CISM Exam dumps PDF | Exam-Dumps.net (Page: 60)

QUESTION: 296

An organization has decided to implement additional security controls to treat the risks of a new process. This is an example of:

eliminating the risk.
transferring the risk.
mitigating the risk.
accepting the risk.

Answer(s): C

Explanation:

Risk can never be eliminated entirely. Transferring the risk gives it away such as buying insurance so the insurance company can take the risk. Implementing additional controls is an example of mitigating risk. Doing nothing to mitigate the risk would be an example of accepting risk.

Reveal Solution Next Question

QUESTION: 297

Which of the following roles is PRIMARILY responsible for determining the information classification levels for a given information asset?

Manager
Custodian
User
Owner

Answer(s): D

Explanation:

Although the information owner may be in a management position and is also considered a user, the information owner role has the responsibility for determining information classification levels. Management is responsible for higher-level issues such as providing and approving budget, supporting activities, etc. The information custodian is responsible for day-to-day security tasks such as protecting information, backing up information, etc. Users are the lowest level. They use the data, but do not classify the data. The owner classifies the data.

Reveal Solution Next Question

QUESTION: 298

The PRIMARY reason for assigning classes of sensitivity and criticality to information resources is to provide a basis for:

determining the scope for inclusion in an information security program.
defining the level of access controls.
justifying costs for information resources.
determining the overall budget of an information security program.

Answer(s): B

Explanation:

The assigned class of sensitivity and criticality of the information resource determines the level of access controls to be put in place. The assignment of sensitivity and criticality takes place with the information assets that have already been included in the information security program and has only an indirect bearing on the costs to be incurred. The assignment of sensitivity and criticality contributes to, but does not decide, the overall budget of the information security program.

Reveal Solution Next Question

QUESTION: 299

An organization is already certified to an international security standard. Which mechanism would BEST help to further align the organization with other data security regulatory requirements as per new business needs?

Key performance indicators (KPIs)
Business impact analysis (BIA)
Gap analysis
Technical vulnerability assessment

Answer(s): C

Explanation:

Gap analysis would help identify the actual gaps between the desired state and the current implementation of information security management. BIA is primarily used for business continuity planning. Technical vulnerability assessment is used for detailed assessment of technical controls, which would come later in the process and would not provide complete information in order to identify gaps.

Reveal Solution Next Question

QUESTION: 300

When performing a qualitative risk analysis, which of the following will BEST produce reliable results?

Estimated productivity losses
Possible scenarios with threats and impacts
Value of information assets
Vulnerability assessment

Answer(s): B

Explanation:

Listing all possible scenarios that could occur, along with threats and impacts, will better frame the range of risks and facilitate a more informed discussion and decision. Estimated productivity losses, value of information assets and vulnerability assessments would not be sufficient on their own.

Reveal Solution Next Question

ISACA CISM Exam (page: 60) ISACA Certified Information Security Manager Updated on: 06-Apr-2026

QUESTION: 296

Explanation:

QUESTION: 297

Explanation:

QUESTION: 298

Explanation:

QUESTION: 299

Explanation:

QUESTION: 300

Explanation:

ISACA CISM Exam (page: 60)
ISACA Certified Information Security Manager
Updated on: 06-Apr-2026