policies should be aligned MOST closely with:
A. industry' best practices
B. organizational needs
C. generally accepted standards
D. local laws and regulations
View answer
Correct Answer: A
Question #14
The PRIMARY objective of security awareness is to:
A. ensure that security policies are understood
B. influence employee behavior
C. ensure legal and regulatory compliance
D. notify of actions for noncompliance
View answer
Correct Answer: C
Question #15
Which of the following is the PRIMARY advantage of having an established information security governance framework in place when an organization is adopting emerging technologies?
A. An emerging technologies strategy would be in place
B. An effective security risk management process is established
C. End-user acceptance of emerging technologies has been established
D. A cost-benefit analysis process would be easier to perform
View answer
Correct Answer: A
Question #16
Which of the following is a risk of cross-training?
A. Increases the dependence on one employee
B. Does not assist in succession planning
C. One employee may know all parts of a system
D. Does not help in achieving a continuity of operations
View answer
Correct Answer: D
Question #17
Which of the following is the MOST appropriate method to protect a password that opens a confidential file?
A. Delivery path tracing
B. Reverse lookup translation
C. Out-of-band channels
D. Digital signatures
View answer
Correct Answer: B
Question #18
Secure customer use of an e-commerce application can BEST be accomplished through:
A. data encryption
B. digital signatures
C. strong passwords
D. two-factor authentication
View answer
Correct Answer: B
Question #19
Which of the following is an inherent weakness of signature-based intrusion detection systems?
A. A higher number of false positives
B. New attack methods will be missed
C. Long duration probing will be missed
D. Attack profiles can be easily spoofed
View answer
Correct Answer: B
Question #20
07.When collecting admissible evidence, which of the following is the MOST important requirement?
A. eed to know
B. ue diligence
C. reserving audit logs
D. hain of custody
View answer
Correct Answer: d
Question #21
Which of the following is the PRIMARY advantage of desk checking a business continuity plan (BCP)?
A. Assesses the availability and compatibility a backup hardware
B. Allows for greater participation be management and the IT department
C. Ensures that appropriate follow-up work is performed on noted issues
D. Provides a low-cost method of assessing the BCP’s completeness
View answer
Correct Answer: D
Question #22
Which of the following is MOST important to the successful promotion of good security management practices?
A. Security metrics
B. Security baselines
C. Management support
D. Periodic training
View answer
Correct Answer: D
Question #23
A contract bid is digitally signed and electronically mailed. The PRIMARY advantage to using a digital signature is that:
A. the bid and the signature can be copied from one document to another
B. the bid cannot be forged even if the keys are compromised
C. the signature can be authenticated even if no encryption is used
D. any alteration of the bid will invalidate the signature
View answer
Correct Answer: C
Question #24
A data-hosting organization’s data center houses servers, applications, and data for a large number of geographically dispersed customers. Which of the following strategies would be the BEST approach for developing a physical access control policy for the organization?
A. Design single sign-on or federated access
B. Conduct a risk assessment to determine security risks and mitigating controls
C. Develop access control requirements for each system and application
D. Review customers’ security policies
View answer
Correct Answer: B
Question #25
A critical device is delivered with a single user and password that is required to be shared for multiple users to access the device. An information security manager has been tasked with ensuring all access to the device is authorized. Which of the following would be the MOST efficient means to accomplish this?
A. Enable access through a separate device that requires adequate authentication
B. Implement manual procedures that require password change after each use
C. Request the vendor to add multiple user IDs
D. Analyze the logs to detect unauthorized access
View answer
Correct Answer: A
Question #26
Documented standards/procedures for the use of cryptography across the enterprise should PRIMARILY:
A. define the circumstances where cryptography should be used
B. define cryptographic algorithms and key lengths
C. describe handling procedures of cryptographic keys
D. establish the use of cryptographic solutions
View answer
Correct Answer: B
Question #27
Which of the following is generally used to ensure that information transmitted over the Internet is authentic and actually transmitted by the named sender?
A. Biometric authentication
B. Embedded steganographic
C. Two-factor authenticationEmbedded digital signature
D.
View answer
Correct Answer: C
Question #28
01.IT-related risk management activities are MOST effective when they are:
A. reated as a distinct process
B. onducted by the IT department
C. ommunicated to all employees
D. ntegrated within business processes
View answer
Correct Answer: d
Question #29
Which of the following would be the MOST effective countermeasure against malicious programming that rounds down transaction amounts and transfers them to the perpetrator’s account?
A. Ensure that proper controls exist for code review and release management
B. Set up an agent to run a virus-scanning program across platforms
C. Implement controls for continuous monitoring of middleware transactions
D. Apply the latest patch programs to the production operating systems
View answer
Correct Answer: B
Question #30
Which of the following is MOST important for an information security manager to regularly report to senior management?
A. Results of penetration tests
B. Audit reports
C. Impact of unremediated risks
D. Threat analysis reports
View answer
Correct Answer: C
Question #31
An intranet server should generally be placed on the:
A. internal network
B. firewall server
C. external router
D. primary domain controller
View answer
Correct Answer: C
Question #32
Which of the following is the initial step in creating a firewall policy?
A. A cost-benefit analysis of methods for securing the applications
B. Identification of network applications to be externally accessed
C. Identification of vulnerabilities associated with network applications to be externally accessed
D. Creation of an applications traffic matrix showing protection methods
View answer
Correct Answer: B
Question #33
Which of the following is the MOST appropriate board-level activity for information security governance?
A. Establish security and continuity ownership
