Updated ISACA CISM Dumps V11.02 [2022] For Certified Information Security Manager Certification Exam

1. Which of the following MOST effectively prevents internal users from modifying sensitive data?

2. A contract bid is digitally signed and electronically mailed The PRIMARY advantage to using a digital signature is that

3. Which of the following would be of GREATEST concern to an information security manager when evaluating a cloud service provider (CSP)?

4. An access rights review revealed that some former employees' access is still active.

Once the access is revoked, which of the following is the BEST course of action to help prevent recurrence?

5. Which of the following is the MOST effective approach for integrating security into application development?

6. Which of the following processes would BEST help to ensure that information security risks will be evaluated when implementing a new payroll system?

7. The MOST important factors in determining the scope and timing for testing a business continuity plan are:

8. A threat intelligence report indicates there has been a significant rise in the number of attacks targeting the industry.

What should the information security manager do NEXT?

9. Which of the following is the MOST effective way to detect social engineering attacks?

10. A third-party contract signed by a business unit manager failed to specify information security requirements.

Which of the following is the BEST way for an information security manager to prevent this situation from reoccurring?

11. Which of the following is the MOST important requirement for the successful implementation of security governance?

12. Which of the following would contribute MOST to employees' understanding of data handling responsibilities?

13. Which of the following BEST reduces the likelihood of leakage of private information via email?

14. A new program has been implemented to standardize security configurations across a multinational organization Following implementation, the configuration standards should:

15. An information security manager s PRIMARY objective for presenting key risks to the board of directors is to:

16. The PRIMARY purpose of asset valuation for the management of information security is to:

17. Which of the following is the PRIMARY reason to invoke continuity and recovery plans?

18. An information security manager is concerned that executive management does not su the following is the BEST way to address this situation?

19. A policy has been established requiting users to install mobile device management (MDM) software on their personal devices.

Which of the following would BEST mitigate the risk created by noncompliance with this policy?

20. Which of the following provides the BEST input to maintain an effective asset classification program?

21. When the inherent risk of a business activity is lower than the acceptable risk level, the BEST course of action would be to:

22. Which of the following is the BEST way to prevent employees from making unauthorized comments to the media about security incidents in progress?

23. Which of the following would be MOST effective when justifying the cost of adding security controls to an existing web application?

24. An information security manager is concerned that executive management does not support information security initiatives.

Which of the following is the BEST way to address this situation?

25. Which of the following is the PRIMARY objective of a business impact analysis (BIA):

26. Which of the following should be define* I FIRST when creating an organization's information security strategy?

27. Meeting which of the following security objectives BEST ensures that information is protected against unauthorized modification?

28. Which of the following is the BEST way for an information security manager to promote the integration of information security considerations into key business processes?

29. Senior management learns of several web application security incidents and wants to know the exposure risk to the organization.

What is the information security manager's BEST course of action?

30. A message is being sent with a hash. The risk of an attacker changing the message and generating an authentic hash value c*n be mitigated by:

31. Which of the following sites would be MOST appropriate in the case of a very short recovery time objective (RTO)?

32. Which of the following is the BEST indication that a recently adopted information security framework is a good fit for an organization?

33. Which of the following is the BEST indication that a recently adopted information security framework is a good fit for an organization?

34. Which of the following is MOST likely to result from a properly conducted post-incident review?

35. Labeling information according to its security classification:

36. Which of the following is MOST likely to result from a properly conducted post-incident review?

37. Which of the following would provide senior management with the BEST overview of the performance of information security risk treatment options?

38. The GREATEST benefit of choosing a private cloud over a public cloud would be:

39. The PRIMARY reason an organization would require that users sign an acknowledgment of their system access responsibilities is to:

40. Which of the following is MOST important to the successful development of an information security strategy?

41. Which of the following processes is the FIRST step in establishing an information security policy?

42. A company has purchased a rival organization and is looking to integrate security strategies.

Which of the following is the GREATEST issue to consider?

43. Which of the following is the PRIMARY reason social media has become a popular target for attack?

44. When using a newly implemented security information and event management (SIEM) infrastructure, which of the following should be considered FIRST?

45. An organization's security policy is to disable access to USB storage devices on laptops and desktops.

Which of the following is the STRONGEST justification foi granting an exception to the policy?

46. Which of the following is the BEST way to improve the timely reporting of information security incidents?

47. Which of the following would BEST assist an information security manager in gaining strategic support from executive management?

48. When information security management is receiving an increased number of false positive incident reports, which of the following is MOST important to review?

49. What should be information security manager’s FIRST course of action when it is discovered a staff member has been posting corporate information on social media sites?

50. Which of the following is the MOST important consideration when determining the approach for gaining organization-wide acceptance of an information security plan?

