CISM (CISM) ISACA 2

Question 1

A newly appointed information security manager discovers that business units independently procure cloud services without IT involvement. What is the BEST first step?

Accepted Answer

Establish a cloud governance policy with business stakeholder input

Answer

Establishing a cloud governance policy with stakeholder input addresses the root cause by creating an approved framework rather than reacting punitively.

Question 2

Which metric BEST demonstrates the effectiveness of a security awareness training program?

Accepted Answer

Reduction in phishing click rates over time

Answer

A reduction in phishing click rates is a measurable behavioral outcome that directly reflects whether training changed employee actions.

Question 3

An organization's risk appetite statement should be approved by:

Accepted Answer

The board of directors or executive leadership

Answer

Risk appetite is a strategic business decision that must be set and approved at the board or executive level to align with organizational objectives.

Question 4

When a critical vulnerability is discovered in a vendor-supplied application, the information security manager should FIRST:

Accepted Answer

Assess the risk and determine interim mitigating controls

Answer

Assessing risk and implementing interim controls allows the organization to make an informed decision about continued operation while a permanent fix is developed.

Question 5

The PRIMARY purpose of a business impact analysis (BIA) in the context of information security is to:

Accepted Answer

Determine the criticality of systems and acceptable recovery times

Answer

A BIA identifies which systems are critical to business operations and establishes RTO and RPO targets to guide recovery planning.

CISM - Certified Information Security Manager Practice Test

CISM - Certified Information Security Manager Practice Test

CISM (CISM) ISACA 2