CISM (CISM) ISACA 5

Question 1

An information security manager is asked to justify a proposed security investment to the CFO. The MOST persuasive approach is to:

Accepted Answer

Quantify the risk reduction in terms of business impact and financial exposure

Answer

Quantifying risk reduction in financial terms connects security investment to business value in language that resonates with financial decision-makers.

Question 2

Which of the following BEST describes a gap analysis in the context of information security program development?

Accepted Answer

A comparison of current security capabilities against a target state or framework

Answer

A gap analysis measures the difference between the current security state and a desired future state or framework, identifying what needs to be built or improved.

Question 3

When an employee is terminated, the MOST critical immediate security action is:

Accepted Answer

Revoking all logical access to systems and data

Answer

Revoking logical access immediately prevents a departing employee from accessing, exfiltrating, or damaging organizational systems or data.

Question 4

The concept of 'defense in depth' is BEST described as:

Accepted Answer

Layering multiple independent security controls so that failure of one does not compromise overall security

Answer

Defense in depth uses multiple layers of controls so that an attacker who bypasses one layer still faces additional barriers before reaching a target.

Question 5

During a business continuity exercise, the recovery team is unable to restore a critical system within the defined RTO. The BEST immediate action for the information security manager is to:

Accepted Answer

Document the failure and update the BCP based on lessons learned

Answer

Exercises are learning opportunities — documenting gaps and updating the BCP to address them is the constructive response that improves actual recovery capability.

CISM - Certified Information Security Manager Practice Test

CISM - Certified Information Security Manager Practice Test

CISM (CISM) ISACA 5