CISM Exam Questions and Answers | Exam-Dumps (Page: 14)

QUESTION: 66

A security manager is preparing a report to obtain the commitment of executive management to a security program. Inclusion of which of the following would be of MOST value?

Examples of genuine incidents at similar organizations
Statement of generally accepted best practices
Associating realistic threats to corporate objectives
Analysis of current technological exposures

Answer(s): C

Explanation:

Linking realistic threats to key business objectives will direct executive attention to them. All other options are supportive but not of as great a value as choice C when trying to obtain the funds for a new program.

Reveal Solution Next Question

QUESTION: 67

The PRIMARY concern of an information security manager documenting a formal data retention policy would be:

generally accepted industry best practices.
business requirements.
legislative and regulatory requirements.
storage availability.

Answer(s): B

Explanation:

The primary concern will be to comply with legislation and regulation but only if this is a genuine business requirement. Best practices may be a useful guide but not a primary concern. Legislative and regulatory requirements are only relevant if compliance is a business need. Storage is irrelevant since whatever is needed must be provided

Reveal Solution Next Question

QUESTION: 68

When personal information is transmitted across networks, there MUST be adequate controls over:

change management.
privacy protection.
consent to data transfer.
encryption devices.

Answer(s): B

Explanation:

Privacy protection is necessary to ensure that the receiving party has the appropriate level of protection of personal data. Change management primarily protects only the information, not the privacy of the individuals. Consent is one of the protections that is frequently, but not always, required. Encryption is a method of achieving the actual control, but controls over the devices may not ensure adequate privacy protection and, therefore, is a partial answer.

Reveal Solution Next Question

QUESTION: 69

An organization's information security processes are currently defined as ad hoc. In seeking to improve their performance level, the next step for the organization should be to:

ensure that security processes are consistent across the organization.
enforce baseline security levels across the organization.
ensure that security processes are fully documented.
implement monitoring of key performance indicators for security processes.

Answer(s): A

Explanation:

The organization first needs to move from ad hoc to repeatable processes. The organization then needs to document the processes and implement process monitoring and measurement. Baselining security levels will not necessarily assist in process improvement since baselining focuses primarily on control improvement. The organization needs to standardize processes both before documentation, and before monitoring and measurement.

Reveal Solution Next Question

QUESTION: 70

Who in an organization has the responsibility for classifying information?

Data custodian
Database administrator
Information security officer
Data owner

Answer(s): D

Explanation:

The data owner has full responsibility over data. The data custodian is responsible for securing the information. The database administrator carries out the technical administration. The information security officer oversees the overall classification management of the information.

Reveal Solution Next Question

ISACA CISM Exam (page: 14) ISACA Certified Information Security Manager Updated on: 25-Dec-2025

QUESTION: 66

Explanation:

QUESTION: 67

Explanation:

QUESTION: 68

Explanation:

QUESTION: 69

Explanation:

QUESTION: 70

Explanation:

ISACA CISM Exam (page: 14)
ISACA Certified Information Security Manager
Updated on: 25-Dec-2025