Free ISACA CISM Practice Exams - Page 2 of 83

Question #11

An information security manager believes that information has been classified inappropriately, = the risk of a breach.

Which of the following is the information security manager’s BEST action?

A . Refer the issue to internal audit for a recommendation.
B . Re-classify the data and increase the security level to meet business risk.
C . Instruct the relevant system owners to reclassify the data.
D . Complete a risk assessment and refer the results to the data owners.

Reveal Solution Hide Solution

Correct Answer: D
D

Explanation:

= Information classification is the process of assigning appropriate labels to information assets based on their sensitivity and value to the organization. Information classification should be aligned with the business objectives and risk appetite of the organization, and should be reviewed periodically to ensure its accuracy and relevance. The information security manager is responsible for establishing and maintaining the information classification policy and procedures, as well as providing guidance and oversight to the data owners and custodians. Data owners are the individuals who have the authority and accountability for the information assets within their business unit or function. Data owners are responsible for determining the appropriate classification level and security controls for their information assets, as well as ensuring compliance with the information classification policy and procedures. Data custodians are the individuals who have the operational responsibility for implementing and maintaining the security controls for the information assets assigned to them by the data owners.

If the information security manager believes that information has been classified inappropriately, increasing the risk of a breach, the best action is to complete a risk assessment and refer the results to the data owners. A risk assessment is a systematic process of identifying, analyzing, and evaluating the risks associated with the information assets, and recommending appropriate risk treatment options. By conducting a risk assessment, the information security manager can provide objective and evidence-based information to the data owners, highlighting the potential impact and likelihood of a breach, as well as the cost and benefit of implementing additional security controls. This will enable the data owners to make informed decisions about the appropriate classification level and security controls for their information assets, and to justify and document any deviations from the information classification policy and procedures.

The other options are not the best actions for the information security manager. Refering the issue to internal audit for a recommendation is not the best action, because internal audit is an independent and objective assurance function that provides assurance on the effectiveness of governance, risk management, and control processes. Internal audit is not responsible for providing recommendations on information classification, which is a management responsibility. Re-classifying the data and increasing the security level to meet business risk is not the best action, because the information security manager does not have the authority or accountability for the information assets, and may not have the full understanding of the business context and objectives of the data owners. Instructing the relevant system owners to reclassify the data is not the best action, because system owners are not the same as data owners, and may not have the authority or accountability for the information assets either. System owners are the individuals who have the authority and accountability for the information systems that process, store, or transmit the information assets. System owners are responsible for ensuring that the information systems comply with the security requirements and controls defined by the data owners and the information security

manager.

Reference = CISM Review Manual, 16th Edition, ISACA, 2020, pp. 49-51, 63-64, 69-701; CISM Online Review Course, Domain 3: Information Security Program Development and Management, Module 2: Information Security Program Framework, ISACA2

Question #12

Which of the following is the MOST important consideration when briefing executives about the current state of the information security program?

A . Including a situational forecast
B . Using appropriate language for the target audience
C . Including trend charts for metrics
D . Using a rating system to demonstrate program effectiveness

Reveal Solution Hide Solution

Question #13

Which or the following is MOST important to consider when determining backup frequency?

A . Recovery point objective (RPO)
B . Recovery time objective (RTO)
C . Allowable interruption window
D . Maximum tolerable outage (MTO)

Reveal Solution Hide Solution

Question #14

Which of the following BEST describes a buffer overflow?

A . A function is carried out with more data than the function can handle
B . A program contains a hidden and unintended function that presents a security risk
C . Malicious code designed to interfere with normal operations
D . A type of covert channel that captures data

Reveal Solution Hide Solution

Question #15

Which of the following should be the FIRST step when performing triage of a malware incident?

A . Containing the affected system
B . Preserving the forensic image
C . Comparing backup against production
D . Removing the malware

Reveal Solution Hide Solution

Question #16

Which of the following should be an information security manager s MOST important consideration when determining the priority for implementing security controls?

A . Alignment with industry benchmarks
B . Results of business impact analyses (BIAs)
C . Possibility of reputational loss due to incidents
D . Availability of security budget

Reveal Solution Hide Solution

Question #17

Which of the following BEST facilitates effective incident response testing?

A . Including all business units in testing
B . Simulating realistic test scenarios
C . Reviewing test results quarterly
D . Testing after major business changes

Reveal Solution Hide Solution

Question #18

A penetration test against an organization’s external web application shows several vulnerabilities.

Which of the following presents the GREATEST concern?

A . A rules of engagement form was not signed prior to the penetration test
B . Vulnerabilities were not found by internal tests
C . Vulnerabilities were caused by insufficient user acceptance testing (UAT)
D . Exploit code for one of the vulnerabilities is publicly available

Reveal Solution Hide Solution

Question #19

An information security manager has been notified about a compromised endpoint device.

Which of the following is the BEST course of action to prevent further damage?

A . Wipe and reset the endpoint device.
B . Isolate the endpoint device.
C . Power off the endpoint device.
D . Run a virus scan on the endpoint device.

Reveal Solution Hide Solution

Question #20

The MAIN reason for having senior management review and approve an information security strategic plan is to ensure:

A . the organization has the required funds to implement the plan.
B . compliance with legal and regulatory requirements.
C . staff participation in information security efforts.
D . the plan aligns with corporate governance.

Reveal Solution Hide Solution