Free ISACA CISM Practice Exams - Page 5 of 83

Question #41

Which of the following should have the MOST influence on an organization’s response to a new industry regulation?

A . The organization’s control objectives
B . The organization’s risk management framework
C . The organization’s risk appetite
D . The organization’s risk control baselines

Question #42

Data entry functions for a web-based application have been outsourced to a third-party service provider who will work from a remote site.

Which of the following issues would be of GREATEST concern to an information security manager?

A . The application does not use a secure communications protocol
B . The application is configured with restrictive access controls
C . The business process has only one level of error checking
D . Server-based malware protection is not enforced

Reveal Solution Hide Solution

Question #43

Which of the following MUST be established to maintain an effective information security governance framework?

A . Security controls automation
B . Defined security metrics
C . Change management processes
D . Security policy provisions

Reveal Solution Hide Solution

Question #44

An information security team plans to strengthen authentication requirements for a customer-facing site, but there are concerns it will negatively impact the user experience.

Which of the following is the information security manager’s BEST course of action?

A . Assess business impact against security risk.
B . Provide security awareness training to customers.
C . Refer to industry best practices.
D . Quantify the security risk to the business.

Reveal Solution Hide Solution

Question #45

Internal audit has reported a number of information security issues that are not in compliance with regulatory requirements.

What should the information security manager do FIRST?

A . Create a security exception.
B . Perform a gap analysis to determine needed resources.
C . Perform a vulnerability assessment.
D . Assess the risk to business operations.

Reveal Solution Hide Solution

Question #46

Which of the following is the MOST important benefit of using a cloud access security broker when migrating to a cloud environment?

A . Enhanced data governance
B . Increased third-party assurance
C . Improved incident management
D . Reduced total cost of ownership (TCO)

Reveal Solution Hide Solution

Question #47

Which of the following is an information security manager’s BEST course of action when a threat intelligence report indicates a large number of ransomware attacks targeting the industry?

A . Increase the frequency of system backups.
B . Review the mitigating security controls.
C . Notify staff members of the threat.
D . Assess the risk to the organization.

Reveal Solution Hide Solution

Correct Answer: D
D

Explanation:

The best course of action for an information security manager when a threat intelligence report indicates a large number of ransomware attacks targeting the industry is to assess the risk to the organization. This means evaluating the likelihood and impact of a potential ransomware attack on the organization’s assets, operations, and reputation, based on the current threat landscape, the organization’s security posture, and the effectiveness of the existing security controls. A risk assessment can help the information security manager prioritize the most critical assets and processes, identify the gaps and weaknesses in the security architecture, and determine the appropriate risk response strategies, such as avoidance, mitigation, transfer, or acceptance. A risk assessment can also provide a business case for requesting additional resources or support from senior management to improve the organization’s security resilience and readiness. The other options are not the best course of action because they are either too reactive or too narrow in scope. Increasing the frequency of system backups (A) is a good practice to ensure data availability and recovery in case of a ransomware attack, but it does not address the prevention or detection of the attack, nor does it consider the potential data breach or extortion that may accompany the attack. Reviewing the mitigating security controls (B) is a part of the risk assessment process, but it is not sufficient by itself. The information security manager should also consider the threat sources, the vulnerabilities, the impact, and the risk appetite of the organization. Notifying staff members of the threat © is a useful awareness and education measure, but it should be done after the risk assessment and in conjunction with other security policies and procedures. Staff members should be informed of the potential risks, the indicators of compromise, the reporting mechanisms, and the best practices to avoid or respond to a ransomware attack.

Reference = CISM Review Manual 2022, pages 77-78, 81-82, 316; CISM Item Development Guide 2022, page 9; #StopRansomware Guide | CISA; [The Human Consequences of Ransomware Attacks – ISACA]; [Ransomware Response, Safeguards and Countermeasures – ISACA]

Question #48

Which of the following roles is accountable for ensuring the impact of a new regulatory framework on a business system is assessed?

A . Senior management
B . Application owner
C . Information security manager
D . Legal representative

Reveal Solution Hide Solution

Question #49

To help ensure that an information security training program is MOST effective its contents should be

A . focused on information security policy.
B . aligned to business processes
C . based on employees’ roles
D . based on recent incidents

Reveal Solution Hide Solution

Question #50

Which of the following BEST indicates the effectiveness of a recent information security awareness campaign delivered across the organization?

A . Decrease in the number of security incidents
B . Increase in the frequency of security incident escalations
C . Reduction in the impact of security incidents
D . Increase in the number of reported security incidents

Reveal Solution Hide Solution