B. Develop “what-if” scenarios on incidents
C. Establish measures for security baselines
D. Include security in job-performance appraisals
View answer
Correct Answer: B
Question #34
Which of the following is the BEST way to verify that all critical production servers are utilizing up-to- date virus signature files?
A. Verify the date that signature files were last pushed out
B. Use a recently identified benign virus to test if it is quarantined
C. Research the most recent signature file and compare to the console
D. Check a sample of servers that the signature files are current
View answer
Correct Answer: A
Question #35
Which of the following provides the linkage to ensure that procedures are correctly aligned with information security policy requirements?
A. Standards
B. Guidelines
C. Security metricsD
View answer
Correct Answer: C
Question #36
Which of the following is MOST closely associated with a business continuity program?
A. Confirming that detailed technical recovery plans exist
B. Periodically testing network redundancy
C. Updating the hot site equipment configuration every quarter
D. Developing recovery time objectives (RTOs) for critical functions
View answer
Correct Answer: B
Question #37
Which of the following would be MOST effective in the strategic alignment of security initiatives?
A. A security steering committee is set up within the IT department
B. Key information security policies are updated on a regular basis
C. Business leaders participate in information security decision making
D. Policies are created with input from business unit managers
View answer
Correct Answer: B
Question #38
Which of the following represents a PRIMARY area of interest when conducting a penetration test?
A. Data mining
B. Network mapping
C. Intrusion Detection System (IDS)
D. Customer data
View answer
Correct Answer: C
Question #39
A semi-annual disaster recovery test has been completed. Which of the following issues discussed during the lessons learned phase should be of GREATEST concern?
A. A server used in recovery did not have the latest security patches
B. Application testing was completed by system administrators
C. Poor network performance was reported during recovery
D. Some restored systems were not listed in the DNS table of the DR subnet
View answer
Correct Answer: D
Question #40
When electronically stored information is requested during a fraud investigation, which of the following should be the FIRST priority?
A. Assigning responsibility for acquiring the data
B. Locating the data and preserving the integrity of the data
C. Creating a forensically sound image
D. Issuing a litigation hold to all affected parties
View answer
Correct Answer: B
Question #41
Which of the following BEST enables an information security manager to determine the comprehensiveness of an organization’s information security strategy?
A. Business impact analysis
B. Organizational risk appetite
C. Independent security audit
D. Security risk assessment
View answer
Correct Answer: B
Question #42
The implementation of a capacity plan would prevent:
A. file system overload arising from distributed denial-of-service attacks
B. system downtime for scheduled security maintenance
C. software failures arising from exploitation of buffer capacity vulnerabilities
D. application failures arising from insufficient hardware resources
View answer
Correct Answer: A
Question #43
04.Abnormal server communication from inside the organization to external parties may be monitored to:
A. ecord the trace of advanced persistent threats
B. valuate the process resiliency of server operations
C. erify the effectiveness of an intrusion detection system
D. upport a nonrepudiation framework in e-commerce
View answer
Correct Answer: a
Question #44
The business advantage of implementing authentication tokens is that they:
A. provide nonrepudiation
B. reduce overall cost
C. improve access security
D. reduce administrative workload
View answer
Correct Answer: C
Question #45
Which of the following would present the GREATEST risk to information security?
A. Virus signature files updates are applied to all servers every day
B. Security access logs are reviewed within five business days
C. Critical patches are applied within 24 hours of their release
D. Security incidents are investigated within five business days
View answer
Correct Answer: C
Question #46
08.Company A, a cloud service provider, is in the process of acquiring Company B to gain new benefits by incorporating their technologies within its cloud services. Which of the following should be the PRIMARY focus of Company A's information security manager?
A. he cost to align to Company A's security policies
B. he organizational structure of Company B
C. ompany B's security policies
D. ompany A's security architecture
View answer
Correct Answer: c
Question #47
Attacks using multiple methods to spread should be classified:
A. each time the exposure is experienced
B. depending on the method used to spread
C. at the highest potential level of business impact
D. using multiple classifications for each impact
View answer
Correct Answer: C
Question #48
When developing security standards, which of the following would be MOST appropriate to include?
A. Accountability for licenses
B. Acceptable use of IT assets
C. operating system requirements
D. Inventory management
View answer
Correct Answer: A
Question #49
An organization provides information to its supply chain partners and customers through an extranet infrastructure. Which of the following should be the GREATEST concern to an IS auditor reviewing the firewall security architecture?
A. A Secure Sockets Layer (SSL) has been implemented for user authentication and remote administration of the firewall
B. Firewall policies are updated on the basis of changing requirements
C. inbound traffic is blocked unless the traffic type and connections have been specifically permitted
D. The firewall is placed on top of the commercial operating system with all installation options
View answer
Correct Answer: D
Question #50
Which of the following are the MOST important individuals to include as members of an information security steering committee?
A. Direct reports to the chief information officer
B. IT management and key business process owners
C. Cross-section of end users and IT professionals
D. Internal audit and corporate legal departments
View answer
Correct Answer: C

View The Updated ISACA Exam Questions

SPOTO Provides 100% Real ISACA Exam Questions for You to Pass Your ISACA Exam!

Get ISACA Practice Test

View Answers after Submission

Please submit your email and WhatsApp to get the answers of questions.

Note: Please make sure your email ID and Whatsapp are valid so that you can get the correct exam results.

Email:
Whatsapp/phone number:


Copyright © 2024. Designer by SPOTO Official Website. All Rights Reserved.