Welcome to download the Newest 2passeasy CISM dumps

https://www.2passeasy.com/dumps/CISM/ (415 New Questions)

Exam Questions CISM

Certified Information Security Manager

https://www.2passeasy.com/dumps/CISM/

Passing Certification Exams Made Easy visit - https://www.2PassEasy.com

 Welcome to download the Newest 2passeasy CISM dumps
https://www.2passeasy.com/dumps/CISM/ (415 New Questions)

NEW QUESTION 1
- (Topic 1)
An organization is implementing an information security governance framework. To communicate the program's effectiveness to stakeholders, it is MOST
important to establish:

A. a control self-assessment (CSA) process.

B. automated reporting to stakeholders.
C. a monitoring process for the security policy.
D. metrics for each milestone.

Answer: D

Explanation:
= Establishing metrics for each milestone is the best way to communicate the program’s effectiveness to stakeholders, as it provides a clear and measurable way
to track the progress, performance, and outcomes of the information security governance framework. Metrics are quantifiable indicators that can be used to
evaluate the achievement of specific objectives, goals, or standards. Metrics can also help to demonstrate the value, benefits, and return on investment of the
information security program, as well as to identify and address the gaps, issues, or risks. Metrics for each milestone should be aligned with the organization’s
strategy, vision, and mission, as well as with the expectations and needs of the stakeholders. Metrics for each milestone should also be SMART (specific,
measurable, achievable, relevant, and time-bound), as well as consistent, reliable, and transparent.
The other options are not as important as establishing metrics for each milestone, as they do not provide a comprehensive and holistic way to communicate the
program’s effectiveness to stakeholders. A control self-assessment (CSA) process is a technique to involve the staff in assessing the design, implementation, and
effectiveness of the information security controls. It can help to increase the awareness, ownership, and accountability of the staff, as well as to identify and
mitigate the risks. However, a CSA process alone is not enough to communicate the program’s effectiveness to stakeholders, as it does not measure the overall
performance or maturity of the information security program. Automated reporting to stakeholders is a method to provide timely, accurate, and consistent
information to the stakeholders about the status, results, and issues of the information security program. It can help to facilitate the communication, collaboration,
and decision making among the stakeholders, as well as to ensure the compliance and transparency of the information security program. However, automated
reporting alone is not enough to communicate the program’s effectiveness to stakeholders, as it does not evaluate the achievement or impact of the information
security program. A monitoring process for the security policy is a process to ensure that the security policy is implemented, enforced, and reviewed in accordance
with the organization’s objectives, standards, and regulations. It can help to maintain the relevance, adequacy, and effectiveness of the security policy, as well as
to incorporate the feedback, changes, and improvements. However, a monitoring process alone is not enough to communicate the program’s effectiveness to
stakeholders, as it does not cover the other aspects of the information security program, such as governance, risk management, incident management, or
business continuity. References =
? CISM Review Manual, 16th Edition, ISACA, 2022, pp. 211-212, 215-216, 233-234, 237-238.
? CISM Questions, Answers & Explanations Database, ISACA, 2022, QID 1018.
? CISM domain 1: Information security governance [Updated 2022], Infosec, 1.
? Key Performance Indicators for Security Governance, Part 1, ISACA Journal, Volume 6, 2020, 2.

NEW QUESTION 2
- (Topic 1)
Which of the following would be MOST useful to a newly hired information security manager who has been tasked with developing and implementing an
information security strategy?

A. The capabilities and expertise of the information security team

B. The organization's mission statement and roadmap
C. A prior successful information security strategy
D. The organization's information technology (IT) strategy

