CompTIA
Checkpoint
ISC
HP
Dell
EC-Council
EXIN
Fortinet
ITIL®
Juniper
PMI
Microsoft
VMware
Avaya
Google
Salesforce
Amazon
Palo Alto Networks
Certiport
ISC2
All Vendors
  2. Home
  3. Exams
  4. ISACA
  5. CISM

Free CISM Exam Braindumps (page: 32)

Page 32 of 430
PDF with 1716 Questions

Which of the following is a benefit of information security governance?

  1. Reduction of the potential for civil or legal liability
  2. Questioning trust in vendor relationships
  3. Increasing the risk of decisions based on incomplete management information
  4. Direct involvement of senior management in developing control processes

Answer(s): A

Explanation:

Information security governance decreases the risk of civil or legal liability. The remaining answers are incorrect. Option D appears to be correct, but senior management would provide oversight and approval as opposed to direct involvement in developing control processes.



Investment in security technology and processes should be based on:

  1. clear alignment with the goals and objectives of the organization.
  2. success cases that have been experienced in previous projects.
  3. best business practices.
  4. safeguards that are inherent in existing technology.

Answer(s): A

Explanation:

Organization maturity level for the protection of information is a clear alignment with goals and objectives of the organization. Experience in previous projects is dependent upon other business models which may not be applicable to the current model. Best business practices may not be applicable to the organization's businessneeds. Safeguards inherent to existing technology are low cost but may not address all business needs and/or goals of the organization.



The data access requirements for an application should be determined by the:

  1. legal department.
  2. compliance officer.
  3. information security manager.
  4. business owner.

Answer(s): D

Explanation:

Business owners are ultimately responsible for their applications. The legal department, compliance officer and information security manager all can advise, but do not have final responsibility.



From an information security perspective, information that no longer supports the main purpose of the business should be:

  1. analyzed under the retention policy.
  2. protected under the information classification policy.
  3. analyzed under the backup policy.
  4. protected under the business impact analysis (BIA).

Answer(s): A

Explanation:

Option A is the type of analysis that will determine whether the organization is required to maintain the data for business, legal or regulatory reasons. Keeping data that are no longer required unnecessarily consumes resources, and, in the case of sensitive personal information, can increase the risk of data compromise.
Options B. C and D are attributes that should be considered in the destruction and retention policy. A BIA could help determine that this information does not support the main objective of the business, but does not indicate the action to take.






Post your Comments and Discuss ISACA CISM exam with other Community members:

CISM Exam Discussions & Posts