ISACA Certified Information Security Manager CISM Dumps in PDF

Free ISACA CISM Real Questions (page: 51)

A risk management program would be expected to:

  1. remove all inherent risk.
  2. maintain residual risk at an acceptable level.
  3. implement preventive controls for every threat.
  4. reduce control risk to zero.

Answer(s): B

Explanation:

The object of risk management is to ensure that all residual risk is maintained at a level acceptable to the business; it is not intended to remove every identified risk or implement controls for every threat since this may not be cost-effective. Control risk, i.e., that a control may not be effective, is a component of the program but is unlikely to be reduced to zero.



Risk assessment should be built into which of the following systems development phases to ensure that risks are addressed in a development project?

  1. Programming
  2. Specification
  3. User testing
  4. Feasibility

Answer(s): D

Explanation:

Risk should be addressed as early as possible in the development cycle. The feasibility study should include risk assessment so that the cost of controls can be estimated before the project proceeds. Risk should also be considered in the specification phase where the controls are designed, but this would still be based on the assessment carried out in the feasibility study. Assessment would not be relevant in choice A or C.



Which of the following would help management determine the resources needed to mitigate a risk to the organization?

  1. Risk analysis process
  2. Business impact analysis (BIA)
  3. Risk management balanced scorecard
  4. Risk-based audit program

Answer(s): B

Explanation:

The business impact analysis (BIA) determines the possible outcome of a risk and is essential to determine the appropriate cost of control. The risk analysis process provides comprehensive data, but does not determine definite resources to mitigate the risk as does the BIA. The risk management balanced scorecard is a measuring tool for goal attainment. A risk-based audit program is used to focus the audit process on the areas of greatest importance to the organization.



A global financial institution has decided not to take any further action on a denial of service (DoS) risk found by the risk assessment team. The MOST likely reason they made this decision is that:

  1. there are sufficient safeguards in place to prevent this risk from happening.
  2. the needed countermeasure is too complicated to deploy.
  3. the cost of countermeasure outweighs the value of the asset and potential loss.
  4. The likelihood of the risk occurring is unknown.

Answer(s): C

Explanation:

An organization may decide to live with specific risks because it would cost more to protect themselves than the value of the potential loss. The safeguards need to match the risk level. While countermeasures could be too complicated to deploy, this is not the most compelling reason. It is unlikely that a global financial institution would not be exposed to such attacks and the frequency could not be predicted.



Which would be one of the BEST metrics an information security manager can employ to effectively evaluate the results of a security program?

  1. Number of controls implemented
  2. Percent of control objectives accomplished
  3. Percent of compliance with the security policy
  4. Reduction in the number of reported security incidents

Answer(s): B

Explanation:

Control objectives are directly related to business objectives; therefore, they would be the best metrics. Number of controls implemented does not have a direct relationship with the results of a security program. Percentage of compliance with the security policy and reduction in the number of security incidents are not as broad as choice B.



Share your comments for ISACA CISM exam with other users:

I
It‘s not A
9/17/2023 5:31:00 PM

answer to question 72 is d [sys_user_role]

I
indira m
8/14/2023 12:15:00 PM

please provide the pdf

R
ribrahim
8/1/2023 6:05:00 AM

hey guys, just to let you all know that i cleared my 312-38 today within 1 hr with 100 questions and passed. thank you so much brain-dumps.net all the questions that ive studied in this dump came out exactly the same word for word "verbatim". you rock brain-dumps.net!!! section name total score gained score network perimeter protection 16 11 incident response 10 8 enterprise virtual, cloud, and wireless network protection 12 8 application and data protection 13 10 network défense management 10 9 endpoint protection 15 12 incident d

A
Andrew
8/23/2023 6:02:00 PM

very helpful

L
latha
9/7/2023 8:14:00 AM

useful questions

I
ibrahim
11/9/2023 7:57:00 AM

page :20 https://exam-dumps.com/snowflake/free-cof-c02-braindumps.html?p=20#collapse_453 q 74: true or false: pipes can be suspended and resumed. true. desc.: pausing or resuming pipes in addition to the pipe owner, a role that has the following minimum permissions can pause or resume the pipe https://docs.snowflake.com/en/user-guide/data-load-snowpipe-intro

F
Franklin Allagoa
7/5/2023 5:16:00 AM

i want hcia exam dumps

S
SSA
12/24/2023 1:18:00 PM

good training

B
BK
8/11/2023 12:23:00 PM

very useful

D
Deepika Narayanan
7/13/2023 11:05:00 PM

yes need this exam dumps

B
Blessious Phiri
8/15/2023 3:31:00 PM

these questions are a great eye opener

J
Jagdesh
9/8/2023 8:17:00 AM

thank you for providing these questions and answers. they helped me pass my exam. you guys are great.

T
TS
7/18/2023 3:32:00 PM

good knowledge

A
Asad Khan
11/1/2023 2:44:00 AM

answer 10 should be a because only a new project will be created & the organization is the same.

R
Raj
9/12/2023 3:49:00 PM

can you please upload the dump again

C
Christian Klein
6/23/2023 1:32:00 PM

is it legit questions from sap certifications ?

A
anonymous
1/12/2024 3:34:00 PM

question 16 should be b (changing the connector settings on the monitor) pc and monitor were powered on. the lights on the pc are on indicating power. the monitor is showing an error text indicating that it is receiving power too. this is a clear sign of having the wrong input selected on the monitor. thus, the "connector setting" needs to be switched from hdmi to display port on the monitor so it receives the signal from the pc, or the other way around (display port to hdmi).

N
NSPK
1/18/2024 10:26:00 AM

q 10. ans is d (in the target org: open deployment settings, click edit next to the source org. select allow inbound changes and save

M
mohamed abdo
9/1/2023 4:59:00 AM

very useful

T
Tom
3/18/2022 8:00:00 PM

i purchased this exam dumps from another website with way more questions but they were all invalid and outdate. this exam dumps was right to the point and all from recent exam. it was a hard pass.

E
Edrick GOP
10/24/2023 6:00:00 AM

it was a good experience and i got 90% in the 200-901 exam.

A
anonymous
8/10/2023 2:28:00 AM

hi please upload this

B
Bakir
7/6/2023 7:24:00 AM

please upload it

A
Aman
6/18/2023 1:27:00 PM

really need this dump. can you please help.

N
Neela Para
1/8/2024 6:39:00 PM

really good and covers many areas explaining the answer.

K
Karan Patel
8/15/2023 12:51:00 AM

yes, can you please upload the exam?

N
NISHAD
11/7/2023 11:28:00 AM

how many questions are there in these dumps?

P
Pankaj
7/3/2023 3:57:00 AM

hi team, please upload this , i need it.

D
DN
9/4/2023 11:19:00 PM

question 14 - run terraform import: this is the recommended best practice for bringing manually created or destroyed resources under terraform management. you use terraform import to associate an existing resource with a terraform resource configuration. this ensures that terraform is aware of the resource, and you can subsequently manage it with terraform.

Z
Zhiguang
8/19/2023 11:37:00 PM

please upload dump. thanks in advance.

D
deedee
12/23/2023 5:51:00 PM

great great

A
Asad Khan
11/1/2023 3:10:00 AM

answer 16 should be b your organizational policies require you to use virtual machines directly

S
Sale Danasabe
10/24/2023 5:21:00 PM

the question are kind of tricky of you didnt get the hnag on it.

L
Luis
11/16/2023 1:39:00 PM

can anyone tell me if this is for rhel8 or rhel9?

AI Tutor 👋 I’m here to help!