CISM Exam dumps PDF | Exam-Dumps.net (Page: 61)

QUESTION: 301

Which of the following is the BEST method to ensure the overall effectiveness of a risk management program?

User assessments of changes
Comparison of the program results with industry standards
Assignment of risk within the organization
Participation by all members of the organization

Answer(s): D

Explanation:

Effective risk management requires participation, support and acceptance by all applicable members of the organization, beginning with the executive levels. Personnel must understand their responsibilities and be trained on how to fulfill their roles.

Reveal Solution Next Question

QUESTION: 302

The MOST effective use of a risk register is to:

identify risks and assign roles and responsibilities for mitigation.
identify threats and probabilities.
facilitate a thorough review of all IT-related risks on a periodic basis.
record the annualized financial amount of expected losses due to risks.

Answer(s): C

Explanation:

A risk register is more than a simple list — it should lie used as a tool to ensure comprehensive documentation, periodic review and formal update of all risk elements in the enterprise's IT and related organization. Identifying risks and assigning roles and responsibilities for mitigation are elements of the register. Identifying threats and probabilities are two elements that are defined in the risk matrix, as differentiated from the broader scope of content in, and purpose for, the risk register. While the annualized loss expectancy (ALE) should be included in the register, this quantification is only a single element in the overall risk analysis program.

Reveal Solution Next Question

QUESTION: 303

After obtaining commitment from senior management, which of the following should be completed NEXT when establishing an information security program?

Define security metrics
Conduct a risk assessment
Perform a gap analysis
Procure security tools

Answer(s): B

Explanation:

When establishing an information security program, conducting a risk assessment is key to identifying the needs of the organization and developing a security strategy. Defining security metrics, performing a gap analysis and procuring security tools are all subsequent considerations.

Reveal Solution Next Question

QUESTION: 304

Which of the following are the essential ingredients of a business impact analysis (B1A)?

Downtime tolerance, resources and criticality
Cost of business outages in a year as a factor of the security budget
Business continuity testing methodology being deployed
Structure of the crisis management team

Answer(s): A

Explanation:

The main purpose of a BIA is to measure the downtime tolerance, associated resources and criticality of a business function. Options B, C and D are all associated with business continuity planning, but are not related to the BIA.

Reveal Solution Next Question

QUESTION: 305

A risk management approach to information protection is:

managing risks to an acceptable level, commensurate with goals and objectives.
accepting the security posture provided by commercial security products.
implementing a training program to educate individuals on information protection and risks.
managing risk tools to ensure that they assess all information protection vulnerabilities.

Answer(s): A

Explanation:

Risk management is identifying all risks within an organization, establishing an acceptable level of risk and effectively managing risks which may include mitigation or transfer. Accepting the security- posture provided by commercial security products is an approach that would be limited to technology components and may not address all business operations of the organization. Education is a part of the overall risk management process. Tools may be limited to technology and would not address non-technology risks.

Reveal Solution Next Question

ISACA CISM Exam (page: 61) ISACA Certified Information Security Manager Updated on: 06-Apr-2026

QUESTION: 301

Explanation:

QUESTION: 302

Explanation:

QUESTION: 303

Explanation:

QUESTION: 304

Explanation:

QUESTION: 305

Explanation:

ISACA CISM Exam (page: 61)
ISACA Certified Information Security Manager
Updated on: 06-Apr-2026