CISM Exam Questions and Answers | Exam-Dumps (Page: 19)

QUESTION: 91

To achieve effective strategic alignment of security initiatives, it is important that:

Steering committee leadership be selected by rotation.
Inputs be obtained and consensus achieved between the major organizational units.
The business strategy be updated periodically.
Procedures and standards be approved by all departmental heads.

Answer(s): B

Explanation:

It is important to achieve consensus on risks and controls, and obtain inputs from various organizational entities since security needs to be aligned to the needs of the organization. Rotation of steering committee leadership does not help in achieving strategic alignment. Updating business strategy does not lead to strategic alignment of security initiatives. Procedures and standards need not be approved by all departmental heads

Reveal Solution Next Question

QUESTION: 92

When developing incident response procedures involving servers hosting critical applications, which of the following should be the FIRST to be notified?

Business management
Operations manager
Information security manager
System users

Answer(s): C

Explanation:

The escalation process in critical situations should involve the information security manager as the first contact so that appropriate escalation steps are invoked as necessary. Choices A, B and D would be notified accordingly.

Reveal Solution Next Question

QUESTION: 93

In implementing information security governance, the information security manager is PRIMARILY responsible for:

developing the security strategy.
reviewing the security strategy.
communicating the security strategy.
approving the security strategy

Answer(s): A

Explanation:

The information security manager is responsible for developing a security strategy based on business objectives with the help of business process owners. Reviewing the security strategy is the responsibility of a steering committee. The information security manager is not necessarily responsible for communicating or approving the security strategy.

Reveal Solution Next Question

QUESTION: 94

An information security strategy document that includes specific links to an organization's business activities is PRIMARILY an indicator of:

performance measurement.
integration.
alignment.
value delivery.

Answer(s): C

Explanation:

Strategic alignment of security with business objectives is a key indicator of performance measurement. In guiding a security program, a meaningful performance measurement will also rely on an understanding of business objectives, which will be an outcome of alignment. Business linkages do not by themselves indicate integration or value delivery. While alignment is an important precondition, it is not as important an indicator.

Reveal Solution Next Question

QUESTION: 95

When an organization is setting up a relationship with a third-party IT service provider, which of the following is one of the MOST important topics to include in the contract from a security standpoint?

Compliance with international security standards.
Use of a two-factor authentication system.
Existence of an alternate hot site in case of business disruption.
Compliance with the organization's information security requirements.

Answer(s): D

Explanation:

Prom a security standpoint, compliance with the organization's information security requirements is one of the most important topics that should be included in the contract with third-party service provider. The scope of implemented controls in any ISO 27001-compliant organization depends on the security requirements established by each organization. Requiring compliance only with this security standard does not guarantee that a service provider complies with the organization's security requirements. The requirement to use a specific kind of control methodology is not usually stated in the contract with third- party service providers.

Reveal Solution Next Question

ISACA CISM Exam (page: 19) ISACA Certified Information Security Manager Updated on: 25-Dec-2025

QUESTION: 91

Explanation:

QUESTION: 92

Explanation:

QUESTION: 93

Explanation:

QUESTION: 94

Explanation:

QUESTION: 95

Explanation:

ISACA CISM Exam (page: 19)
ISACA Certified Information Security Manager
Updated on: 25-Dec-2025