Free CISM Exam Braindumps
Certified Information Security Manager Questions 601–605 (page: 122)

Updated On: 10-Feb-2026

When contracting with an outsourcer to provide security administration, the MOST important contractual element is the:

  1. right-to-terminate clause.
  2. limitations of liability.
  3. service level agreement (SLA).
  4. financial penalties clause.

Answer(s): C

Explanation:

Service level agreements (SLAs) provide metrics to which outsourcing firms can be held accountable. This is more important than a limitation on the outsourcing firm's liability, a right-to-terminate clause or a hold- harmless agreement which involves liabilities to third parties.



A third-party service provider is developing a mobile app for an organization’s customers.

Which of the following issues should be of GREATEST concern to the information security manager?

  1. Software escrow is not addressed in the contract.
  2. The contract has no requirement for secure development practices.
  3. The mobile app’s programmers are all offshore contractors.
  4. SLAs after deployment are not clearly defined.

Answer(s): B



Implementing a strong password policy is part of an organization’s information security strategy for the year. A business unit believes the strategy may adversely affect a client’s adoption of a recently developed mobile application and has decided not to implement the policy.

Which of the following is the information security manager’s BEST course of action?

  1. Analyze the risk and impact of not implementing the policy.
  2. Develop and implement a password policy for the mobile application.
  3. Escalate non-implementation of the policy to senior management.
  4. Benchmark with similar mobile applications to identify gaps.

Answer(s): C



Which of the following would BEST enable an organization to effectively monitor the implementation of standardized configurations?

  1. Implement a separate change tracking system to record changes to configurations.
  2. Perform periodic audits to detect non-compliant configurations.
  3. Develop policies requiring use of the established benchmarks.
  4. Implement automated scanning against the established benchmarks.

Answer(s): D



Which of the following should be the information security manager’s NEXT step following senior management approval of the information security strategy?

  1. Develop a security policy.
  2. Develop a budget.
  3. Perform a gap analysis.
  4. Form a steering committee.

Answer(s): A



Viewing page 122 of 345
Viewing questions 606 - 610 out of 1716 questions


Post your Comments and Discuss ISACA CISM exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!