Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  2. Home
  3. Exams
  4. ISACA
  5. CISM

ISACA CISM Exam Questions
Certified Information Security Manager (Page 42 )

Updated On: 19-Feb-2026
Page 42 of 345
PDF with 1716 Questions

Which of the following is MOST critical for an effective information security governance framework?

  1. Board members are committed to the information security program.
  2. Information security policies are reviewed on a regular basis.
  3. The information security program is continually monitored.
  4. The CIO is accountable for the information security program.

Answer(s): A



Which of the following is MOST important when establishing a successful information security governance framework?

  1. Selecting information security steering committee members
  2. Developing an information security strategy
  3. Determining balanced scorecard metrics for information security
  4. Identifying information security risk scenarios

Answer(s): B



When creating an information security governance program, which of the following will BEST enable the organization to address regulatory compliance requirements?

  1. Guidelines for processes and procedures
  2. A security control framework
  3. An approved security strategy plan
  4. Input from the security steering committee

Answer(s): A



An organization enacted several information security policies to satisfy regulatory requirements. Which of the following situations would MOST likely increase the probability of noncompliance to these requirements?

  1. Inadequate buy-in from system owners to support the policies
  2. Availability of security policy documents on a public website
  3. Lack of training for end users on security policies
  4. Lack of an information security governance framework

Answer(s): A



Which of the following is the BEST evidence that an organization's information security governance framework is effective?

  1. Threats to the organization have diminished.
  2. The risk register is reviewed annually.
  3. The framework focuses primarily on technical controls.
  4. The framework can adapt to organizational changes.

Answer(s): A






Post your Comments and Discuss ISACA CISM exam dumps with other Community members:

Join the CISM Discussion