Cisco®
Oracle
CompTIA
Checkpoint
ISC
EC-Council
EXIN
Fortinet
ITIL®
Juniper
Microsoft
VMware
Avaya
SAP
Google
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk®
All Vendors
  2. Home
  3. Exams
  4. ISACA
  5. CISM

Free ISACA CISM Exam Braindumps (page: 73)

Page 73 of 430
PDF with 1716 Questions

When a significant security breach occurs, what should be reported FIRST to senior management?

  1. A summary of the security logs that illustrates the sequence of events
  2. An of the incident and corrective action taken
  3. An analysis of the impact of similar attacks at other organizations
  4. A business case for implementing stronger logical access controls

Answer(s): B

Explanation:

When reporting an incident to senior management, the initial information to be communicated should include an of what happened and how the breach was resolved. A summary of security logs would be too technical to report to senior management. An analysis of the impact of similar attacks and a business case for improving controls would be desirable; however, these would be communicated later in the process.



The PRIMARY reason for initiating a policy exception process is when:

  1. operations are too busy to comply.
  2. the risk is justified by the benefit.
  3. policy compliance would be difficult to enforce.
  4. users may initially be inconvenienced.

Answer(s): B

Explanation:

Exceptions to policy are warranted in circumstances where compliance may be difficult or impossible and the risk of noncompliance is outweighed by the benefits. Being busy is not a justification for policy exceptions, nor is the fact that compliance cannot be enforced. User inconvenience is not a reason to automatically grant exception to a policy.



Which of (lie following would be the MOST relevant factor when defining the information classification policy?

  1. Quantity of information
  2. Available IT infrastructure
  3. Benchmarking
  4. Requirements of data owners

Answer(s): D

Explanation:

When defining the information classification policy, the requirements of the data owners need to be identified. The quantity of information, availability of IT infrastructure and benchmarking may be part of the scheme after the fact and would be less relevant.



To determine the selection of controls required to meet business objectives, an information security manager should:

  1. prioritize the use of role-based access controls.
  2. focus on key controls.
  3. restrict controls to only critical applications.
  4. focus on automated controls.

Answer(s): B

Explanation:

Key controls primarily reduce risk and are most effective for the protection of information assets. The other choices could be examples of possible key controls.



Viewing page 73 of 430
Viewing questions 289 - 292 out of 1716 questions



Post your Comments and Discuss ISACA CISM exam prep with other Community members:

CISM Exam Discussions & Posts