CISM Exam dumps PDF | Exam-Dumps.net (Page: 63)

QUESTION: 311

After assessing and mitigating the risks of a web application, who should decide on the acceptance of residual application risks?

Information security officer
Chief information officer (CIO)
Business owner
Chief executive officer (CFO)

Answer(s): C

Explanation:

The business owner of the application needs to understand and accept the residual application risks.

Reveal Solution Next Question

QUESTION: 312

The purpose of a corrective control is to:

reduce adverse events.
indicate compromise.
mitigate impact.
ensure compliance.

Answer(s): C

Explanation:

Corrective controls serve to reduce or mitigate impacts, such as providing recovery capabilities. Preventive controls reduce adverse events, such as firewalls. Compromise can be detected by detective controls, such as intrusion detection systems (IDSs). Compliance could be ensured by preventive controls, such as access controls.

Reveal Solution Next Question

QUESTION: 313

Which of the following is the MOST important requirement for setting up an information security infrastructure for a new system?

Performing a business impact analysis (BIA)
Considering personal information devices as pan of the security policy
Initiating IT security training and familiarization
Basing the information security infrastructure on risk assessment

Answer(s): D

Explanation:

The information security infrastructure should be based on risk. While considering personal information devices as part of the security policy may be a consideration, it is not the most important requirement. A BIA is typically carried out to prioritize business processes as part of a business continuity plan. Initiating IT security training may not be important for the purpose of the information security infrastructure.

Reveal Solution Next Question

QUESTION: 314

Previously accepted risk should be:

re-assessed periodically since the risk can be escalated to an unacceptable level due to revised conditions.
accepted permanently since management has already spent resources (time and labor) to conclude that the risk level is acceptable.
avoided next time since risk avoidance provides the best protection to the company.
removed from the risk log once it is accepted.

Answer(s): A

Explanation:

Acceptance of risk should be regularly reviewed to ensure that the rationale for the initial risk acceptance is still valid within the current business context. The rationale for initial risk acceptance may no longer be valid due to change(s) and. hence, risk cannot be accepted permanently. Risk is an inherent part of business and it is impractical and costly to eliminate all risk. Even risks that have been accepted should be monitored for changing conditions that could alter the original decision.

Reveal Solution Next Question

QUESTION: 315

An information security manager is advised by contacts in law enforcement that there is evidence that his/ her company is being targeted by a skilled gang of hackers known to use a variety of techniques, including social engineering and network penetration. The FIRST step that the security manager should take is to:

perform a comprehensive assessment of the organization's exposure to the hacker's techniques.
initiate awareness training to counter social engineering.
immediately advise senior management of the elevated risk.
increase monitoring activities to provide early detection of intrusion.

Answer(s): C

Explanation:

Information about possible significant new risks from credible sources should be provided to managementalong with advice on steps that need to be taken to counter the threat. The security manager should assess the risk, but senior management should be immediately advised. It may be prudent to initiate an awareness campaign subsequent to sounding the alarm if awareness training is not current. Monitoring activities should also be increased.

Reveal Solution Next Question

ISACA CISM Exam (page: 63) ISACA Certified Information Security Manager Updated on: 06-Apr-2026

QUESTION: 311

Explanation:

QUESTION: 312

Explanation:

QUESTION: 313

Explanation:

QUESTION: 314

Explanation:

QUESTION: 315

Explanation:

ISACA CISM Exam (page: 63)
ISACA Certified Information Security Manager
Updated on: 06-Apr-2026