CISM Exam dumps PDF | Exam-Dumps.net (Page: 25)

QUESTION: 121

Which of the following is a benefit of information security governance?

Reduction of the potential for civil or legal liability
Questioning trust in vendor relationships
Increasing the risk of decisions based on incomplete management information
Direct involvement of senior management in developing control processes

Answer(s): A

Explanation:

Information security governance decreases the risk of civil or legal liability. The remaining answers are incorrect. Option D appears to be correct, but senior management would provide oversight and approval as opposed to direct involvement in developing control processes.

Reveal Solution Next Question

QUESTION: 122

Investment in security technology and processes should be based on:

clear alignment with the goals and objectives of the organization.
success cases that have been experienced in previous projects.
best business practices.
safeguards that are inherent in existing technology.

Answer(s): A

Explanation:

Organization maturity level for the protection of information is a clear alignment with goals and objectives of the organization. Experience in previous projects is dependent upon other business models which may not be applicable to the current model. Best business practices may not be applicable to the organization's businessneeds. Safeguards inherent to existing technology are low cost but may not address all business needs and/or goals of the organization.

Reveal Solution Next Question

QUESTION: 123

The data access requirements for an application should be determined by the:

legal department.
compliance officer.
information security manager.
business owner.

Answer(s): D

Explanation:

Business owners are ultimately responsible for their applications. The legal department, compliance officer and information security manager all can advise, but do not have final responsibility.

Reveal Solution Next Question

QUESTION: 124

From an information security perspective, information that no longer supports the main purpose of the business should be:

analyzed under the retention policy.
protected under the information classification policy.
analyzed under the backup policy.
protected under the business impact analysis (BIA).

Answer(s): A

Explanation:

Option A is the type of analysis that will determine whether the organization is required to maintain the data for business, legal or regulatory reasons. Keeping data that are no longer required unnecessarily consumes resources, and, in the case of sensitive personal information, can increase the risk of data compromise.
Options B. C and D are attributes that should be considered in the destruction and retention policy. A BIA could help determine that this information does not support the main objective of the business, but does not indicate the action to take.

Reveal Solution Next Question

QUESTION: 125

The organization has decided to outsource the majority of the IT department with a vendor that is hosting servers in a foreign country. Of the following, which is the MOST critical security consideration?

Laws and regulations of the country of origin may not be enforceable in the foreign country.
A security breach notification might get delayed due to the time difference.
Additional network intrusion detection sensors should be installed, resulting in an additional cost.
The company could lose physical control over the server and be unable to monitor the physical security posture of the servers.

Answer(s): A

Explanation:

A company is held to the local laws and regulations of the country in which the company resides, even if the company decides to place servers with a vendor that hosts the servers in a foreign country. A potential violation of local laws applicable to the company might not be recognized or rectified (i.e., prosecuted) due to the lack of knowledge of the local laws that are applicable and the inability to enforce the laws. Option B is not a problem. Time difference does not play a role in a 24/7 environment. Pagers, cellular phones, telephones, etc. are usually available to communicate notifications. Option C is a manageable problem that requires additional funding, but can be addressed. Option D is a problem that can be addressed. Most hosting providers have standardized the level of physical security that is in place. Regular physical audits or a SAS 70 report can address such concerns.

Reveal Solution Next Question

ISACA CISM Exam (page: 25) ISACA Certified Information Security Manager Updated on: 31-Mar-2026

QUESTION: 121

Explanation:

QUESTION: 122

Explanation:

QUESTION: 123

Explanation:

QUESTION: 124

Explanation:

QUESTION: 125

Explanation:

ISACA CISM Exam (page: 25)
ISACA Certified Information Security Manager
Updated on: 31-Mar-2026