CISM (CISM) 3

Question 1

A CISM is presenting the security program's value to executive leadership. Which approach is MOST effective?

Accepted Answer

Present security metrics tied to business risk reduction and outcomes

Answer

Executive leadership responds best to security metrics framed in terms of business risk reduction and organizational outcomes.

Question 2

Which of the following is the MOST important characteristic of an effective information security policy?

Accepted Answer

It is approved by senior management and aligned to business objectives

Answer

Policies derive their authority and effectiveness from senior management approval and alignment with business goals.

Question 3

During a penetration test, a critical vulnerability is discovered in a production system. What should the information security manager do FIRST?

Accepted Answer

Assess the risk and notify appropriate stakeholders per the established process

Answer

Risk assessment and stakeholder notification per established processes ensure coordinated and appropriate response to discovered vulnerabilities.

Question 4

What is the PRIMARY difference between a recovery time objective (RTO) and a recovery point objective (RPO)?

Accepted Answer

RTO measures how quickly systems must be restored; RPO measures acceptable data loss

Answer

RTO defines the maximum acceptable downtime for system recovery, while RPO defines the maximum acceptable data loss measured in time.

Question 5

An organization is adopting a cloud-first strategy. What is the MOST important security consideration the CISM should address?

Accepted Answer

Defining shared responsibility boundaries between the organization and cloud provider

Answer

Clearly defining the shared responsibility model ensures neither the organization nor the provider has unaddressed security gaps.

CISM - Certified Information Security Manager Practice Test