Answer: B

Explanation:
= The most useful source of information for a newly hired information security manager who has been tasked with developing and implementing an information
security strategy is the organization’s mission statement and roadmap. The mission statement defines the organization’s purpose, vision, values, and goals, and
the roadmap outlines the organization’s strategic direction, priorities, and initiatives. By reviewing the mission statement and roadmap, the information security
manager can understand the organization’s business objectives, risk appetite, and security needs, and align the information security strategy with them. The
information security strategy should support and enable the organization’s mission and roadmap, and provide the security governance, policies, standards, and
controls to protect the organization’s information assets and processes.
The capabilities and expertise of the information security team (A) are important factors for the information security manager to consider, but they are not the most
useful source of information for developing and implementing an information security strategy. The information security team is responsible for executing and
maintaining the information security program and activities, such as risk management, security awareness, incident response, and compliance. The information
security manager should assess the capabilities and expertise of the information security team to identify the strengths, weaknesses, opportunities, and threats,
and to plan the resource allocation, training, and development of the team. However, the capabilities and expertise of the information security team do not directly
inform the information security strategy, which should be driven by the organization’s business objectives, risk appetite, and security needs.
A prior successful information security strategy © is a possible source of information for the information security manager to refer to, but it is not the most useful
one. A prior successful information security strategy is a strategy that has been implemented and evaluated by another organization or a previous information
security manager, and has achieved the desired security outcomes and benefits. The information security manager can learn from the best practices, lessons
learned, and challenges of a prior successful information security strategy, and apply them to the current organization or situation. However, a prior successful
information security strategy may not be relevant, applicable, or suitable for the organization, as it may not reflect the current or future business objectives, risk
appetite, and security needs of the organization, or the changing threat landscape and business environment.
The organization’s information technology (IT) strategy (D) is also a possible source of information for the information security manager to consult, but it is not the
most useful one. The IT strategy is a strategy that defines the IT vision, goals, and initiatives of the organization, and how IT supports and enables the business
processes and activities. The information security manager should review the IT strategy to understand the IT infrastructure, systems, and services of the
organization, and how they relate to the information security program and activities. However, the IT strategy is not the primary driver of the information security
strategy, which should be aligned with the organization’s business objectives, risk appetite, and security needs, and not only with the IT objectives, capabilities,
and requirements.
References = CISM Review Manual, 16th Edition, Chapter 1: Information Security Governance, Section: Information Security Strategy Development, page 23-241

NEW QUESTION 3
- (Topic 1)
Which of the following is MOST important when conducting a forensic investigation?

Passing Certification Exams Made Easy visit - https://www.2PassEasy.com

 Welcome to download the Newest 2passeasy CISM dumps
https://www.2passeasy.com/dumps/CISM/ (415 New Questions)

A. Analyzing system memory

B. Documenting analysis steps
C. Capturing full system images
D. Maintaining a chain of custody

Answer: D

Explanation:
Maintaining a chain of custody is the most important step when conducting a forensic investigation, as this ensures that the evidence is preserved, protected, and
documented from the time of collection to the time of presentation in court. A chain of custody provides a record of who handled the evidence, when, where, why,
and how, and prevents any tampering, alteration, or loss of the evidence. A chain of custody also establishes the authenticity, reliability, and admissibility of the
evidence in legal
proceedings. Analyzing system memory, documenting analysis steps, and capturing full system images are also important, but not as important as maintaining a
chain of custody, as they do not guarantee the integrity and validity of the evidence. References = CISM Review Manual 2023, page 1701; CISM Review
Questions, Answers & Explanations Manual 2023, page 332; ISACA CISM - iSecPrep, page 183

NEW QUESTION 4
- (Topic 1)
Which of the following is the MOST important reason to ensure information security is aligned with the organization's strategy?

A. To identify the organization's risk tolerance

B. To improve security processes
C. To align security roles and responsibilities
D. To optimize security risk management

Answer: D

Explanation:
= The most important reason to ensure information security is aligned with the organization’s strategy is to optimize security risk management. Information
security is not an isolated function, but rather an integral part of the organization’s overall objectives, processes, and governance. By aligning information security
with the organization’s strategy, the information security manager can ensure that security risks are identified, assessed, treated, and monitored in a consistent,
effective, and efficient manner1. Alignment also enables the information security manager to communicate the value and benefits of information security to senior
management and other stakeholders, and to justify the allocation of resources and investments for security initiatives2. Alignment also helps to establish clear
roles and responsibilities for information security across the organization, and to foster a culture of security awareness and accountability3. Therefore, alignment is
essential for optimizing security risk management, which is the process of balancing the protection of information assets with the business objectives and risk
appetite of the organization4. References = 1: CISM Exam Content Outline | CISM Certification | ISACA 2: CISM_Review_Manual Pages 1-30 - Flip PDF
Download | FlipHTML5 3: CISM 2020: Information Security & Business Process Alignment 4: CISM Review Manual 15th Edition, Chapter 2, Section 2.1

NEW QUESTION 5
- (Topic 1)
Which of the following is the BEST evidence of alignment between corporate and information security governance?

