CISM Exam Questions and Answers | Exam-Dumps (Page: 17)

QUESTION: 81

Temporarily deactivating some monitoring processes, even if supported by an acceptance of operational risk, may not be acceptable to the information security manager if:

it implies compliance risks.
short-term impact cannot be determined.
it violates industry security practices.
changes in the roles matrix cannot be detected.

Answer(s): A

Explanation:

Monitoring processes are also required to guarantee fulfillment of laws and regulations of the organization and, therefore, the information security manager will be obligated to comply with the law. Choices B and C are evaluated as part of the operational risk. Choice D is unlikely to be as critical a breach of regulatory legislation. The acceptance of operational risks overrides choices B, C and D.

Reveal Solution Next Question

QUESTION: 82

An outcome of effective security governance is:

business dependency assessment
strategic alignment.
risk assessment.
planning.

Answer(s): B

Explanation:

Business dependency assessment is a process of determining the dependency of a business on certain information resources. It is not an outcome or a product of effective security management. Strategic alignment is an outcome of effective security governance. Where there is good governance, there is likely to be strategic alignment. Risk assessment is not an outcome of effective security governance; it is a process. Planning comes at the beginning of effective security governance, and is not an outcome but a process.

Reveal Solution Next Question

QUESTION: 83

How would an information security manager balance the potentially conflicting requirements of an international organization's security standards and local regulation?

Give organization standards preference over local regulations
Follow local regulations only
Make the organization aware of those standards where local regulations causes conflicts
Negotiate a local version of the organization standards

Answer(s): D

Explanation:

Adherence to local regulations must always be the priority. Not following local regulations can prove detrimental to the group organization. Following local regulations only is incorrect since there needs to be some recognition of organization requirements. Making an organization aware of standards is a sensible step, but is not a total solution. Negotiating a local version of the organization standards is the most effective compromise in this situation.

Reveal Solution Next Question

QUESTION: 84

Who should drive the risk analysis for an organization?

Senior management
Security manager
Quality manager
Legal department

Answer(s): B

Explanation:

Although senior management should support and sponsor a risk analysis, the know-how and the management of the project will be with the security department. Quality management and the legal department will contribute to the project.

Reveal Solution Next Question

QUESTION: 85

The FIRST step in developing an information security management program is to:

identify business risks that affect the organization.
clarify organizational purpose for creating the program.
assign responsibility for the program.
assess adequacy of controls to mitigate business risks.

Answer(s): B

Explanation:

In developing an information security management program, the first step is to clarify the organization's purpose for creating the program. This is a business decision based more on judgment than on any specific quantitative measures. After clarifying the purpose, the other choices are assigned and acted upon.

Reveal Solution Next Question

ISACA CISM Exam (page: 17) ISACA Certified Information Security Manager Updated on: 25-Dec-2025

QUESTION: 81

Explanation:

QUESTION: 82

Explanation:

QUESTION: 83

Explanation:

QUESTION: 84

Explanation:

QUESTION: 85

Explanation:

ISACA CISM Exam (page: 17)
ISACA Certified Information Security Manager
Updated on: 25-Dec-2025