CISM Exam dumps PDF | Exam-Dumps.net (Page: 56)

QUESTION: 276

The MAIN reason why asset classification is important to a successful information security program is because classification determines:

the priority and extent of risk mitigation efforts.
the amount of insurance needed in case of loss.
the appropriate level of protection to the asset.
how protection levels compare to peer organizations.

Answer(s): C

Explanation:

Protection should be proportional to the value of the asset. Classification is based upon the value of the asset to the organization. The amount of insurance needed in case of loss may not be applicable in each case. Peer organizations may have different classification schemes for their assets.

Reveal Solution Next Question

QUESTION: 277

The BEST strategy for risk management is to:

achieve a balance between risk and organizational goals.
reduce risk to an acceptable level.
ensure that policy development properly considers organizational risks.
ensure that all unmitigated risks are accepted by management.

Answer(s): B

Explanation:

The best strategy for risk management is to reduce risk to an acceptable level, as this will take into account the organization's appetite for risk and the fact that it would not be practical to eliminate all risk. Achieving balance between risk and organizational goals is not always practical. Policy development must consider organizational risks as well as business objectives. It may be prudent to ensure that management understands and acceptsrisks that it is not willing to mitigate, but that is a practice and is not sufficient to l>e considered a strategy.

Reveal Solution Next Question

QUESTION: 278

Which of the following would be the MOST important factor to be considered in the loss of mobile equipment with unencrypted data?

Disclosure of personal information
Sufficient coverage of the insurance policy for accidental losses
Intrinsic value of the data stored on the equipment
Replacement cost of the equipment

Answer(s): C

Explanation:

When mobile equipment is lost or stolen, the information contained on the equipment matters most in determining the impact of the loss. The more sensitive the information, the greater the liability. If staff carries mobile equipment for business purposes, an organization must develop a clear policy as to what information should be kept on the equipment and for what purpose. Personal information is not defined in the question as the data that were lost. Insurance may be a relatively smaller issue as compared with information theft or opportunity loss, although insurance is also an important factor for a successful business. Cost of equipment would be a less important issue as compared with other choices.

Reveal Solution Next Question

QUESTION: 279

An organization has to comply with recently published industry regulatory requirements — compliance that potentially has high implementation costs. What should the information security manager do FIRST?

Implement a security committee.
Perform a gap analysis.
Implement compensating controls.
Demand immediate compliance.

Answer(s): B

Explanation:

Since they are regulatory requirements, a gap analysis would be the first step to determine the level of compliance already in place. Implementing a security committee or compensating controls would not be the first step. Demanding immediate compliance would not assess the situation.

Reveal Solution Next Question

QUESTION: 280

Which of the following would be MOST relevant to include in a cost-benefit analysis of a two-factor authentication system?

Annual loss expectancy (ALE) of incidents
Frequency of incidents
Total cost of ownership (TCO)
Approved budget for the project

Answer(s): C

Explanation:

The total cost of ownership (TCO) would be the most relevant piece of information in that it would establish a cost baseline and it must be considered for the full life cycle of the control. Annual loss expectancy (ALE) and the frequency of incidents could help measure the benefit, but would have more of an indirect relationship as not all incidents may be mitigated by implementing a two-factor authentication system. The approved budget for the project may have no bearing on what the project may actually cost.

Reveal Solution Next Question

ISACA CISM Exam (page: 56) ISACA Certified Information Security Manager Updated on: 06-Apr-2026

QUESTION: 276

Explanation:

QUESTION: 277

Explanation:

QUESTION: 278

Explanation:

QUESTION: 279

Explanation:

QUESTION: 280

Explanation:

ISACA CISM Exam (page: 56)
ISACA Certified Information Security Manager
Updated on: 06-Apr-2026