A. Security key performance indicators (KPIs)

B. Project resource optimization
C. Regular security policy reviews
D. Senior management sponsorship

Answer: D

Explanation:
Alignment between corporate and information security governance means that the information security program supports the organizational goals and objectives,
and is integrated into the enterprise governance structure. The best evidence of alignment is the senior management sponsorship, which demonstrates the
commitment and support of the top-level executives and board members for the information security program. Senior management sponsorship also ensures that
the information security program has adequate resources, authority, and accountability to achieve its objectives and address the risks and issues that affect the
organization. Senior management sponsorship also helps to establish a culture of security awareness and compliance throughout the organization, and to
communicate the value and benefits of the information security program to the stakeholders.
References =
? CISM Review Manual 15th Edition, page 1631
? CISM 2020: Information Security & Business Process Alignment, video 22
? Certified Information Security Manager (CISM), page 33

NEW QUESTION 6
- (Topic 1)
Which of the following is the MOST important criterion when deciding whether to accept residual risk?

A. Cost of replacing the asset

B. Cost of additional mitigation
C. Annual loss expectancy (ALE)
D. Annual rate of occurrence

Answer: C

Explanation:
= Annual loss expectancy (ALE) is the most important criterion when deciding whether to accept residual risk, because it represents the expected monetary loss
for an asset due to a risk over a one-year period. ALE is calculated by multiplying the annual rate of occurrence (ARO) of a risk event by the single loss expectancy
(SLE) of the asset. ARO is the estimated frequency of a risk event occurring within a one-year period, and SLE is the estimated cost of a single occurrence of a
risk event. ALE helps to compare the cost and benefit of different risk responses, such as avoidance, mitigation, transfer, or acceptance. Risk acceptance is
appropriate when the ALE is lower than the cost of other risk responses, or when the risk is unavoidable or acceptable within the organization’s risk appetite and
tolerance. ALE also helps to prioritize the risks that need more attention and resources.
References = CISM Review Manual, 16th Edition, Chapter 2: Information Risk Management, Section: Risk Assessment, page 831; CISM Review Questions,

Passing Certification Exams Made Easy visit - https://www.2PassEasy.com

 Welcome to download the Newest 2passeasy CISM dumps
https://www.2passeasy.com/dumps/CISM/ (415 New Questions)

Answers & Explanations Manual, 10th Edition, Question 22, page 242

NEW QUESTION 7
- (Topic 1)
Which of the following is the MOST important consideration when establishing an organization's information security governance committee?

A. Members have knowledge of information security controls.

B. Members are business risk owners.
C. Members are rotated periodically.
D. Members represent functions across the organization.

Answer: D

Explanation:
= The most important consideration when establishing an organization’s information security governance committee is to ensure that members represent
functions across the organization. This is because the information security governance committee is responsible for setting the direction, scope, and objectives of
the information security program, and for ensuring that the program aligns with the organization’s business goals and strategies. By having members from
different functions, such as finance, human resources, operations, legal, and IT, the committee can ensure that the information security program considers the
needs, expectations, and perspectives of various stakeholders, and that the program supports the organization’s mission, vision, and values. Having a diverse and
representative committee also helps to foster a culture of security awareness and accountability throughout the organization, and to promote collaboration and
communication among different functions.
Members having knowledge of information security controls, members being business risk owners, and members being rotated periodically are all desirable
characteristics of an information security governance committee, but they are not the most important consideration. Members having knowledge of information
security controls can help the committee to understand the technical aspects of information security and to evaluate the effectiveness and efficiency of the
information security program. However, having technical knowledge is not sufficient to ensure that the information security program is aligned with the
organization’s business goals and strategies, and that the program considers the needs and expectations of various stakeholders. Members being business risk
owners can help the committee to identify and prioritize the information security risks that affect the organization’s business objectives, and to allocate appropriate
resources and responsibilities for managing those risks. However, being a business risk owner does not necessarily imply that the member has a comprehensive
and balanced view of the organization’s information security needs and expectations, and that the member can represent the interests and perspectives of various
functions. Members being rotated periodically can help the committee to maintain its independence and objectivity, and to avoid conflicts of interest or
complacency. However, rotating members too frequently can also reduce the continuity and consistency of the information security program, and can affect the
committee’s ability to monitor and evaluate the performance and progress of the information security program. References =
? ISACA, CISM Review Manual, 16th Edition, 2020, pages 36-37.
? ISACA, CISM Review Questions, Answers & Explanations Database, 12th Edition, 2020, question ID 1014.

NEW QUESTION 8
- (Topic 1)
An information security manager learns of a new standard related to an emerging technology the organization wants to implement. Which of the following should
the information security manager recommend be done FIRST?

A. Determine whether the organization can benefit from adopting the new standard.
B. Obtain legal counsel's opinion on the standard's applicability to regulations,
C. Perform a risk assessment on the new technology.
D. Review industry specialists’ analyses of the new standard.

