(CISM) Flashcards

A newly appointed CISM is reviewing the organization's information security governance structure. Which of the following BEST demonstrates effective governance?

Answer: The board of directors receives regular security risk reports

Effective governance requires board-level oversight and accountability, including regular reporting on security risks.

During a risk assessment, an organization identifies a threat with a high likelihood but low impact. What is the MOST appropriate risk treatment?

Answer: Implement controls proportional to the risk level

Controls should be implemented proportional to the overall risk level, balancing likelihood and impact considerations.

An organization is developing its information security strategy. Which factor is MOST critical to align the strategy with business objectives?

Answer: Understanding the organization's risk appetite and business goals

Security strategy must be grounded in the organization's risk appetite and specific business objectives to be effective.

Which metric BEST demonstrates the effectiveness of a security awareness training program?

Answer: Reduction in phishing click rates after training

Behavioral change metrics like reduced phishing click rates directly measure training effectiveness rather than just participation.

A third-party vendor with access to sensitive customer data has suffered a breach. What should the information security manager do FIRST?

Answer: Assess the impact on the organization and notify affected parties per policy

The immediate priority is assessing organizational impact and fulfilling notification obligations per policy and regulatory requirements.

Which of the following is the PRIMARY purpose of a business impact analysis (BIA) in the context of information security?

Answer: To identify critical processes and the impact of their disruption

A BIA identifies critical business processes, their dependencies, and the consequences of disruption to prioritize recovery efforts.

An organization wants to validate its incident response capabilities. Which approach provides the MOST realistic assessment?

Answer: Performing a full simulation (red team) exercise without prior notice

Unannounced red team exercises provide the most realistic test of actual incident response capability under realistic conditions.