CISM Exam Questions and Answers | Exam-Dumps (Page: 21)

QUESTION: 101

An information security manager must understand the relationship between information security and business operations in order to:

support organizational objectives.
determine likely areas of noncompliance.
assess the possible impacts of compromise.
understand the threats to the business.

Answer(s): A

Explanation:

Security exists to provide a level of predictability for operations, support for the activities of the organization and to ensure preservation of the organization. Business operations must be the driver for security activities in order to set meaningful objectives, determine and manage the risks to those activities, and provide a basis to measure the effectiveness of and provide guidance to the security program. Regulatory compliance may or may not be an organizational requirement. If compliance is a requirement, some level of compliance must be supported but compliance is only one aspect. It is necessary to understand the business goals in order to assess potential impacts and evaluate threats. These are some of the ways in which security supports organizational objectives, but they are not the only ways.

Reveal Solution Next Question

QUESTION: 102

The MOST effective approach to address issues that arise between IT management, business units and security management when implementing a new security strategy is for the information security manager to:

escalate issues to an external third party for resolution.
ensure that senior management provides authority for security to address the issues.
insist that managers or units not in agreement with the security solution accept the risk.
refer the issues to senior management along with any security recommendations.

Answer(s): D

Explanation:

Senior management is in the best position to arbitrate since they will look at the overall needs of the business in reaching a decision. The authority may be delegated to others by senior management after their review of the issues and security recommendations. Units should not be asked to accept the risk without first receiving input from senior management.

Reveal Solution Next Question

QUESTION: 103

Obtaining senior management support for establishing a warm site can BEST be accomplished by:

establishing a periodic risk assessment.
promoting regulatory requirements.
developing a business case.
developing effective metrics.

Answer(s): C

Explanation:

Business case development, including a cost-benefit analysis, will be most persuasive to management. A risk assessment may be included in the business ease, but by itself will not be as effective in gaining management support. Informing management of regulatory requirements may help gain support for initiatives, but given that more than half of all organizations are not in compliance with regulations, it is unlikely to be sufficient in many cases. Good metrics which provide assurance that initiatives are meeting organizational goals will also be useful, but are insufficient in gaining management support.

Reveal Solution Next Question

QUESTION: 104

Which of the following would be the BEST option to improve accountability for a system administrator who has security functions?

Include security responsibilities in the job description
Require the administrator to obtain security certification
Train the system administrator on penetration testing and vulnerability assessment
Train the system administrator on risk assessment

Answer(s): A

Explanation:

The first step to improve accountability is to include security responsibilities in a job description. This documents what is expected and approved by the organization. The other choices are methods to ensure that the system administrator has the training to fulfill the responsibilities included in the job description.

Reveal Solution Next Question

QUESTION: 105

Which of the following is the MOST important element of an information security strategy?

Defined objectives
Time frames for delivery
Adoption of a control framework
Complete policies

Answer(s): A

Explanation:

Without defined objectives, a strategy — the plan to achieve objectives — cannot be developed. Time frames for delivery are important but not critical for inclusion in the strategy document. Similarly, the adoption of a control framework is not critical to having a successful information security strategy. Policies are developed subsequent to, and as a part of, implementing a strategy.

Reveal Solution Next Question

ISACA CISM Exam (page: 21) ISACA Certified Information Security Manager Updated on: 25-Dec-2025

QUESTION: 101

Explanation:

QUESTION: 102

Explanation:

QUESTION: 103

Explanation:

QUESTION: 104

Explanation:

QUESTION: 105

Explanation:

ISACA CISM Exam (page: 21)
ISACA Certified Information Security Manager
Updated on: 25-Dec-2025