Free ISACA CISM Practice Exams - Page 6 of 83

Question #51

Which of the following is the PRIMARY reason to regularly update business continuity and disaster recovery documents?

A . To enforce security policy requirements
B . To maintain business asset inventories
C . To ensure audit and compliance requirements are met
D . To ensure the availability of business operations

Question #52

To inform a risk treatment decision, which of the following should the information security manager compare with the organization’s risk appetite?

A . Gap analysis results
B . Level of residual risk
C . Level of risk treatment
D . Configuration parameters

Reveal Solution Hide Solution

Question #53

When deciding to move to a cloud-based model, the FIRST consideration should be:

A . storage in a shared environment.
B . availability of the data.
C . data classification.
D . physical location of the data.

Reveal Solution Hide Solution

Correct Answer: C
C

Explanation:

The first consideration when deciding to move to a cloud-based model should be data classification, because it helps the organization to identify the sensitivity, value, and criticality of the data that will be stored, processed, or transmitted in the cloud. Data classification can help the organization to determine the appropriate level of protection, encryption, and access control for the data, and to comply with the relevant legal, regulatory, and contractual requirements. Data classification can also help the organization to evaluate the suitability, compatibility, and trustworthiness of the cloud service provider and the cloud service model, and to negotiate the terms and conditions of the cloud service contract.

Storage in a shared environment, availability of the data, and physical location of the data are all important considerations when deciding to move to a cloud-based model, but they are not the first consideration. Storage in a shared environment can affect the security, privacy, and integrity of the data, as the data may be co-located with other customers’ data, and may be subject to unauthorized access, modification, or deletion. Availability of the data can affect the reliability, performance, and continuity of the data, as the data may be inaccessible, corrupted, or lost due to network failures, service outages, or disasters. Physical location of the data can affect the compliance, sovereignty, and jurisdiction of the data, as the data may be stored or transferred across different countries or regions, and may be subject to different laws, regulations, or policies. However, these considerations depend on the data classification, as different types of data may have different levels of risk, impact, and expectation in the cloud environment.

Reference =

ISACA, CISM Review Manual, 16th Edition, 2020, pages 95-96, 99-100, 103-104, 107-108.

ISACA, CISM Review Questions, Answers & Explanations Database, 12th Edition, 2020, question ID 1031.

Question #54

When investigating an information security incident, details of the incident should be shared:

A . widely to demonstrate positive intent.
B . only with management.
C . only as needed,
D . only with internal audit.

Reveal Solution Hide Solution

Question #55

While responding to a high-profile security incident, an information security manager observed several deficiencies in the current incident response plan.

When would be the BEST time to update the plan?

A . While responding to the incident
B . During a tabletop exercise
C . During post-incident review
D . After a risk reassessment

Reveal Solution Hide Solution

Question #56

Which of the following should be the MOST important consideration of business continuity management?

A . Ensuring human safety
B . Identifying critical business processes
C . Ensuring the reliability of backup data
D . Securing critical information assets

Reveal Solution Hide Solution

Question #57

An information security program is BEST positioned for success when it is closely aligned with:

A . information security best practices.
B . recognized industry frameworks.
C . information security policies.
D . the information security strategy.

Reveal Solution Hide Solution

Question #58

Which of the following should be done FIRST when implementing a security program?

A . Perform a risk analysis
B . Implement data encryption.
C . Create an information asset inventory.
D . Determine the value of information assets.

Reveal Solution Hide Solution

Question #59

The use of a business case to obtain funding for an information security investment is MOST effective when the business case:

A . relates the investment to the organization’s strategic plan.
B . translates information security policies and standards into business requirements.
C . articulates management’s intent and information security directives in clear language.
D . realigns information security objectives to organizational strategy.

Reveal Solution Hide Solution

Question #60

An organization wants to integrate information security into its HR management processes.

Which of the following should be the FIRST step?

A . Calculate the return on investment (ROI).
B . Provide security awareness training to HR.
C . Benchmark the processes with best practice to identify gaps.
D . Assess the business objectives of the processes.

Reveal Solution Hide Solution