Jan-2024 ISACA CISM Actual Questions and 100% Cover Real Exam Questions [Q154-Q172]

NEW QUESTION 154
When implementing a new risk assessment methodology, which of the following is the MOST important requirement?

Risk assessments must be conducted by certified staff.

The methodology must be approved by the chief executive officer.

Risk assessments must be reviewed annually.

The methodology used must be consistent across the organization.

NEW QUESTION 155
Which of the following is the BEST reason to initiate a reassessment of current risk?

Follow-up to an audit report

A recent security incident

Certification requirements

Changes to security personnel

NEW QUESTION 156
Which of the following is the MOST usable deliverable of an information security risk analysis?

Business impact analysis (BIA) report

List of action items to mitigate risk

Assignment of risks to process owners

Quantification of organizational risk

NEW QUESTION 157
On which of the following should a firewall be placed?

Web server

Intrusion detection system (IDS) server

Screened subnet

Domain boundary

NEW QUESTION 158
When performing a risk assessment, the MOST important consideration is that:

management supports risk mitigation efforts.

annual loss expectations (ALEs) have been calculated for critical assets.

assets have been identified and appropriately valued.

attack motives, means and opportunities be understood.

NEW QUESTION 159
Which of the following is MOST helpful in integrating information security governance with corporate governance?

Assigning the implementation of information security governance to the steering committee.

Including information security processes within operational and management processes.

Providing independent reports of information security efficiency and effectiveness to the board.

Aligning the information security governance to a globally accepted framework.

NEW QUESTION 160
Which of the following measures is the MOST effective deterrent against disgruntled stall abusing their privileges?

Layered defense strategy

System audit log monitoring

Signed acceptable use policy

High-availability systems

NEW QUESTION 161
Which of the following is the BEST mechanism to determine the effectiveness of the incident response process?

Incident response metrics

Periodic auditing of the incident response process

Action recording and review

Post incident review

NEW QUESTION 162
Which of the following is MOST likely to increase end user security awareness in an organization?

A dedicated channel for reporting suspicious emails

Security objectives included in job descriptions

Simulated phishing attacks

Red team penetration testing

NEW QUESTION 163
The MOST effective way to ensure network users are aware of their responsibilities to comply with an organization’s security requirements is:

messages displayed at every logon.

periodic security-related e-mail messages.

an Intranet web site for information security.

circulating the information security policy.

NEW QUESTION 164
The decision to escalate an incident should be based PRIMARILY on:

organizational hierarchy.

prioritization by the information security manager

predefined policies and procedures

response team experience.

NEW QUESTION 165
An information security program should focus on:

best practices also in place at peer companies.

solutions codified in international standards.

key controls identified in risk assessments.

continued process improvement.

NEW QUESTION 166
A risk assessment exercise has identified the threat of a denial of service (DoS) attack Executive management has decided to take no further action related to this risk. The MO ST likely reason for this decision is

the risk assessment has not defined the likelihood of occurrence

the reported vulnerability has not been validated

executive management is not aware of the impact potential

the cost of implementing controls exceeds the potential financial losses.

NEW QUESTION 167
Which of the following is the MOST immediate consequence of failing to tune a newly installed intrusion detection system (IDS) with the threshold set to a low value?

The number of false positives increases

The number of false negatives increases

Active probing is missed

Attack profiles are ignored

NEW QUESTION 168
To reduce the possibility of service interruptions, an entity enters into contracts with multiple Internet service providers (ISPs). Which of the following would be the MOST important item to include?

Service level agreements (SLAs)

Right to audit clause

Intrusion detection system (IDS) services

Spam filtering services

NEW QUESTION 169
Which of the following is MOST helpful when justifying the funding required for a compensating control?

Business impact analysis (B1A)

Risk analysis

Business case

Threat assessment

NEW QUESTION 170
Which of the following is the GREATEST security threat when an organization allows remote access to a virtual private network (VPN)?

Client logins are subject to replay attack

Compromised VPN clients could impact the network

Attackers could compromise the VPN gateway

VPN traffic could be sniffed and captured

NEW QUESTION 171
An information security manager has identified and implemented mitigating controls according to industry best practices. Which of the following is the GREATEST risk associated with this approach?

The security program may not be aligned with organizational objectives.

Important security controls may be missed without senior management input.

The mitigation measures may not be updated in a timely manner.

The cost of control implementation may be too high.

NEW QUESTION 172
The use of a business case to obtain funding for an information security investment is MOST effective when the business case:

realigns information security objectives to organizational strategy,

articulates management s intent and information security directives in clear language.

relates the investment to the organization’s strategic plan.

translates information security policies and standards into business requirements.

Jan-2024 ISACA CISM Actual Questions and 100% Cover Real Exam Questions [Q154-Q172]

Be the first to reply

Leave a Reply Cancel reply