[Full-Version] 2025 New Preparation Guide of ISACA CISM Exam
CISM Practice Exam - 799 Unique Questions
NEW QUESTION # 15
A security risk assessment exercise should be repeated at regular intervals because:
- A. omissions in earlier assessments can be addressed.
- B. business threats are constantly changing.
- C. repetitive assessments allow various methodologies.
- D. they help raise awareness on security in the business.
Answer: B
Explanation:
Section: INFORMATION RISK MANAGEMENT
Explanation:
As business objectives and methods change, the nature and relevance of threats change as well. Choice B does not, by itself, justify regular reassessment. Choice C is not necessarily true in all cases. Choice D is incorrect because there are better ways of raising security awareness than by performing a risk assessment.
NEW QUESTION # 16
In order to understand an organization's security posture, it is MOST important for an organization's senior leadership to:
- A. ensure established security metrics are reported.
- B. evaluate results of the most recent incident response test.
- C. review the number of reported security incidents.
- D. assess progress of risk mitigation efforts.
Answer: D
Explanation:
According to the CISM Review Manual, an organization's security posture is the overall condition of its information security, which is determined by the effectiveness of its security program and the alignment of its security objectives with its business goals. To understand the security posture, the senior leadership needs to have a holistic view of the security risks and the actions taken to address them. Therefore, assessing the progress of risk mitigation efforts is the most important activity for the senior leadership, as it provides them with the information on how well the security program is performing and whether it is meeting the expected outcomes. Evaluating the results of the most recent incident response test, reviewing the number of reported security incidents, and ensuring established security metrics are reported are all useful activities for the senior leadership, but they are not sufficient to understand the security posture. They only provide partial or isolated information on the security performance, which may not reflect the overall security condition or the alignment with the business objectives. Reference = CISM Review Manual, 16th Edition, Chapter 1, Information Security Governance, pages 28-29.
NEW QUESTION # 17
After undertaking a security assessment of a production system, the information security manager is MOST likely to:
- A. inform the development team of any residual risks, and together formulate risk reduction measures.
- B. establish an overall security program that minimizes the residual risks of that production system.
- C. inform the system owner of any residual risks and propose measures to reduce them.
- D. inform the IT manager of the residual risks and propose measures to reduce them.
Answer: C
Explanation:
Section: INFORMATION RISK MANAGEMENT
NEW QUESTION # 18
An organization experienced a breach which was successfully contained and remediated. Based on industry regulations, the breach needs to be communicated externally. What should the information security manager do NEXT?
- A. Contact the board of directors.
- B. Invoke the corporate communications plan.
- C. Send out a breach notification to all parties involved.
- D. Refer to the incident response plan.
Answer: B
Explanation:
Section: INCIDENT MANAGEMENT AND RESPONSE
NEW QUESTION # 19
An organization finds it necessary to quickly shift to a work-fromhome model with an increased need for remote access security.
Which of the following should be given immediate focus?
- A. Moving to a zero trust access model
- B. Enhancing cyber response capability
- C. Enabling network-level authentication
- D. Strengthening endpoint security
Answer: D
Explanation:
Strengthening endpoint security is the most immediate focus when shifting to a work-from-home model with an increased need for remote access security, as this reduces the risk of unauthorized access, data leakage, malware infection, and other threats that may compromise the confidentiality, integrity, and availability of the organization's information assets. Moving to a zero trust access model, enabling network-level authentication, and enhancing cyber response capability are also important, but not as urgent as strengthening endpoint security, as they require more time, resources, and planning to implement effectively. Reference = CISM Review Manual 2023, page 1561; CISM Review Questions, Answers & Explanations Manual 2023, page 302; ISACA CISM - iSecPrep, page 153
NEW QUESTION # 20
Good information security procedures should:
- A. underline the importance of security governance.
- B. define the allowable limits of behavior.
- C. describe security baselines for each platform.
- D. be updated frequently as new software is released.
Answer: D
Explanation:
Explanation
Security procedures often have to change frequently to keep up with changes in software. Since a procedure is a how-to document, it must be kept up-to-date with frequent changes in software. A security standard such as platform baselines - defines behavioral limits, not the how-to process; it should not change frequently.
High-level objectives of an organization, such as security governance, would normally be addressed in a security policy.
NEW QUESTION # 21
Which of the following techniques would be the BEST test of security effectiveness?
- A. Analyzing technical security practices
- B. Reviewing security policies and standards
- C. Performing an external penetration test
- D. Reviewing security logs
Answer: B
Explanation:
Section: INFORMATION SECURITY PROGRAM DEVELOPMENT
NEW QUESTION # 22
The PRIMARY reason for defining the information security roles and responsibilities of staff throughout an organization is to:
- A. increase corporate accountability.
- B. comply with security policy.
- C. reinforce the need for training.
- D. enforce individual accountability.
Answer: D
Explanation:
Individual accountability ensures that individuals are held responsible for their actions related to information security, which promotes adherence to policy, procedures and guidelines. Defining roles and responsibilities helps make clear what is expected of each staff member, which in turn makes it possible to hold individuals accountable for fulfilling those expectations. This encourages behavior that supports the organization's information security objectives.
NEW QUESTION # 23
Which of the following would BEST ensure the success of information security governance within an organization?
- A. Steering committees approve security projects
- B. Steering committees enforce compliance with laws and regulations
- C. Security policy training provided to all managers
- D. Security training available to all employees on the intranet
Answer: A
Explanation:
Section: INFORMATION SECURITY GOVERNANCE
Explanation:
The existence of a steering committee that approves all security projects would be an indication of the existence of a good governance program. Compliance with laws and regulations is part of the responsibility of the steering committee but it is not a full answer. Awareness training is important at all levels in any medium, and also an indicator of good governance. However, it must be guided and approved as a security project by the steering committee.
NEW QUESTION # 24
An organization provides notebook PCs, cable wire locks, smartphone access, and virtual private network (VPN) access to its remote employees. Which of the following is MOST important for the information security manager to ensure?
- A. Employees use the VPN when accessing the organization's online resources.
- B. Employees are trained on the acceptable use policy.
- C. Employees physically lock PCs when leaving the immediate area.
- D. Employees use smartphone tethering when accessing from remote locations.
Answer: A
Explanation:
Explanation
Using the VPN when accessing the organization's online resources is the most important thing to ensure, as it provides a secure and encrypted connection between the remote employees and the organization's network, and protects the data and systems from unauthorized access, interception, or tampering. VPNs also help to comply with the organization's security policies and standards, and to prevent data leakage or breaches.
References = CISM Review Manual 2022, page 3081; CISM Exam Content Outline, Domain 4, Knowledge Statement 4.92; CISM 2020: Remote Access Security; How to Secure Remote Workers with VPN
NEW QUESTION # 25
Which of the following is the MOST important factor to ensure information security is meeting the organization's objectives?
- A. Implementation of a security awareness program
- B. Internal audit's involvement in the security process
- C. Establishment of acceptable risk thresholds
- D. Implementation of a control self-assessment (CSA) process
Answer: C
NEW QUESTION # 26
When conducting a post-incident review, the GREATEST benefit of collecting mean time to resolution (MTTR) data is the ability to:
- A. provide metrics for reporting to senior management
- B. learn of potential areas of improvement
- C. verify compliance with the service level agreement (SLA).
- D. reduce the costs of future preventive controls.
Answer: B
NEW QUESTION # 27
Which of the following is the GREATEST benefit of integrating information security program requirements into vendor management?
- A. The ability to define service level agreements (SLAs)
- B. The ability to meet industry compliance requirements
- C. The ability to improve vendor performance
- D. The ability to reduce risk in the supply chain
Answer: D
NEW QUESTION # 28
Temporarily deactivating some monitoring processes, even if supported by an acceptance of operational risk, may not be acceptable to the information security manager if:
- A. it violates industry security practices.
- B. it implies compliance risks.
- C. short-term impact cannot be determined.
- D. changes in the roles matrix cannot be detected.
Answer: B
Explanation:
Explanation
Monitoring processes are also required to guarantee fulfillment of laws and regulations of the organization and, therefore, the information security manager will be obligated to comply with the law. Choices B and C are evaluated as part of the operational risk. Choice D is unlikely to be as critical a breach of regulatory legislation. The acceptance of operational risks overrides choices B, C and D.
NEW QUESTION # 29
Which of the following metrics would provide management with the MOST useful information about the progress of a security awareness program?
- A. Decreased number of security incidents
- B. Increased number of downloads of the organization's security policy
- C. Completion rate of user awareness training within each business unit
- D. Increased reported of security incidents
Answer: A
Explanation:
Section: INFORMATION SECURITY PROGRAM DEVELOPMENT
NEW QUESTION # 30
At what stage of the applications development process would encryption key management initially be addressed?
- A. Code reviews
- B. Systems testing
- C. Deployment
- D. Requirements development
Answer: D
Explanation:
Encryption key management has to be integrated into the requirements of the application's design. During systems testing and deployment would be too late since the requirements have already been agreed upon. Code reviews are part of the final quality assurance (QA) process and would also be too late in the process.
NEW QUESTION # 31
Which of the following is the BEST indication that a recently adopted information security framework is a good fit for *n organization?
- A. The business has obtained framework certification.
- B. Objectives in the framework correlate directly to business practices
- C. The number of security incidents has significantly declined
- D. The framework includes industry-recognized information security best practices.
Answer: C
NEW QUESTION # 32
Which of the following is an example of a vulnerability?
- A. Defective software
- B. Unauthorized users
- C. Natural disasters
- D. Ransomware
Answer: A
Explanation:
Section: INFORMATION SECURITY PROGRAM MANAGEMENT
NEW QUESTION # 33
An organization's information security manager is performing a post-incident review of a security incident in which the following events occurred:
* A bad actor broke into a business-critical FTP server by brute forcing an administrative password
* The third-party service provider hosting the server sent an automated alert message to the help desk, but was ignored
* The bad actor could not access the administrator console, but was exposed to encrypted data transferred to the server
* After three (3) hours, the bad actor deleted the FTP directory causing incoming FTP attempts by legitimate customers to fail Which of the following poses the GREATEST risk to the organization related to This event?
- A. Removal of data
- B. Downtime of the service
- C. Potential access to the administrator console
- D. Disclosure of stolen data
Answer: B
NEW QUESTION # 34
Security policies should be aligned MOST closely with:
- A. local laws and regulations.
- B. organizational needs.
- C. industry' best practices.
- D. generally accepted standards.
Answer: B
Explanation:
The needs of the organization should always take precedence. Best practices and local regulations are important, but they do not take into account the total needs of an organization.
NEW QUESTION # 35
A new type of ransomware has infected an organization's network. Which of the following would have BEST enabled the organization to detect this situation?
- A. Monitoring of anomalies in system behavior
- B. Regular review of the threat landscape
- C. Use of integrated patch deployment tools
- D. Periodic information security training for end users
Answer: A
NEW QUESTION # 36
Which of the following is the MOST appropriate individual to ensure that new exposures have not been introduced into an existing application during the change management process?
- A. Data security officer
- B. System user
- C. System analyst
- D. Operations manager
Answer: B
Explanation:
Explanation
System users, specifically the user acceptance testers, would be in the best position to note whether new exposures are introduced during the change management process. The system designer or system analyst, data security officer and operations manager would not be as closely involved in testing code changes.
NEW QUESTION # 37
An information security manager notes that security incidents are not being appropriately escalated by the help desk after tickets are logged. Which of the following is the BEST automated control to resolve this issue?
- A. Integrating incident response workflow into the help desk ticketing system
- B. Implementing automated vulnerability scanning in the help desk workflow
- C. Integrating automated service level agreement (SLA) reporting into the help desk ticketing system
- D. Changing the default setting for all security incidents to the highest priority
Answer: A
Explanation:
The best automated control to resolve the issue of security incidents not being appropriately escalated by the help desk is to integrate incident response workflow into the help desk ticketing system. This will ensure that the help desk staff follow the predefined steps and procedures for handling and escalating security incidents, based on the severity, impact, and urgency of each incident. The incident response workflow will also provide clear guidance on who to notify, when to notify, and how to notify the relevant stakeholders and authorities. This will improve the efficiency, effectiveness, and consistency of the incident response process.
Reference = CISM Review Manual, 16th Edition, page 2901; A Practical Approach to Incident Management Escalation2
NEW QUESTION # 38
......
The Certified Information Security Manager (CISM) exam is a certification program designed and offered by the Information Systems Audit and Control Association (ISACA). CISM exam is designed for professionals who are responsible for managing, designing, and overseeing an organization's information security program. It is a globally recognized certification that validates the skills and knowledge required for managing, designing, and assessing an enterprise's information security program.
Isaca CISM Practice Test Questions, Isaca CISM Exam Practice Test Questions
Certified Information Security Manager (CISM) is a sought-after certification offered by ISACA. ISACA is a non-profit independent association that helps those professionals who are involved in risk management, information security, assurance, and governance. The exam that you need to pass for this certificate evaluates if you are experienced and has the knowledge for the management of the information security program.
Latest Questions CISM Guide to Prepare Free Practice Tests: https://www.latestcram.com/CISM-exam-cram-questions.html
Reliable CISM Dumps Questions Available as Web-Based Practice Test Engine: https://drive.google.com/open?id=1WBUmT3eBggOzEDMTlB52Mm7aK19neUNb
