QUESTION: 241

What is the PRIMARY objective of assigning classifications to information assets?

Identify appropriate levels of protection.
Identify business owners and information custodians.
Demonstrate compliance with regulatory requirements.
Maintain an accurate IT asset inventory.

Answer(s): A

An organization engages a third-party vendor to monitor and support a financial application under scrutiny by regulators. Maintaining strict data integrity and confidentiality for this application is critical to the business.
Which of the following controls would MOST effectively manage risk to the organization?

Implementing segregation of duties between systems and data
Activating access and data logging
Disabling vendor access and only re-enabling when access is needed
Implementing periodic access reviews of vendor employees

Answer(s): B

Show Answer Next Question

QUESTION: 243

A regulatory compliance issue has been identified in a critical business application, but remediating the issue would significantly impact business operations. What information would BEST enable senior management to make an informed decision?

Impact analysis and treatment options
Costs associated with compensating controls
Industry benchmarks and best practices
Risk assessment results and recommendations

Answer(s): A

Show Answer Next Question

QUESTION: 244

Which of the following is the BEST method for management to obtain assurance of compliance with its security policy?

Review security incident logs.
Train staff on their compliance responsibilities.
Conduct regular independent reviews.
Questionstaff concerning their security duties.

Answer(s): C

Show Answer Next Question

Free ISACA CISM Exam Braindumps (page: 62)

QUESTION: 241

QUESTION: 242

QUESTION: 243

QUESTION: 244

CISM Exam Discussions & Posts