Shortly after installation, an intrusion detection system (IDS) reports a violation. Which of the following is theMOST likely ?
Answer(s): A
Which of the following provides the GREATEST assurance that information security is addressed in change management?
Answer(s): D
Who would be in the BEST position to determine the recovery point objective (RPO) for business applications?
Answer(s): B
The recovery point objective (RPO) is the processing checkpoint to which systems are recovered. In addition to data owners, the chief operations officer (COO) is the most knowledgeable person to make this decision. It would be inappropriate for the information security manager or an internal audit to determine the RPO because they are not directly responsible for the data or the operation.
Which two components PRIMARILY must be assessed in an effective risk analysis?
The probability or likelihood of the event and the financial impact or magnitude of the event must be assessed first. Duration refers to the length of the event; it is important in order to assess impact but is secondary. Once the likelihood is determined, the frequency is also important to determine overall impact.
Information security managers should use risk assessment techniques to:
Information security managers should use risk assessment techniques to justify and implement a risk mitigation strategy as efficiently as possible. None of the other choices accomplishes that task, although they are important components.
Post your Comments and Discuss ISACA CISM exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CISM content, but please register or login to continue.