CISM Exam Questions and Answers | Exam-Dumps (Page: 8)

QUESTION: 36

Which of the following MOST commonly falls within the scope of an information security governance steering committee?

Interviewing candidates for information security specialist positions
Developing content for security awareness programs
Prioritizing information security initiatives
Approving access to critical financial systems

Answer(s): C

Explanation:

Prioritizing information security initiatives is the only appropriate item. The interviewing of specialists should be performed by the information security manager, while the developing of program content should be performed by the information security staff. Approving access to critical financial systems is the responsibility of individual system data owners.

Reveal Solution Next Question

QUESTION: 37

Which of the following is the MOST important factor when designing information security architecture?

Technical platform interfaces
Scalability of the network
Development methodologies
Stakeholder requirements

Answer(s): D

Explanation:

The most important factor for information security is that it advances the interests of the business, as defined by stakeholder requirements. Interoperability and scalability, as well as development methodologies, are all important but are without merit if a technologically-elegant solution is achieved that does not meet the needs of the business.

Reveal Solution Next Question

QUESTION: 38

Which of the following characteristics is MOST important when looking at prospective candidates for the role of chief information security officer (CISO)?

Knowledge of information technology platforms, networks and development methodologies
Ability to understand and map organizational needs to security technologies
Knowledge of the regulatory environment and project management techniques
Ability to manage a diverse group of individuals and resources across an organization

Answer(s): B

Explanation:

Information security will be properly aligned with the goals of the business only with the ability to understand and map organizational needs to enable security technologies. All of the other choices are important but secondary to meeting business security needs.

Reveal Solution Next Question

QUESTION: 39

Which of the following are likely to be updated MOST frequently?

Procedures for hardening database servers
Standards for password length and complexity
Policies addressing information security governance
Standards for document retention and destruction

Answer(s): A

Explanation:

Policies and standards should generally be more static and less subject to frequent change. Procedures on the other hand, especially with regard to the hardening of operating systems, will be subject to constant change; as operating systems change and evolve, the procedures for hardening will have to keep pace.

Reveal Solution Next Question

QUESTION: 40

Who should be responsible for enforcing access rights to application data?

Data owners
Business process owners
The security steering committee
Security administrators

Answer(s): D

Explanation:

As custodians, security administrators are responsible for enforcing access rights to data. Data owners are responsible for approving these access rights. Business process owners are sometimes the data owners as well, and would not be responsible for enforcement. The security steering committee would not be responsible for enforcement.

Reveal Solution Next Question

ISACA CISM Exam (page: 8) ISACA Certified Information Security Manager Updated on: 25-Dec-2025

QUESTION: 36

Explanation:

QUESTION: 37

Explanation:

QUESTION: 38

Explanation:

QUESTION: 39

Explanation:

QUESTION: 40

Explanation:

ISACA CISM Exam (page: 8)
ISACA Certified Information Security Manager
Updated on: 25-Dec-2025