CISM Certification Exam Questions with AI Explanations

QUESTION: 216

A legacy application does not comply with new regulatory requirements to encrypt sensitive data at rest, and remediating this issue would require significant investment. What should the information security manager do FIRST?

Investigate alternative options to remediate the noncompliance.
Assess the business impact to the organization.
Present the noncompliance risk to senior management.
Determine the cost to remediate the noncompliance.

Answer(s): B

Reveal Solution Next Question

QUESTION: 217

During the establishment of a service level agreement (SLA) with a cloud service provider, it is MOST
important for the information security manager to:

update the security policy to reflect the provider's terms of service.
ensure security requirements are contractually enforceable.
set up proper communication paths with the provider.
understand the cloud storage architecture in use to determine security risk.

Answer(s): B

Reveal Solution Next Question

QUESTION: 218

An outsourced vendor handles an organization's business-critical data.

Which of the following is the MOST effective way for the client organization to obtain assurance of the vendor's security practices?