CISM Exam Questions and Answers | Exam-Dumps (Page: 3)

QUESTION: 11

Which of the following individuals would be in the BEST position to sponsor the creation of an information security steering group?

Information security manager
Chief operating officer (COO)
Internal auditor
Legal counsel

Answer(s): B

Explanation:

The chief operating officer (COO) is highly-placed within an organization and has the most knowledge of business operations and objectives. The chief internal auditor and chief legal counsel are appropriate members of such a steering group. However, sponsoring the creation of the steering committee should be initiated by someone versed in the strategy and direction of the business. Since a security manager is looking to this group for direction, they are not in the best position to oversee formation of this group.

Reveal Solution Next Question

QUESTION: 12

The MOST important component of a privacy policy is:

notifications.
warranties.
liabilities.
geographic coverage.

Answer(s): A

Explanation:

Privacy policies must contain notifications and opt-out provisions: they are a high-level management statement of direction. They do not necessarily address warranties, liabilities or geographic coverage, which are more specific.

Reveal Solution Next Question

QUESTION: 13

The cost of implementing a security control should not exceed the:

annualized loss expectancy.
cost of an incident.
asset value.
implementation opportunity costs.

Answer(s): C

Explanation:

The cost of implementing security controls should not exceed the worth of the asset. Annualized loss expectancy represents the losses drat are expected to happen during a single calendar year. A security mechanism may cost more than this amount (or the cost of a single incident) and still be considered cost effective. Opportunity costs relate to revenue lost by forgoing the acquisition of an item or the making of a business decision.

Reveal Solution Next Question

QUESTION: 14

When a security standard conflicts with a business objective, the situation should be resolved by:

changing the security standard.
changing the business objective.
performing a risk analysis.
authorizing a risk acceptance.

Answer(s): C

Explanation:

Conflicts of this type should be based on a risk analysis of the costs and benefits of allowing or disallowing an exception to the standard. It is highly improbable that a business objective could be changed to accommodate a security standard, while risk acceptance* is a process that derives from the risk analysis.

Reveal Solution Next Question

QUESTION: 15

Minimum standards for securing the technical infrastructure should be defined in a security:

strategy.
guidelines.
model.
architecture.

Answer(s): D

Explanation:

Minimum standards for securing the technical infrastructure should be defined in a security architecture document. This document defines how components are secured and the security services that should be in place. A strategy is a broad, high-level document. A guideline is advisory in nature, while a security model shows the relationships between components.

Reveal Solution Next Question

ISACA CISM Exam (page: 3) ISACA Certified Information Security Manager Updated on: 25-Dec-2025

QUESTION: 11

Explanation:

QUESTION: 12

Explanation:

QUESTION: 13

Explanation:

QUESTION: 14

Explanation:

QUESTION: 15

Explanation:

ISACA CISM Exam (page: 3)
ISACA Certified Information Security Manager
Updated on: 25-Dec-2025