QUESTION: 173

Which of the following is a PRIMARY responsibility of an information security governance committee?

Analyzing information security policy compliance reviews
Approving the purchase of information security technologies
Reviewing the information security strategy
Approving the information security awareness training strategy

Answer(s): C

An information security manager discovers that the organization’s new information security policy is not being followed across all departments. Which of the following should be of GREATEST concern to the information security manager?

Different communication methods may be required for each business unit.
Business unit management has not emphasized the importance of the new policy.
The corresponding controls are viewed as prohibitive to business operations.
The wording of the policy is not tailored to the audience.

Answer(s): C

Show Answer Next Question

QUESTION: 175

An organization has detected potential risk emerging from noncompliance with new regulations in its industry. Which of the following is the MOST important reason to report this situation to senior management?

The risk profile needs to be updated.
An external review of the risk needs to be conducted.
Specific monitoring controls need to be implemented.
A benchmark analysis needs to be performed.

Answer(s): A

Show Answer Next Question

QUESTION: 176

Which of the following is the BEST way for an information security manager to identify compliance with information security policies within an organization?

Analyze system logs.
Conduct security awareness testing.
Perform vulnerability assessments.
Conduct periodic audits.

Answer(s): D

Show Answer Next Question

Free ISACA CISM Exam Braindumps (page: 45)

QUESTION: 173

QUESTION: 174

QUESTION: 175

QUESTION: 176

CISM Exam Discussions & Posts