QUESTION: 13

The cost of implementing a security control should not exceed the:

annualized loss expectancy.
cost of an incident.
asset value.
implementation opportunity costs.

Answer(s): C

Explanation:

The cost of implementing security controls should not exceed the worth of the asset. Annualized loss expectancy represents the losses drat are expected to happen during a single calendar year. A security mechanism may cost more than this amount (or the cost of a single incident) and still be considered cost effective. Opportunity costs relate to revenue lost by forgoing the acquisition of an item or the making of a business decision.

Show Answer Next Question

QUESTION: 14

When a security standard conflicts with a business objective, the situation should be resolved by:

changing the security standard.
changing the business objective.
performing a risk analysis.
authorizing a risk acceptance.

Answer(s): C

Explanation:

Conflicts of this type should be based on a risk analysis of the costs and benefits of allowing or disallowing an exception to the standard. It is highly improbable that a business objective could be changed to accommodate a security standard, while risk acceptance* is a process that derives from the risk analysis.

Show Answer Next Question

QUESTION: 15

Minimum standards for securing the technical infrastructure should be defined in a security:

strategy.
guidelines.
model.
architecture.

Answer(s): D

Explanation:

Minimum standards for securing the technical infrastructure should be defined in a security architecture document. This document defines how components are secured and the security services that should be in place. A strategy is a broad, high-level document. A guideline is advisory in nature, while a security model shows the relationships between components.

Show Answer Next Question

QUESTION: 16

Which of the following is MOST appropriate for inclusion in an information security strategy?

Business controls designated as key controls
Security processes, methods, tools and techniques
Firewall rule sets, network defaults and intrusion detection system (IDS) settings
Budget estimates to acquire specific security tools

Answer(s): B

Explanation:

A set of security objectives, processes, methods, tools and techniques together constitute a security strategy. Although IT and business governance are intertwined, business controls may not be included in a security strategy. Budgets will generally not be included in an information security strategy. Additionally, until information security strategy is formulated and implemented, specific tools will not be identified and specific cost estimates will not be available. Firewall rule sets, network defaults and intrusion detection system (IDS) settings are technical details subject to periodic change, and are not appropriate content for a strategy document.

Show Answer Next Question

Free ISACA CISM Exam Questions (page: 5)

QUESTION: 13

Explanation:

QUESTION: 14

Explanation:

QUESTION: 15

Explanation:

QUESTION: 16

Explanation:

CISM Exam Discussions & Posts