CISM Exam dumps PDF | Exam-Dumps.net (Page: 7)

QUESTION: 31

A business unit intends to deploy a new technology in a manner that places it in violation of existing information security standards. What immediate action should an information security manager take?

Enforce the existing security standard
Change the standard to permit the deployment
Perform a risk analysis to quantify the risk
Perform research to propose use of a better technology

Answer(s): C

Explanation:

Resolving conflicts of this type should be based on a sound risk analysis of the costs and benefits of allowing or disallowing an exception to the standard. A blanket decision should never be given without conducting such an analysis. Enforcing existing standards is a good practice; however, standards need to be continuously examined in light of new technologies and the risks they present. Standards should not be changed without an appropriate risk assessment.

Reveal Solution Next Question

QUESTION: 32

Acceptable levels of information security risk should be determined by:

legal counsel.
security management.
external auditors.
die steering committee.

Answer(s): D

Explanation:

Senior management, represented in the steering committee, has ultimate responsibility for determining what levels of risk the organization is willing to assume. Legal counsel, the external auditors and security management are not in a position to make such a decision.

Reveal Solution Next Question

QUESTION: 33

The PRIMARY goal in developing an information security strategy is to:

establish security metrics and performance monitoring.
educate business process owners regarding their duties.
ensure that legal and regulatory requirements are met
support the business objectives of the organization.

Answer(s): D

Explanation:

The business objectives of the organization supersede all other factors. Establishing metrics and measuring performance, meeting legal and regulatory requirements, and educating business process owners are all subordinate to this overall goal.

Reveal Solution Next Question

QUESTION: 34

Senior management commitment and support for information security can BEST be enhanced through:

a formal security policy sponsored by the chief executive officer (CEO).
regular security awareness training for employees.
periodic review of alignment with business management goals.
senior management signoff on the information security strategy.

Answer(s): C

Explanation:

Ensuring that security activities continue to be aligned and support business goals is critical to obtaining their support. Although having the chief executive officer (CEO) signoff on the security policy and senior management signoff on the security strategy makes for good visibility and demonstrates good tone at the top, it is a one-time discrete event that may be quickly forgotten by senior management. Security awareness training for employees will not have as much effect on senior management commitment.

Reveal Solution Next Question

QUESTION: 35

When identifying legal and regulatory issues affecting information security, which of the following would represent the BEST approach to developing information security policies?

Create separate policies to address each regulation
Develop policies that meet all mandated requirements
Incorporate policy statements provided by regulators
Develop a compliance risk assessment

Answer(s): B

Explanation:

It will be much more efficient to craft all relevant requirements into policies than to create separate versions. Using statements provided by regulators will not capture all of the requirements mandated by different regulators. A compliance risk assessment is an important tool to verify that procedures ensure compliance once the policies have been established.

Reveal Solution Next Question

ISACA CISM Exam (page: 7) ISACA Certified Information Security Manager Updated on: 31-Mar-2026

QUESTION: 31

Explanation:

QUESTION: 32

Explanation:

QUESTION: 33

Explanation:

QUESTION: 34

Explanation:

QUESTION: 35

Explanation:

ISACA CISM Exam (page: 7)
ISACA Certified Information Security Manager
Updated on: 31-Mar-2026