Answer: A

Explanation:
= The first step that the information security manager should recommend when learning of a new standard related to an emerging technology is to determine
whether the organization can benefit from adopting the new standard. This involves evaluating the business objectives, needs, and requirements of the
organization, as well as the potential advantages, disadvantages, and challenges of implementing the new technology and the new standard. The information
security manager should also consider the alignment of the new standard with the organization’s existing policies, procedures, and standards, as well as the
impact of the new standard on the organization’s information security governance, risk management, program, and incident management. By conducting a
preliminary analysis of the feasibility, suitability, and desirability of the new standard, the information security manager can provide a sound basis for further
decision making and planning.
References = CISM Review Manual, 16th Edition, Chapter 1: Information Security Governance, Section: Information Security Standards, page 391; CISM Review
Questions, Answers & Explanations Manual, 10th Edition, Question 43, page 412.

NEW QUESTION 9
- (Topic 1)
Which of the following is the PRIMARY benefit of implementing a vulnerability assessment process?

A. Threat management is enhanced.

B. Compliance status is improved.
C. Security metrics are enhanced.
D. Proactive risk management is facilitated.

Answer: D

Explanation:
A vulnerability assessment process is a systematic and proactive approach to identify, analyze and prioritize the vulnerabilities in an information system. It helps to
reduce the exposure of the system to potential threats and improve the security posture of the organization. By implementing a vulnerability assessment process,
the organization can facilitate proactive risk management, which is the PRIMARY benefit of this process. Proactive risk management is the process of identifying,
assessing and mitigating risks before they become incidents or cause significant impact to the organization. Proactive risk management enables the organization
to align its security strategy with its business objectives, optimize its security resources and investments, and enhance its resilience and compliance.
* A. Threat management is enhanced. This is a secondary benefit of implementing a vulnerability assessment process. Threat management is the process of
identifying, analyzing and responding to the threats that may exploit the vulnerabilities in an information system. Threat management is enhanced by implementing
a vulnerability assessment process, as it helps to reduce the attack surface and prioritize the most critical threats. However, threat management is not the
PRIMARY benefit of implementing a vulnerability assessment process, as it is a reactive rather than proactive approach to risk management.
* B. Compliance status is improved. This is a secondary benefit of implementing a vulnerability assessment process. Compliance status is the degree to which an

Passing Certification Exams Made Easy visit - https://www.2PassEasy.com

 Welcome to download the Newest 2passeasy CISM dumps
https://www.2passeasy.com/dumps/CISM/ (415 New Questions)

organization adheres to the applicable laws, regulations, standards and policies that govern its information security. Compliance status is improved by
implementing a vulnerability assessment process, as it helps to demonstrate the organization’s commitment to security best practices and meet the expectations
of the stakeholders and regulators. However, compliance status is not the PRIMARY benefit of implementing a vulnerability assessment process, as it is a result
rather than a driver of risk management.
* C. Security metrics are enhanced. This is a secondary benefit of implementing a vulnerability assessment process. Security metrics are the quantitative and
qualitative measures that indicate the effectiveness and efficiency of the information security processes and controls. Security metrics are enhanced by
implementing a vulnerability assessment process, as it helps to provide objective and reliable data for security monitoring and reporting. However, security metrics
are not the PRIMARY benefit of implementing a vulnerability assessment process, as they are a means rather than an end of risk management.
References =
? CISM Review Manual 15th Edition, pages 1-301
? CISM Exam Content Outline2
? Risk Assessment for Technical Vulnerabilities3
? A Step-By-Step Guide to Vulnerability Assessment4

NEW QUESTION 10
- (Topic 1)
Which of the following should be the PRIMARY area of focus when mitigating security risks associated with emerging technologies?

