Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  2. Home
  3. Exams
  4. ISACA
  5. CISM

ISACA CISM Exam Questions
Certified Information Security Manager (Page 26 )

Updated On: 17-Feb-2026
Page 26 of 345
PDF with 1716 Questions

Which of the following is a benefit of information security governance?

  1. Reduction of the potential for civil or legal liability
  2. Questioning trust in vendor relationships
  3. Increasing the risk of decisions based on incomplete management information
  4. Direct involvement of senior management in developing control processes

Answer(s): A

Explanation:

Information security governance decreases the risk of civil or legal liability. The remaining answers are incorrect. Option D appears to be correct, but senior management would provide oversight and approval as opposed to direct involvement in developing control processes.



Investment in security technology and processes should be based on:

  1. clear alignment with the goals and objectives of the organization.
  2. success cases that have been experienced in previous projects.
  3. best business practices.
  4. safeguards that are inherent in existing technology.

Answer(s): A

Explanation:

Organization maturity level for the protection of information is a clear alignment with goals and objectives of the organization. Experience in previous projects is dependent upon other business models which may not be applicable to the current model. Best business practices may not be applicable to the organization's businessneeds. Safeguards inherent to existing technology are low cost but may not address all business needs and/or goals of the organization.



The data access requirements for an application should be determined by the:

  1. legal department.
  2. compliance officer.
  3. information security manager.
  4. business owner.

Answer(s): D

Explanation:

Business owners are ultimately responsible for their applications. The legal department, compliance officer and information security manager all can advise, but do not have final responsibility.



From an information security perspective, information that no longer supports the main purpose of the business should be:

  1. analyzed under the retention policy.
  2. protected under the information classification policy.
  3. analyzed under the backup policy.
  4. protected under the business impact analysis (BIA).

Answer(s): A

Explanation:

Option A is the type of analysis that will determine whether the organization is required to maintain the data for business, legal or regulatory reasons. Keeping data that are no longer required unnecessarily consumes resources, and, in the case of sensitive personal information, can increase the risk of data compromise.
Options B. C and D are attributes that should be considered in the destruction and retention policy. A BIA could help determine that this information does not support the main objective of the business, but does not indicate the action to take.



The organization has decided to outsource the majority of the IT department with a vendor that is hosting servers in a foreign country. Of the following, which is the MOST critical security consideration?

  1. Laws and regulations of the country of origin may not be enforceable in the foreign country.
  2. A security breach notification might get delayed due to the time difference.
  3. Additional network intrusion detection sensors should be installed, resulting in an additional cost.
  4. The company could lose physical control over the server and be unable to monitor the physical security posture of the servers.

Answer(s): A

Explanation:

A company is held to the local laws and regulations of the country in which the company resides, even if the company decides to place servers with a vendor that hosts the servers in a foreign country. A potential violation of local laws applicable to the company might not be recognized or rectified (i.e., prosecuted) due to the lack of knowledge of the local laws that are applicable and the inability to enforce the laws. Option B is not a problem. Time difference does not play a role in a 24/7 environment. Pagers, cellular phones, telephones, etc. are usually available to communicate notifications. Option C is a manageable problem that requires additional funding, but can be addressed. Option D is a problem that can be addressed. Most hosting providers have standardized the level of physical security that is in place. Regular physical audits or a SAS 70 report can address such concerns.






Post your Comments and Discuss ISACA CISM exam dumps with other Community members:

Join the CISM Discussion