2020 Latest Isaca CISM Exam Questions - CISM Dumps
                     Isaca CISM
https://www.realexamcollection.com/isaca/cism-dumps.html
Practice Exam Isaca - CISM
Question #:1
During the due diligence phase of an acquisition, the MOST important course of action for an information
security manager is to:
A.  perform a gap analysis.
B.  review the state of security awareness.
C.  perform a risk assessment
D.  review information security policies
Answer: A
Question #:2
An external security audit has reported multiple instances of control noncompliance. Which of the following is
MOST important for the information security manager to communicate to senior managements.
A.  Control owner responses based on a root cause analysis
B.  An accountability risk to initiate remediation activities
C.  A plan for mitigating the risk due to noncompliance
D.  The impact of noncompliance on the organization's risk profile
Answer: D
Question #:3
Senior management has allocated funding to each of the organization s divisions to address information
security vulnerabilities The funding is based on each division's technology budget from the previous fiscal
year. Which of the following should be of GREATEST concern to the information security manager?
A.  Redundant controls may be implemented across divisions.
B.  Information security governance could be decentralized by division.
C.  Areas of highest risk may not be adequately prioritized for treatment.
D.  Return on investment may be inconsistently reported to senior management
Answer: C
1 of 4
Practice Exam Isaca - CISM
Question #:4
Following a highly sensitive data breach at a large company, all servers and workstations were patched. The
information security manager s NEXT step should be to:
A.  inform senior management of changes in risk metrics.
B.  perform an assessment to measure the current state
C.  deliver security awareness training.
D.  ensure baseline back-ups are performed.
Answer: B
Question #:5
Which of the following is MOST important for an information security manager to communicate to senior
management regarding the security program?
A.  Impact analysts results
B.  User roles and responsibilities
C.  Security architecture changes
D.  Potential risks and exposures
Answer: D
Question #:6
Which of the following would be MOST effective in ensuring that information security is appropriately
addressed in new systems?
A.  Information security staff perform compliance reviews before production begins
B.  Information security staff take responsibility for the design of system security
C.  Internal audit signs off on security prior to implementation
D.  Business requirements must include security objectives.
Answer: D
2 of 4
Practice Exam Isaca - CISM
Question #:7
Which of the following is MOST effective in the strategic alignment of security initiatives?
A.  A security steering committee is set up within the IT deployment.
B.  Key information security policy are updated on a regular basis
C.  Policies are created with input from business unit managers.
D.  Business leaders participate in information security decision making
Answer: D
Question #:8
An organization wants to integrate information security into its human resource management processes. Which
of the following should be the FWST step?
A.  Benchmark the processes with best practice to identify gaps.
B.  Identify information security risk associated with the processes
C.  Assess the business objectives of the processes
D.  Evaluate the cost of information security integration
Answer: C
Question #:9
An organization is in the process of adopting a hybrid data infrastructure, transferring all non-core applications
to cloud service providers and maintaining all core business functions in-house. The information security
manager has determined a defense in depth strategy should be used. Which of the following BEST describes
this strategy?
A.  Deployment of nested firewalls within the infrastructure
B.  Separate security controls for applications, platforms programs and endpoints
C.  Multi-factor login requirements for cloud service applications timeouts, and complex passwords
D.  Strict enforcement of role-based access control (RBAC)
Answer: B
Question #:10
3 of 4
Practice Exam Isaca - CISM
A risk analysis for a new system is being performed. For which of the following is business knowledge MORE
important than IT knowledge?
A.  Vulnerability analysis
B.  Balanced scorecard
C.  Cost-benefit analysis
D.  Impact analysis
Answer: D
https://www.realexamcollection.com/isaca/cism-dumps.html
4 of 4