CISM Exam dumps PDF | Exam-Dumps.net (Page: 52)

QUESTION: 256

Which of the following types of information would the information security manager expect to have the LOWEST level of security protection in a large, multinational enterprise?

Strategic business plan
Upcoming financial results
Customer personal information
Previous financial results

Answer(s): D

Explanation:

Previous financial results are public; all of the other choices are private information and should only be accessed by authorized entities.

Reveal Solution Next Question

QUESTION: 257

The PRIMARY purpose of using risk analysis within a security program is to:

justify the security expenditure.
help businesses prioritize the assets to be protected.
inform executive management of residual risk value.
assess exposures and plan remediation.

Answer(s): D

Explanation:

Risk analysis explores the degree to which an asset needs protecting so this can be managed effectively. Risk analysis indirectly supports the security expenditure, but justifying the security expenditure is not its primary purpose. Helping businesses prioritize the assets to be protected is an indirect benefit of risk analysis, but not its primary purpose. Informing executive management of residual risk value is not directly relevant.

Reveal Solution Next Question

QUESTION: 258

Which of the following is the PRIMARY prerequisite to implementing data classification within an organization?

Defining job roles
Performing a risk assessment
Identifying data owners
Establishing data retention policies

Answer(s): C

Explanation:

Identifying the data owners is the first step, and is essential to implementing data classification. Defining job roles is not relevant. Performing a risk assessment is important, but will require the participation of data owners (who must first be identified). Establishing data retention policies may occur after data have been classified.

Reveal Solution Next Question

QUESTION: 259

An online banking institution is concerned that the breach of customer personal information will have a significant financial impact due to the need to notify and compensate customers whose personal information may have been compromised. The institution determines that residual risk will always be too high and decides to:

mitigate the impact by purchasing insurance.
implement a circuit-level firewall to protect the network.
increase the resiliency of security measures in place.
implement a real-time intrusion detection system.

Answer(s): A

Explanation:

Since residual risk will always be too high, the only practical solution is to mitigate the financial impact by purchasing insurance.

Reveal Solution Next Question

QUESTION: 260

What mechanisms are used to identify deficiencies that would provide attackers with an opportunity to compromise a computer system?

Business impact analyses
Security gap analyses
System performance metrics
Incident response processes

Answer(s): B

Explanation:

A security gap analysis is a process which measures all security controls in place against typically good business practice, and identifies related weaknesses. A business impact analysis is less suited to identify security deficiencies. System performance metrics may indicate security weaknesses, but that is not their primary purpose. Incident response processes exist for cases where security weaknesses are exploited.

Reveal Solution Next Question

ISACA CISM Exam (page: 52) ISACA Certified Information Security Manager Updated on: 06-Apr-2026

QUESTION: 256

Explanation:

QUESTION: 257

Explanation:

QUESTION: 258

Explanation:

QUESTION: 259

Explanation:

QUESTION: 260

Explanation:

ISACA CISM Exam (page: 52)
ISACA Certified Information Security Manager
Updated on: 06-Apr-2026