CISM Exam Questions and Answers | Exam-Dumps (Page: 5)

QUESTION: 21

When an organization hires a new information security manager, which of the following goals should this individual pursue FIRST?

Develop a security architecture
Establish good communication with steering committee members
Assemble an experienced staff
Benchmark peer organizations

Answer(s): B

Explanation:

New information security managers should seek to build rapport and establish lines of communication with senior management to enlist their support. Benchmarking peer organizations is beneficial to better understand industry best practices, but it is secondary to obtaining senior management support. Similarly, developing a security architecture and assembling an experienced staff are objectives that can be obtained later.

Reveal Solution Next Question

QUESTION: 22

It is MOST important that information security architecture be aligned with which of the following?

Industry best practices
Information technology plans
Information security best practices
Business objectives and goals

Answer(s): D

Explanation:

Information security architecture should always be properly aligned with business goals and objectives. Alignment with IT plans or industry and security best practices is secondary by comparison.

Reveal Solution Next Question

QUESTION: 23

Which of the following is MOST likely to be discretionary?

Policies
Procedures
Guidelines
Standards

Answer(s): C

Explanation:

Policies define security goals and expectations for an organization. These are defined in more specific terms within standards and procedures. Standards establish what is to be done while procedures describe how it is to be done. Guidelines provide recommendations that business management must consider in developing practices within their areas of control; as such, they are discretionary.

Reveal Solution Next Question

QUESTION: 24

Security technologies should be selected PRIMARILY on the basis of their:

ability to mitigate business risks.
evaluations in trade publications.
use of new and emerging technologies.
benefits in comparison to their costs.

Answer(s): A

Explanation:

The most fundamental evaluation criterion for the appropriate selection of any security technology is its ability to reduce or eliminate business risks. Investments in security technologies should be based on their overall value in relation to their cost; the value can be demonstrated in terms of risk mitigation. This should take precedence over whether they use new or exotic technologies or how they are evaluated in trade publications.

Reveal Solution Next Question

QUESTION: 25

Which of the following are seldom changed in response to technological changes?

Standards
Procedures
Policies
Guidelines

Answer(s): C

Explanation:

Policies are high-level statements of objectives. Because of their high-level nature and statement of broad operating principles, they are less subject to periodic change. Security standards and procedures as well as guidelines must be revised and updated based on the impact of technology changes.

Reveal Solution Next Question

ISACA CISM Exam (page: 5) ISACA Certified Information Security Manager Updated on: 25-Dec-2025

QUESTION: 21

Explanation:

QUESTION: 22

Explanation:

QUESTION: 23

Explanation:

QUESTION: 24

Explanation:

QUESTION: 25

Explanation:

ISACA CISM Exam (page: 5)
ISACA Certified Information Security Manager
Updated on: 25-Dec-2025