ISACA Certified Information Security Manager CISM Dumps in PDF

Free ISACA CISM Real Questions (page: 59)

Risk assessment is MOST effective when performed:

  1. at the beginning of security program development.
  2. on a continuous basis.
  3. while developing the business case for the security program.
  4. during the business change process.

Answer(s): B

Explanation:

Risk assessment needs to be performed on a continuous basis because of organizational and technical changes. Risk assessment must take into account all significant changes in order to be effective.



Which of the following is the MAIN reason for performing risk assessment on a continuous basis'?

  1. Justification of the security budget must be continually made.
  2. New vulnerabilities are discovered every day.
  3. The risk environment is constantly changing.
  4. Management needs to be continually informed about emerging risks.

Answer(s): C

Explanation:

The risk environment is impacted by factors such as changes in technology, and business strategy. These changes introduce new threats and vulnerabilities to the organization. As a result, risk assessment should be performed continuously. Justification of a budget should never be the main reason for performing a risk assessment. New vulnerabilities should be managed through a patch management process. Informing management about emerging risks is important, but is not the main driver for determining when a risk assessment should be performed.



There is a time lag between the time when a security vulnerability is first published, and the time when a patch is delivered. Which of the following should be carried out FIRST to mitigate the risk during this time period?

  1. Identify the vulnerable systems and apply compensating controls
  2. Minimize the use of vulnerable systems
  3. Communicate the vulnerability to system users
  4. Update the signatures database of the intrusion detection system (IDS)

Answer(s): A

Explanation:

The best protection is to identify the vulnerable systems and apply compensating controls until a patch is installed. Minimizing the use of vulnerable systems and communicating the vulnerability to system users could be compensating controls but would not be the first course of action. Choice D does not make clear the timing of when the intrusion detection system (IDS) signature list would be updated to accommodate the vulnerabilities that are not yet publicly known. Therefore, this approach should not always be considered as the first option.



Which of the following security activities should be implemented in the change management process to identify key vulnerabilities introduced by changes?

  1. Business impact analysis (BIA)
  2. Penetration testing
  3. Audit and review
  4. Threat analysis

Answer(s): B

Explanation:

Penetration testing focuses on identifying vulnerabilities. None of the other choices would identify vulnerabilities introduced by changes.



Which of the following techniques MOST clearly indicates whether specific risk-reduction controls should be implemented?

  1. Countermeasure cost-benefit analysis
  2. Penetration testing
  3. Frequent risk assessment programs
  4. Annual loss expectancy (ALE) calculation

Answer(s): A

Explanation:

In a countermeasure cost-benefit analysis, the annual cost of safeguards is compared with the expected cost of loss. This can then be used to justify a specific control measure. Penetration testing may indicate the extent of a weakness but, by itself, will not establish the cost/benefit of a control. Frequent risk assessment programs will certainly establish what risk exists but will not determine the maximum cost of controls. Annual loss expectancy (ALE) is a measure which will contribute to the value of the risk but. alone, will not justify a control.



Share your comments for ISACA CISM exam with other users:

J
JM
12/19/2023 2:23:00 PM

q252: dns poisoning is the correct answer, not locator redirection. beaconing is detected from a host. this indicates that the system has been infected with malware, which could be the source of local dns poisoning. location redirection works by either embedding the redirection in the original websites code or having a user click on a url that has an embedded redirect. since users at a different office are not getting redirected, it isnt an embedded redirection on the original website and since the user is manually typing in the url and not clicking a link, it isnt a modified link.

F
Freddie
12/12/2023 12:37:00 PM

helpful dump questions

D
Da Costa
8/25/2023 7:30:00 AM

question 423 eigrp uses metric

B
Bsmaind
8/20/2023 9:22:00 AM

hello nice dumps

B
beau
1/12/2024 4:53:00 PM

good resource for learning

S
Sandeep
12/29/2023 4:07:00 AM

very useful

K
kevin
9/29/2023 8:04:00 AM

physical tempering techniques

B
Blessious Phiri
8/15/2023 4:08:00 PM

its giving best technical knowledge

T
Testbear
6/13/2023 11:15:00 AM

please upload

S
shime
10/24/2023 4:23:00 AM

great question with explanation thanks!!

T
Thembelani
5/30/2023 2:40:00 AM

does this exam have lab sections?

S
Shin
9/8/2023 5:31:00 AM

please upload

P
priti kagwade
7/22/2023 5:17:00 AM

please upload the braindump for .net

R
Robe
9/27/2023 8:15:00 PM

i need this exam 1z0-1107-2. please.

C
Chiranthaka
9/20/2023 11:22:00 AM

very useful!

N
Not Miguel
11/26/2023 9:43:00 PM

for this question - "which three type of basic patient or member information is displayed on the patient info component? (choose three.)", list of conditions is not displayed (it is displayed in patient card, not patient info). so should be thumbnail of chatter photo

A
Andrus
12/17/2023 12:09:00 PM

q52 should be d. vm storage controller bandwidth represents the amount of data (in terms of bandwidth) that a vms storage controller is using to read and write data to the storage fabric.

R
Raj
5/25/2023 8:43:00 AM

nice questions

M
max
12/22/2023 3:45:00 PM

very useful

M
Muhammad Rawish Siddiqui
12/8/2023 6:12:00 PM

question # 208: failure logs is not an example of operational metadata.

S
Sachin Bedi
1/5/2024 4:47:00 AM

good questions

K
Kenneth
12/8/2023 7:34:00 AM

thank you for the test materials!

H
Harjinder Singh
8/9/2023 4:16:00 AM

its very helpful

S
SD
7/13/2023 12:56:00 AM

good questions

K
kanjoe
7/2/2023 11:40:00 AM

good questons

M
Mahmoud
7/6/2023 4:24:00 AM

i need the dumb of the hcip security v4.0 exam

W
Wei
8/3/2023 4:18:00 AM

upload the dump please

S
Stephen
10/3/2023 6:24:00 PM

yes, iam looking this

S
Stephen
8/4/2023 9:08:00 PM

please upload cima e2 managing performance dumps

H
hp
6/16/2023 12:44:00 AM

wonderful questions

P
Priyo
11/14/2023 2:23:00 AM

i used this site since 2000, still great to support my career

J
Jude
8/29/2023 1:56:00 PM

why is the answer to "which of the following is required by scrum?" all of the following stated below since most of them are not mandatory? sprint retrospective. members must be stand up at the daily scrum. sprint burndown chart. release planning.

M
Marc blue
9/15/2023 4:11:00 AM

great job. hope this helps out.

A
Anne
9/13/2023 2:33:00 AM

upload please. many thanks!

AI Tutor 👋 I’m here to help!