CISM Exam Questions and Answers | Exam-Dumps (Page: 57)

QUESTION: 281

One way to determine control effectiveness is by determining:

whether it is preventive, detective or compensatory.
the capability of providing notification of failure.
the test results of intended objectives.
the evaluation and analysis of reliability.

Answer(s): C

Explanation:

Control effectiveness requires a process to verify that the control process worked as intended. Examples such as dual-control or dual-entry bookkeeping provide verification and assurance that the process operated as intended. The type of control is not relevant, and notification of failure is not determinative of control strength. Reliability is not an indication of control strength; weak controls can be highly reliable, even if they are ineffective controls.

Reveal Solution Next Question

QUESTION: 282

What does a network vulnerability assessment intend to identify?

0-day vulnerabilities
Malicious software and spyware
Security design flaws
Misconfiguration and missing updates

Answer(s): D

Explanation:

A network vulnerability assessment intends to identify known vulnerabilities based on common misconfigurations and missing updates. 0-day vulnerabilities by definition are not previously known and therefore are undetectable. Malicious software and spyware are normally addressed through antivirus and antispyware policies. Security design flaws require a deeper level of analysis.

Reveal Solution Next Question

QUESTION: 283

Who is responsible for ensuring that information is classified?

Senior management
Security manager
Data owner
Custodian

Answer(s): C

Explanation:

The data owner is responsible for applying the proper classification to the data. Senior management is ultimately responsible for the organization. The security officer is responsible for applying security protection relative to the level of classification specified by the owner. The technology group is delegated the custody of the data by the data owner, but the group does not classify the information.

Reveal Solution Next Question

QUESTION: 284

After a risk assessment, it is determined that the cost to mitigate the risk is much greater than the benefit to be derived. The information security manager should recommend to business management that the risk be:

transferred.
treated.
accepted.
terminated.

Answer(s): C

Explanation:

When the cost of control is more than the cost of the risk, the risk should be accepted. Transferring, treating or terminating the risk is of limited benefit if the cost of that control is more than the cost of the risk itself.

Reveal Solution Next Question

QUESTION: 285

When a significant security breach occurs, what should be reported FIRST to senior management?

A summary of the security logs that illustrates the sequence of events
An of the incident and corrective action taken
An analysis of the impact of similar attacks at other organizations
A business case for implementing stronger logical access controls

Answer(s): B

Explanation:

When reporting an incident to senior management, the initial information to be communicated should include an of what happened and how the breach was resolved. A summary of security logs would be too technical to report to senior management. An analysis of the impact of similar attacks and a business case for improving controls would be desirable; however, these would be communicated later in the process.

Reveal Solution Next Question

ISACA CISM Exam (page: 57) ISACA Certified Information Security Manager Updated on: 02-Jan-2026

QUESTION: 281

Explanation:

QUESTION: 282

Explanation:

QUESTION: 283

Explanation:

QUESTION: 284

Explanation:

QUESTION: 285

Explanation:

ISACA CISM Exam (page: 57)
ISACA Certified Information Security Manager
Updated on: 02-Jan-2026