CISM Practice Exam Dumps Can Help You Prepare Exam Well

1. Which of the following should be the FIRST step in developing an information security plan?

2. Senior management commitment and support for information security can BEST be obtained through presentations that:

3. The MOST appropriate role for senior management in supporting information security is the:

4. Which of the following would BEST ensure the success of information security governance within an organization?

5. Information security governance is PRIMARILY driven by:

6. Which of the following represents the MAJOR focus of privacy regulations?

7. Investments in information security technologies should be based on:

8. Retention of business records should PRIMARILY be based on:

9. Which of the following is characteristic of centralized information security management?

10. Successful implementation of information security governance will FIRST require:

11. Which of the following individuals would be in the BEST position to sponsor the creation of an information security steering group?

12. The MOST important component of a privacy policy is:

13. The cost of implementing a security control should not exceed the:

14. When a security standard conflicts with a business objective, the situation should be resolved by:

15. Minimum standards for securing the technical infrastructure should be defined in a security:

16. Which of the following is MOST appropriate for inclusion in an information security strategy?

17. Senior management commitment and support for information security will BEST be attained by an information security manager by emphasizing:

18. Which of the following roles would represent a conflict of interest for an information security manager?

19. Which of the following situations must be corrected FIRST to ensure successful information security governance within an organization?

20. Which of the following requirements would have the lowest level of priority in information security?

21. When an organization hires a new information security manager, which of the following goals should this individual pursue FIRST?

22. It is MOST important that information security architecture be aligned with which of the following?

23. Which of the following is MOST likely to be discretionary?

24. Security technologies should be selected PRIMARILY on the basis of their:

25. Which of the following are seldom changed in response to technological changes?

26. The MOST important factor in planning for the long-term retention of electronically stored business records is to take into account potential changes in:

27. Which of the following is characteristic of decentralized information security management across a geographically dispersed organization?

28. Which of the following is the MOST appropriate position to sponsor the design and implementation of a new security infrastructure in a large global enterprise?

29. Which of the following would be the MOST important goal of an information security governance program?

30. Relationships among security technologies are BEST defined through which of the following?

31. A business unit intends to deploy a new technology in a manner that places it in violation of existing information security standards.

What immediate action should an information security manager take?

32. Acceptable levels of information security risk should be determined by:

33. The PRIMARY goal in developing an information security strategy is to:

34. Senior management commitment and support for information security can BEST be enhanced through:

35. When identifying legal and regulatory issues affecting information security, which of the following would represent the BEST approach to developing information security policies?

36. Which of the following MOST commonly falls within the scope of an information security governance steering committee?

37. Which of the following is the MOST important factor when designing information security architecture?

38. Which of the following characteristics is MOST important when looking at prospective candidates for the role of chief information security officer (CISO)?

39. Which of the following are likely to be updated MOST frequently?

40. Who should be responsible for enforcing access rights to application data?

41. The chief information security officer (CISO) should ideally have a direct reporting relationship to the:

42. Which of the following is the MOST essential task for a chief information security officer (CISO) to perform?

43. Developing a successful business case for the acquisition of information security software products can BEST be assisted by:

44. When an information security manager is developing a strategic plan for information security, the timeline for the plan should be:

45. Which of the following is the MOST important information to include in a strategic plan for information security?

46. Information security projects should be prioritized on the basis of:

47. Which of the following is the MOST important information to include in an information security standard?

48. Which of the following would BEST prepare an information security manager for regulatory reviews?

49. An information security manager at a global organization that is subject to regulation by multiple governmental jurisdictions with differing requirements should:

50. Which of the following BEST describes an information security manager's role in a multidisciplinary team that will address a new regulatory requirement regarding operational risk?

51. From an information security manager perspective, what is the immediate benefit of clearly-defined roles and responsibilities?

52. An internal audit has identified major weaknesses over IT processing.

Which of the following should an information security manager use to BEST convey a sense of urgency to management?

53. Reviewing which of the following would BEST ensure that security controls are effective?

54. Which of the following is responsible for legal and regulatory liability?

55. While implementing information security governance an organization should FIRST:

56. The MOST basic requirement for an information security governance program is to:

57. Information security policy enforcement is the responsibility of the:

58. A good privacy statement should include:

59. Which of the following would be MOST effective in successfully implementing restrictive password policies?

60. When designing an information security quarterly report to management, the MOST important element to be considered should be the:

61. An information security manager at a global organization has to ensure that the local information security program will initially ensure compliance with the:

62. A new regulation for safeguarding information processed by a specific type of transaction has come to the attention of an information security officer. The officer should FIRST:

63. The PRIMARY objective of a security steering group is to:

64. Data owners must provide a safe and secure environment to ensure confidentiality, integrity and availability of the transaction. This is an example of an information security:

65. At what stage of the applications development process should the security department initially become involved?

66. A security manager is preparing a report to obtain the commitment of executive management to a security program. Inclusion of which of the following would be of MOST value?

67. The PRIMARY concern of an information security manager documenting a formal data retention policy would be:

68. When personal information is transmitted across networks, there MUST be adequate controls over:

69. An organization's information security processes are currently defined as ad hoc. In seeking to improve their performance level, the next step for the organization should be to:

70. Who in an organization has the responsibility for classifying information?

71. What is the PRIMARY role of the information security manager in the process of information classification within an organization?

72. Logging is an example of which type of defense against systems compromise?

73. Which of the following is MOST important in developing a security strategy?

74. Who is ultimately responsible for the organization's information?

75. Which of the following factors is a PRIMARY driver for information security governance that does not require any further justification?

76. A security manager meeting the requirements for the international flow of personal data will need to ensure:

77. An information security manager mapping a job description to types of data access is MOST likely to adhere to which of the following information security principles?

78. Which of the following is the MOST important prerequisite for establishing information security management within an organization?

79. What will have the HIGHEST impact on standard information security governance models?

80. In order to highlight to management, the importance of integrating information security in the business processes, a newly hired information security officer should FIRST:

81. Temporarily deactivating some monitoring processes, even if supported by an acceptance of operational risk, may not be acceptable to the information security manager if:

82. An outcome of effective security governance is:

83. How would an information security manager balance the potentially conflicting requirements of an international organization's security standards and local regulation?

84. Who should drive the risk analysis for an organization?

85. The FIRST step in developing an information security management program is to:

86. Which of the following is the MOST important to keep in mind when assessing the value of information?

87. What would a security manager PRIMARILY utilize when proposing the implementation of a security solution?

88. To justify its ongoing security budget, which of the following would be of MOST use to the information security' department?

89. Which of the following situations would MOST inhibit the effective implementation of security governance?

90. To achieve effective strategic alignment of security initiatives, it is important that:

91. What would be the MOST significant security risks when using wireless local area network (LAN) technology?

92. When developing incident response procedures involving servers hosting critical applications, which of the following should be the FIRST to be notified?

93. In implementing information security governance, the information security manager is PRIMARILY responsible for:

94. An information security strategy document that includes specific links to an organization's business activities is PRIMARILY an indicator of:

95. When an organization is setting up a relationship with a third-party IT service provider, which of the following is one of the MOST important topics to include in the contract from a security standpoint?

96. To justify the need to invest in a forensic analysis tool, an information security manager should FIRST:

97. The MOST useful way to describe the objectives in the information security strategy is through:

98. In order to highlight to management, the importance of network security, the security manager should FIRST:

99. When developing an information security program, what is the MOST useful source of information for determining available resources?

100. The MOST important characteristic of good security policies is that they: