Free ISACA CISM Practice Exams

Question #1

Which of the following documents should contain the INITIAL prioritization of recovery of services?

A . IT risk analysis
B . Threat assessment
C . Business impact analysis (BIA)
D . Business process map

Correct Answer: C
C

Explanation:

A business impact analysis (BIA) is the document that should contain the initial priori-tization of recovery of services. A BIA is a process of identifying and analyzing the po-tential effects of disruptions to critical business functions and processes.

A BIA typi-cally includes the following steps1:

• Identifying the critical business functions and processes that support the organization’s mission and objectives.

• Estimating the maximum tolerable downtime (MTD) for each function or process, which is the longest time that the organization can afford to be without that function or process before suffering unacceptable consequences.

• Assessing the potential impacts of disruptions to each function or process, such as finan-cial losses, reputational damage, legal liabilities, regulatory penalties, customer dissatis-faction, etc.

• Prioritizing the recovery of functions or processes based on their MTDs and impacts, and assigning recovery time objectives (RTOs) and recovery point objectives (RPOs) for each function or process. RTOs are the target times for restoring functions or processes after a disruption, while RPOs are the acceptable amounts of data loss in case of a disruption.

• Identifying the resources and dependencies required for each function or process, such as staff, equipment, software, data, suppliers, customers, etc.

A BIA provides the basis for developing a business continuity plan (BCP), which is a document that outlines the strategies and procedures for ensuring the continuity or re-covery of critical business functions and processes in the event of a disruption2. The other options are not documents that should contain the initial prioritization of recov-ery of services. An IT risk analysis is a process of identifying and evaluating the threats and vulnerabilities that affect the IT systems and assets of an organization. It helps to determine the likelihood and impact of potential IT incidents, and to select and imple-ment appropriate controls to mitigate the risks3. A threat assessment is a process of identifying and analyzing the sources and capabilities of adversaries that may pose a threat to an organization’s security. It helps to determine the level of threat posed by different actors, and to develop countermeasures to prevent or respond to attacks. A business process map is a visual representation of the activities, inputs, outputs, roles, and resources involved in a business process. It helps to understand how a process works, how it can be improved, and how it relates to other processes.

Reference: 1: Business impact analysis (BIA) – Wikipedia 2: Business continuity plan – Wikipedia 3: IT risk management – Wikipedia: Threat assessment – Wikipedia: Business process map-ping – Wikipedia

Question #2

An information security manager developing an incident response plan MUST ensure it includes:

A . an inventory of critical data.
B . criteria for escalation.
C . a business impact analysis (BIA).
D . critical infrastructure diagrams.

Reveal Solution Hide Solution

Question #3

Which type of plan is PRIMARILY intended to reduce the potential impact of security events that may occur?

A . Security awareness plan
B . Business continuity plan (BCP)
C . Disaster recovery plan (DRP)
D . Incident response plan

Reveal Solution Hide Solution

Question #4

An information security manager learns of a new standard related to an emerging technology the organization wants to implement.

Which of the following should the information security manager recommend be done FIRST?

A . Determine whether the organization can benefit from adopting the new standard.
B . Obtain legal counsel’s opinion on the standard’s applicability to regulations,
C . Perform a risk assessment on the new technology.
D . Review industry specialists’ analyses of the new standard.

Reveal Solution Hide Solution

Question #5

Which of the following is MOST important for the effective implementation of an information

security governance program?

A . Employees receive customized information security training
B . The program budget is approved and monitored by senior management
C . The program goals are communicated and understood by the organization.
D . Information security roles and responsibilities are documented.

Reveal Solution Hide Solution

Question #6

During the implementation of a new system, which of the following processes proactively minimizes the likelihood of disruption, unauthorized alterations, and errors?