ISACA Certified Information Security Manager CISM Dumps in PDF

Free ISACA CISM Real Questions (page: 21)

An information security manager must understand the relationship between information security and business operations in order to:

  1. support organizational objectives.
  2. determine likely areas of noncompliance.
  3. assess the possible impacts of compromise.
  4. understand the threats to the business.

Answer(s): A

Explanation:

Security exists to provide a level of predictability for operations, support for the activities of the organization and to ensure preservation of the organization. Business operations must be the driver for security activities in order to set meaningful objectives, determine and manage the risks to those activities, and provide a basis to measure the effectiveness of and provide guidance to the security program. Regulatory compliance may or may not be an organizational requirement. If compliance is a requirement, some level of compliance must be supported but compliance is only one aspect. It is necessary to understand the business goals in order to assess potential impacts and evaluate threats. These are some of the ways in which security supports organizational objectives, but they are not the only ways.



The MOST effective approach to address issues that arise between IT management, business units and security management when implementing a new security strategy is for the information security manager to:

  1. escalate issues to an external third party for resolution.
  2. ensure that senior management provides authority for security to address the issues.
  3. insist that managers or units not in agreement with the security solution accept the risk.
  4. refer the issues to senior management along with any security recommendations.

Answer(s): D

Explanation:

Senior management is in the best position to arbitrate since they will look at the overall needs of the business in reaching a decision. The authority may be delegated to others by senior management after their review of the issues and security recommendations. Units should not be asked to accept the risk without first receiving input from senior management.



Obtaining senior management support for establishing a warm site can BEST be accomplished by:

  1. establishing a periodic risk assessment.
  2. promoting regulatory requirements.
  3. developing a business case.
  4. developing effective metrics.

Answer(s): C

Explanation:

Business case development, including a cost-benefit analysis, will be most persuasive to management. A risk assessment may be included in the business ease, but by itself will not be as effective in gaining management support. Informing management of regulatory requirements may help gain support for initiatives, but given that more than half of all organizations are not in compliance with regulations, it is unlikely to be sufficient in many cases. Good metrics which provide assurance that initiatives are meeting organizational goals will also be useful, but are insufficient in gaining management support.



Which of the following would be the BEST option to improve accountability for a system administrator who has security functions?

  1. Include security responsibilities in the job description
  2. Require the administrator to obtain security certification
  3. Train the system administrator on penetration testing and vulnerability assessment
  4. Train the system administrator on risk assessment

Answer(s): A

Explanation:

The first step to improve accountability is to include security responsibilities in a job description. This documents what is expected and approved by the organization. The other choices are methods to ensure that the system administrator has the training to fulfill the responsibilities included in the job description.



Which of the following is the MOST important element of an information security strategy?

  1. Defined objectives
  2. Time frames for delivery
  3. Adoption of a control framework
  4. Complete policies

Answer(s): A

Explanation:

Without defined objectives, a strategy — the plan to achieve objectives — cannot be developed. Time frames for delivery are important but not critical for inclusion in the strategy document. Similarly, the adoption of a control framework is not critical to having a successful information security strategy. Policies are developed subsequent to, and as a part of, implementing a strategy.



Share your comments for ISACA CISM exam with other users:

J
Jay
9/26/2023 8:00:00 AM

link plz for download

L
Leo
10/30/2023 1:11:00 PM

data quality oecd

B
Blessious Phiri
8/13/2023 9:35:00 AM

rman is one good recovery technology

D
DiligentSam
9/30/2023 10:26:00 AM

need it thx

V
Vani
8/10/2023 8:11:00 PM

good questions

F
Fares
9/11/2023 5:00:00 AM

good one nice revision

L
Lingaraj
10/26/2023 1:27:00 AM

i love this thank you i need

M
Muhammad Rawish Siddiqui
12/5/2023 12:38:00 PM

question # 142: data governance is not one of the deliverables in the document and content management context diagram.

A
al
6/7/2023 10:25:00 AM

most answers not correct here

B
Bano
1/19/2024 2:29:00 AM

what % of questions do we get in the real exam?

O
Oliviajames
10/25/2023 5:31:00 AM

i just want to tell you. i took my microsoft az-104 exam and passed it. your program was awesome. i especially liked your detailed questions and answers and practice tests that made me well-prepared for the exam. thanks to this website!!!

D
Divya
8/27/2023 12:31:00 PM

all the best

K
KY
1/1/2024 11:01:00 PM

very usefull document

A
Arun
9/20/2023 4:52:00 PM

nice and helpful questions

J
Joseph J
7/11/2023 2:53:00 PM

i found the questions helpful

M
Meg
10/12/2023 8:02:00 AM

q 105 . ans is d

N
Navaneeth S
7/14/2023 7:57:00 AM

i have interest to get a sybase iq dba certification

A
Aish
10/11/2023 5:27:00 AM

want to pass exm.

A
Anonymous
6/12/2023 7:23:00 AM

are the answers correct?

K
Kris
7/7/2023 9:43:00 AM

good morning, could you please upload this exam again, i need it to test my knowledge in sd-wan with version 7.0.

M
Meghraj mali
10/7/2023 1:47:00 PM

very nice question

N
Noel
11/1/2022 9:14:00 PM

i have learning disability and this exam dumps allowed me to focus on the actual questions and not worry about notes and the those other study materials.

J
Jas
10/25/2023 6:01:00 PM

165 should be apt

N
Neetu
6/22/2023 8:41:00 AM

please upload the dumps, real need of them

M
Mark
10/24/2023 1:34:00 AM

any recent feeedback?

G
Gopinadh
8/9/2023 4:05:00 AM

question number 2 is indicating you are giving proper questions. observe and change properly.

S
Santhi
1/1/2024 8:23:00 AM

passed today.40% questions were new.litwere case study,lots of new questions on afd,ratelimit,tm,lb,app gatway.got 2 set series of questions which are not present here.questions on azure cyclecloud, no.of vnet/vms required for implimentation,blueprints assignment/management group etc

R
Raviraj Magadum
1/12/2024 11:39:00 AM

practice test

S
sivaramakrishnan
7/27/2023 8:12:00 AM

want the dumps for emc content management server programming(cmsp)

A
Aderonke
10/23/2023 1:52:00 PM

brilliant and helpful

A
Az
9/16/2023 2:43:00 PM

q75. azure files is pass

K
ketty
11/9/2023 8:10:00 AM

very helpful

S
Sonail
5/2/2022 1:36:00 PM

thank you for these questions. it helped a lot.

S
Shariq
7/28/2023 8:00:00 AM

how do i get the h12-724 dumps

AI Tutor 👋 I’m here to help!