Free CISM Exam Braindumps
Certified Information Security Manager Questions 556–560 (page: 113)

Updated On: 10-Feb-2026

Which of the following is an important criterion for developing effective key risk indicators (KRIs) to monitor information security risk?

  1. The indicator should possess a high correlation with a specific risk and be measured on a regular basis.
  2. The indicator should focus on IT and accurately represent risk variances.
  3. The indicator should align with key performance indicators and measure root causes of process performance issues.
  4. The indicator should provide a retrospective view of risk impacts and be measured annually.

Answer(s): A



When implementing security architecture, an information security manager MUST ensure that security controls:

  1. form multiple barriers against threats.
  2. are transparent.
  3. are the least expensive.
  4. are communicated through security policies.

Answer(s): A



An information security manager is reviewing the business case for a security project that is entering the development phase. It is determined that the estimated cost of the controls is now greater than the risk being mitigated.

The information security manager’s BEST recommendation would be to:

  1. eliminate some of the controls from the project scope.
  2. discontinue the project to release funds for other efforts.
  3. pursue the project until the benefits cover the costs.
  4. slow the pace of the project to spread costs over a longer period.

Answer(s): A



The chief information security officer (CISO) has developed an information security strategy, but is struggling to obtain senior management commitment for funds to implement the strategy.

Which of the following is the MOST likely reason?

  1. The strategy does not include a cost-benefit analysis.
  2. The CISO reports to the CIO.
  3. There was a lack of engagement with the business during development.
  4. The strategy does not comply with security standards.

Answer(s): A



An organization wants to enable digital forensics for a business-critical application. Which of the following will
BEST help to support this objective?

  1. Install biometric access control.
  2. Develop an incident response plan.
  3. Define data retention criteria.
  4. Enable activity logging.

Answer(s): D



Viewing page 113 of 345
Viewing questions 561 - 565 out of 1716 questions


Post your Comments and Discuss ISACA CISM exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!