51. Which of the following is the MOST useful metric for determining how well firewall logs are being monitored?

52. As part of an international expansion plan, an organization has acquired a company located in another jurisdiction.

Which of the following would be the BEST way to maintain an effective information security program?

53. Which of the following is the MOST effective data loss control when connecting a personally owned mobile device to the corporate email system?

54. An organization has implemented an enhanced password policy for business applications which requires significantly more business resource to support clients.

The BEST approach to obtain the support of business management would be to:

55. Which of the following is the BEST resource for evaluating the strengths and weaknesses of an incident response plan?

56. Which of the following is the BEST way to demonstrate to senior management that organizational security practices comply with industry standards?

57. Over the last year, an information security manager has performed risk assessments on multiple third-party vendors.

Which of the following criteria would be MOST helpful in determining the associated level of risk applied to each vendor?

58. After implementing an information security governance framework, which of the following would provide the BEST information to develop an information security project plan?

59. Which of the following is the BEST method to defend against social engineering attacks?

60. Which of the following would provide the MOST useful input when creating an information security program?

61. Which of the following is an information security manager’s BEST course of action when informed of decision to reduce funding for the information security program?

62. Which of the following will BEST protect an organization against spear phishing?

63. Which of the following should be PRIMARILY included in a security training program for business process owners?

64. Which of the following external entities would provide the BEST guideance to an organization facing advanced attacks?

65. Which of the following is a PRIMARY security responsibility of an information owner?

66. To ensure appropriate control of information processed in IT systems, security safeguards should be based PRIMARILY on:

67. Which of the following BEST enables an effective escalation process within an incident response program?

68. Which of the following activities BEST enables executive management to ensure value delivery within an information security program?

69. Which of the following would present the GREATEST need to revise information security poll'

70. During which phase of an incident response process should corrective actions to the response procedure be considered and implemented?

71. The PRIMARY benefit of integrating information security activities into change management processes is to:

72. Within a security governance framework, which of the following is the MOST important characteristic of the information security committee? The committee:

73. Which of the following is an information security manager's BEST course of action to address a significant materialized risk that was not prevented by organizational controls?

74. Which of the following control type is the FIRST consideration for aligning employee behavior with an organization’s information security objectives?

75. Which of the following would BEST justify spending for a compensating control?

76. To gain a clear understanding of the impact that a new regulatory will have on an organization’s security control, an information manager should FIRST.

77. An emergency change was made to an IT system as a result of a failure.

Which of the following should be of GREATEST concern to the organizations information security manager?

78. The PRIMARY purpose of vulnerability assessments is to:

79. A business unit uses e-commerce with a strong password policy. Many customers complain that they cannot remember their password because they are too long and complex. The business unit states it is imperative to improve the customer experience. The information security manager should FIRST.

80. Before final acceptance of residual risk, what is the BEST way for an information security manager to address risk factors determined to be lower than acceptable risk levels?

81. Which of the following is the MOST effective defense against spear phishing attacks?

82. Which of the following provides the MOST relevant evidence of incident response maturity?

83. Relying on which of the following methods when detecting new threats using IDS should be of MOST concern?

84. Which is MOST important to enable a timely response to a security breach?

85. Which of the following is the BEST way to increase the visibility of information security within an organization's culture?

86. After a server has been attacked, which of the following is the BEST course of action?

87. Which of the following is the MOST important driver when developing an effective information security strategy?

88. An information security manager is reviewing the impact of a regulation on the organization’s human resources system.

The NEXT course of action should be to:

89. Which of the following is the MOST important outcome from vulnerability scanning?

90. Which of the following would provide nonrepudiation of electronic transactions?

91. A multinational organization wants to ensure its privacy program appropriately addresses privacy risk throughout its operations.

Which of the following would be of MOST concern to senior management?

92. Executive management is considering outsourcing all IT operations.

Which of the following functions should remain internal?

93. Which of the following metrics is MOST useful to demonstrate the effectiveness of an incident response plan?

94. Senior management has approved employees working off-site by using a virtual private network (VPN) connection.

It is MOST important for the information security manager to periodically:

95. The success of a computer forensic investigation depends on the concept of:

96. Which of the following activities should take place FIRST when a security patch for Internet software is received from a vendor?

97. Which of the following will BEST help to ensure security is addressed when developing a custom application?

98. Due lo budget constraints, an internal IT application does not include the necessary controls to meet a client service level agreement (SLA).

Which of the following is the information security manager's BEST course of action?

99. Which of the following is MOST critical to review when preparing to outsource a data repository to a cloud-based solution?

100. When developing a new application, which of the following is the BEST approach to ensure compliance with security requirements?