CISM (CISM) ISACA 4

Question 1

A penetration test reveals a critical vulnerability in a production system. The system owner refuses to patch it due to potential downtime. The information security manager should:

Accepted Answer

Document the risk and escalate to senior management for a formal risk acceptance decision

Answer

Risk acceptance decisions for critical vulnerabilities must be made by appropriate senior stakeholders with authority, not left to system owners or security managers alone.

Question 2

The CISM job practice area that involves identifying and managing information security risks is:

Accepted Answer

Information Security Risk Management

Answer

Information Security Risk Management is the CISM domain specifically focused on identifying, assessing, and managing information security risks.

Question 3

When developing key risk indicators (KRIs), the information security manager should ensure they are:

Accepted Answer

Predictive and aligned to risk appetite thresholds

Answer

Effective KRIs provide early warning signals of emerging risk and are tied to the organization's defined risk appetite so management can act before thresholds are breached.

Question 4

An organization is merging with another company. The MOST important information security consideration during due diligence is:

Accepted Answer

Assessing the target company's security posture and existing vulnerabilities

Answer

Assessing the target's security posture identifies inherited risks, liabilities, and compliance gaps that could affect the acquiring organization after the merger.

Question 5

Which of the following is the MOST important characteristic of an effective information security policy?

Accepted Answer

It is approved by senior management and communicated to all staff

Answer

Senior management approval provides authority and accountability, while communication to all staff ensures awareness — both are essential for policy effectiveness.

CISM - Certified Information Security Manager Practice Test

CISM - Certified Information Security Manager Practice Test

CISM (CISM) ISACA 4