CISM Exam dumps PDF | Exam-Dumps.net (Page: 12)

QUESTION: 56

The MOST basic requirement for an information security governance program is to:

be aligned with the corporate business strategy.
be based on a sound risk management approach.
provide adequate regulatory compliance.
provide best practices for security- initiatives.

Answer(s): A

Explanation:

To receive senior management support, an information security program should be aligned with the corporate business strategy. Risk management is a requirement of an information security program which should take into consideration the business strategy. Security governance is much broader than just regulatory compliance. Best practice is an operational concern and does not have a direct impact on a governance program.

Reveal Solution Next Question

QUESTION: 57

Information security policy enforcement is the responsibility of the:

security steering committee.
chief information officer (CIO).
chief information security officer (CISO).
chief compliance officer (CCO).

Answer(s): C

Explanation:

Information security policy enforcement is the responsibility of the chief information security officer (CISO), first and foremost. The board of directors and executive management should ensure that a security policy is in line with corporate objectives. The chief information officer (CIO) and the chief compliance officer (CCO) are involved in the enforcement of the policy but are not directly responsible for it.

Reveal Solution Next Question

QUESTION: 58

A good privacy statement should include:

notification of liability on accuracy of information.
notification that information will be encrypted.
what the company will do with information it collects.
a description of the information classification process.

Answer(s): C

Explanation:

Most privacy laws and regulations require disclosure on how information will be used. Choice A is incorrect because that information should be located in the web site's disclaimer. Choice B is incorrect because, although encryption may be applied, this is not generally disclosed. Choice D is incorrect because information classification would be contained in a separate policy.

Reveal Solution Next Question

QUESTION: 59

Which of the following would be MOST effective in successfully implementing restrictive password policies?

Regular password audits
Single sign-on system
Security awareness program
Penalties for noncompliance

Answer(s): C

Explanation:

To be successful in implementing restrictive password policies, it is necessary to obtain the buy-in of the end users. The best way to accomplish this is through a security awareness program. Regular password audits and penalties for noncompliance would not be as effective on their own; people would go around them unless forced by the system. Single sign-on is a technology solution that would enforce password complexity but would not promote user compliance. For the effort to be more effective, user buy-in is important.

Reveal Solution Next Question

QUESTION: 60

When designing an information security quarterly report to management, the MOST important element to be considered should be the:

information security metrics.
knowledge required to analyze each issue.
linkage to business area objectives.
baseline against which metrics are evaluated.

Answer(s): C

Explanation:

The link to business objectives is the most important clement that would be considered by management. Information security metrics should be put in the context of impact to management objectives. Although important, the security knowledge required would not be the first element to be considered. Baselining against the information security metrics will be considered later in the process.

Reveal Solution Next Question

ISACA CISM Exam (page: 12) ISACA Certified Information Security Manager Updated on: 31-Mar-2026

QUESTION: 56

Explanation:

QUESTION: 57

Explanation:

QUESTION: 58

Explanation:

QUESTION: 59

Explanation:

QUESTION: 60

Explanation:

ISACA CISM Exam (page: 12)
ISACA Certified Information Security Manager
Updated on: 31-Mar-2026