Free CISM Exam Braindumps
Certified Information Security Manager Questions 586–590 (page: 119)

Updated On: 10-Feb-2026

Authorization can BEST be accomplished by establishing:

  1. the ownership of the data.
  2. what users can do when they are granted system access.
  3. whether users are who they say they are.
  4. how users identify themselves to information systems.

Answer(s): B



Which of the following would provide the MOST effective security outcome in an organization’s contract management process?

  1. Extending security assessment to include random penetration testing
  2. Extending security assessment to cover asset disposal on contract termination
  3. Performing vendor security benchmark analyses at the request-for-proposal (RFP) stage
  4. Ensuring security requirements are defined at the request-for-proposal (RFP) stage

Answer(s): C



An organization’s outsourced firewall was poorly configured and allowed unauthorized access that resulted in downtime of 48 hours. Which of the following should be the information security manager’s NEXT course of action?

  1. Reconfigure the firewall in accordance with best practices.
  2. Obtain supporting evidence that the problem has been corrected.
  3. Revisit the contract and improve accountability of the service provider.
  4. Seek damages from the service provider.

Answer(s): B



The PRIMARY advantage of involving end users in continuity planning is that they:

  1. are more objective than information security management.
  2. can balance the technical and business risks.
  3. have a better understanding of specific business needs.
  4. can see the overall impact to the business.

Answer(s): B



Who can BEST advocate the development of and ensure the success of an information security program?

  1. Internal auditor
  2. Chief operating officer (COO)
  3. Steering committee
  4. IT management

Answer(s): C

Explanation:

Senior management represented in the security steering committee is in the best position to advocate the establishment of and continued support for an information security program. The chief operating officer (COO) will be a member of that committee. An internal auditor is a good advocate but is secondary to the influence of senior management. IT management has a lesser degree of influence and would also be part of the steering committee.



Viewing page 119 of 345
Viewing questions 591 - 595 out of 1716 questions


Post your Comments and Discuss ISACA CISM exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!