CISM Exam dumps PDF | Exam-Dumps.net (Page: 64)

QUESTION: 316

Which of the following steps should be performed FIRST in the risk assessment process?

Staff interviews
Threat identification
Asset identification and valuation
Determination of the likelihood of identified risks

Answer(s): C

Explanation:

The first step in the risk assessment methodology is a system characterization, or identification and valuation, of all of the enterprise's assets to define the boundaries of the assessment. Interviewing is a valuable tool to determine qualitative information about an organization's objectives and tolerance for risk. Interviews are used in subsequent steps. Identification of threats comes later in the process and should not be performed prior to an inventory since many possible threats will not be applicable if there is no asset at risk. Determination of likelihood comes later in the risk assessment process.

Reveal Solution Next Question

QUESTION: 317

Which of the following authentication methods prevents authentication replay?

Password hash implementation
Challenge/response mechanism
Wired Equivalent Privacy (WEP) encryption usage
HTTP Basic Authentication

Answer(s): B

Explanation:

A challenge/response mechanism prevents replay attacks by sending a different random challenge in each authentication event. The response is linked to that challenge. Therefore, capturing the authentication handshake and replaying it through the network will not work. Using hashes by itself will not prevent a replay. A WEP key will not prevent sniffing (it just takes a few more minutes to break the WEP key if the attacker does not already have it) and therefore will not be able to prevent recording and replaying an authentication handshake. HTTP Basic Authentication is clear text and has no mechanisms to prevent replay.

Reveal Solution Next Question

QUESTION: 318

An organization has a process in place that involves the use of a vendor. A risk assessment was completed during the development of the process. A year after the implementation a monetary decision has been made to use a different vendor. What, if anything, should occur?

Nothing, since a risk assessment was completed during development.
A vulnerability assessment should be conducted.
A new risk assessment should be performed.
The new vendor's SAS 70 type II report should be reviewed.

Answer(s): C

Explanation:

The risk assessment process is continual and any changes to an established process should include a new- risk assessment. While a review of the SAS 70 report and a vulnerability assessment may be components of a risk assessment, neither would constitute sufficient due diligence on its own.

Reveal Solution Next Question

QUESTION: 319

Which of the following is MOST important to consider when developing a business case to support the investment in an information security program?

Senior management support
Results of a cost-benefit analysis
Results of a risk assessment
Impact on the risk profile

Answer(s): D

Explanation:

The information security manager must understand the business risk profile of the organization. No model provides a complete picture, but logically categorizing the risk areas of an organization facilitates focusing on key risk management strategies and decisions. It also enables the organization to develop and implement risk treatment approaches that are relevant to the business and cost effective.

Reveal Solution Next Question

QUESTION: 320

It is MOST important for an information security manager to ensure that security risk assessments are performed:

consistently throughout the enterprise
during a root cause analysis
as part of the security business case
in response to the threat landscape

Answer(s): A

Reference:

https://m.isaca.org/Certification/Additional-Resources/Documents/CISM-Item-Development-Guide_bro_Eng_0117.pdf(14)

Reveal Solution Next Question

ISACA CISM Exam (page: 64) ISACA Certified Information Security Manager Updated on: 06-Apr-2026

QUESTION: 316

Explanation:

QUESTION: 317

Explanation:

QUESTION: 318

Explanation:

QUESTION: 319

Explanation:

QUESTION: 320

Reference:

ISACA CISM Exam (page: 64)
ISACA Certified Information Security Manager
Updated on: 06-Apr-2026