CISM Exam Questions and Answers | Exam-Dumps (Page: 23)

QUESTION: 111

Which of the following BEST contributes to the development of a security governance framework that supports the maturity model concept?

Continuous analysis, monitoring and feedback
Continuous monitoring of the return on security investment (ROSD
Continuous risk reduction
Key risk indicator (KRD setup to security management processes

Answer(s): A

Explanation:

To improve the governance framework and achieve a higher level of maturity, an organization needs to conduct continuous analysis, monitoring and feedback compared to the current state of maturity. Return on security investment (ROSD may show the performance result of the security-related activities; however, the result is interpreted in terms of money and extends to multiple facets of security initiatives. Thus, it may not be an adequate option. Continuous risk reduction would demonstrate the effectiveness of the security governance framework, but does not indicate a higher level of maturity. Key risk indicator (KRD setup is a tool to be used in internal control assessment. KRI setup presents a threshold to alert management when controls are being compromised in business processes. This is a control tool rather than a maturity model support tool.

Reveal Solution Next Question

QUESTION: 112

The MOST complete business case for security solutions is one that.

includes appropriate justification.
explains the current risk profile.
details regulatory requirements.
identifies incidents and losses.

Answer(s): A

Explanation:

Management is primarily interested in security solutions that can address risks in the most cost-effective way. To address the needs of an organization, a business case should address appropriate security solutions in line with the organizational strategy.

Reveal Solution Next Question

QUESTION: 113

Which of the following is MOST important to understand when developing a meaningful information security strategy?

Regulatory environment
International security standards
Organizational risks
Organizational goals

Answer(s): D

Explanation:

Alignment of security with business objectives requires an understanding of what an organization is trying to accomplish. The other choices are all elements that must be considered, but their importance is secondary and will vary depending on organizational goals.

Reveal Solution Next Question

QUESTION: 114

Which of the following is the BEST advantage of a centralized information security organizational structure?

It allows for a common level of assurance across the enterprise.
It is easier to manage and control business unit security teams.
It is more responsive to business unit needs.
It provides a faster turnaround for security waiver requests.

Answer(s): B

Explanation:

It is easier to manage and control a centralized structure. Promoting security awareness is an advantage of decentralization. Decentralization allows you to use field security personnel as security missionaries or ambassadors to spread the security awareness message. Decentralized operations allow security administrators to be more responsive. Being close to the business allows decentralized security administrators to achieve a faster turnaround than that achieved in a centralized operation.

Reveal Solution Next Question

QUESTION: 115

Which of the following would help to change an organization's security culture?

Develop procedures to enforce the information security policy
Obtain strong management support
Implement strict technical security controls
Periodically audit compliance with the information security policy

Answer(s): B

Explanation:

Management support and pressure will help to change an organization's culture. Procedures will support an information security policy, but cannot change the culture of the organization. Technical controls will provide more security to an information system and staff; however, this does not mean the culture will be changed. Auditing will help to ensure the effectiveness of the information security policy; however, auditing is not effective in changing the culture of the company.

Reveal Solution Next Question

ISACA CISM Exam (page: 23) ISACA Certified Information Security Manager Updated on: 25-Dec-2025

QUESTION: 111

Explanation:

QUESTION: 112

Explanation:

QUESTION: 113

Explanation:

QUESTION: 114

Explanation:

QUESTION: 115

Explanation:

ISACA CISM Exam (page: 23)
ISACA Certified Information Security Manager
Updated on: 25-Dec-2025