A. Compatibility with legacy systems

B. Application of corporate hardening standards
C. Integration with existing access controls
D. Unknown vulnerabilities

Answer: D

Explanation:
= The primary area of focus when mitigating security risks associated with emerging technologies is unknown vulnerabilities. Emerging technologies are new and
complex, and often involve multiple parties, interdependencies, and uncertainties. Therefore, they may have unknown vulnerabilities that could expose the
organization to threats that are difficult to predict, detect, or prevent1. Unknown vulnerabilities could also result from the lack of experience, knowledge, or best
practices in implementing, operating, or securing emerging technologies2. Unknown vulnerabilities could lead to serious consequences, such as data breaches,
system failures, reputational damage, legal liabilities, or regulatory sanctions3. Therefore, it is important to focus on identifying, assessing, and addressing
unknown vulnerabilities when mitigating security risks associated with emerging technologies.
The other options are not as important as unknown vulnerabilities, because they are either more predictable, manageable, or specific. Compatibility with legacy
systems is a technical issue that could affect the performance, functionality, or reliability of emerging technologies, but it is not a security risk per se. It could be
resolved by testing, upgrading, or replacing legacy systems4. Application of corporate hardening standards is a security measure that could reduce the attack
surface and improve the resilience of emerging technologies, but it is not a sufficient or comprehensive solution. It could be limited by the availability, applicability,
or effectiveness of the standards. Integration with existing access controls is a security requirement that could prevent unauthorized or inappropriate access to
emerging technologies, but it is not a guarantee of security. It could be challenged by the complexity, diversity, or dynamism of the access scenarios. References =
1: Performing Risk Assessments of Emerging Technologies - ISACA 2: Assessing the Risk of Emerging Technology - ISACA 3: Factors Influencing Public Risk
Perception of Emerging Technologies: A … 4: CISM Review Manual 15th Edition, Chapter 3, Section 3.3 : CISM Review Manual 15th Edition, Chapter 3, Section
3.4 : CISM Review Manual 15th Edition, Chapter 3, Section 3.5

NEW QUESTION 10
- (Topic 1)
Which of the following provides the BEST assurance that security policies are applied across business operations?

A. Organizational standards are included in awareness training.

B. Organizational standards are enforced by technical controls.
C. Organizational standards are required to be formally accepted.
D. Organizational standards are documented in operational procedures.

Answer: D

Explanation:
= The best assurance that security policies are applied across business operations is that organizational standards are documented in operational procedures.
Operational procedures are the specific steps and actions that need to be taken to implement and comply with the security policies and standards. They provide
clear and consistent guidance for the staff members who are responsible for performing the security tasks and functions. They also help to ensure that the security
policies and standards are aligned with the business objectives and processes, and that they are measurable and auditable. Documenting the organizational
standards in operational procedures can help to improve the security awareness, accountability, and performance of the staff members, and to reduce the risks of
errors, deviations, and violations. The other options are not the best assurance because they are either too general or too specific. Organizational standards are
included in awareness training (A) is a good practice to educate the staff members about the security policies and standards, but it does not guarantee that they
will follow them or understand how to apply them in their daily operations. Organizational standards are enforced by technical controls (B) is a way to automate and
monitor the compliance with the security policies and standards, but it does not cover all the aspects of security that may require human intervention or judgment.
Organizational standards are required to be formally accepted © is a way to obtain the commitment and support from the staff members for the security policies
and standards, but it does not ensure that they will adhere to them or know how to execute them in their work activities. References = CISM Review Manual 2022,
pages 24-25, 28-29; CISM Item Development Guide 2022, page 9; Policies, Procedures, Standards, Baselines, and Guidelines | CISSP Security-Management
Practices | Pearson IT Certification

NEW QUESTION 14
- (Topic 1)
Which of the following should be the MOST important consideration when establishing information security policies for an organization?

A. Job descriptions include requirements to read security policies.

B. The policies are updated annually.
C. Senior management supports the policies.
D. The policies are aligned to industry best practices.

Answer: C

Explanation:

Passing Certification Exams Made Easy visit - https://www.2PassEasy.com

 Welcome to download the Newest 2passeasy CISM dumps
https://www.2passeasy.com/dumps/CISM/ (415 New Questions)

The most important consideration when establishing information security policies for an organization is to ensure that senior management supports the policies.
Senior management support is essential for the successful implementation and enforcement of information security policies, as it demonstrates the commitment
and accountability of the organization’s leadership to information security. Senior management support also helps to allocate adequate resources, establish clear
roles and responsibilities, and promote a security-aware culture within the organization. Without senior management support, information security policies may not
be aligned with the organization’s goals and objectives, may not be communicated and disseminated effectively, and may not be followed or enforced consistently.
Job descriptions that include requirements to read security policies are a way of ensuring that employees are aware of their security obligations, but they are not
the most important consideration when establishing information security policies. The policies should be relevant and applicable to the employees’ roles and
functions, and should be reinforced by regular training and awareness programs.
The policies should be updated periodically to reflect the changes in the organization’s environment, risks, and requirements, but updating them annually may not
be sufficient or necessary. The frequency of updating the policies should depend on the nature and impact of the changes, and should be determined by a defined
policy review process.
The policies should be aligned with industry best practices, standards, and frameworks, but this is not the most important consideration when establishing
information security policies. The policies should also be customized and tailored to the organization’s specific context, needs, and expectations, and should be
consistent with the organization’s vision, mission, and values. References =
? ISACA, CISM Review Manual, 16th Edition, 2020, pages 37-38.
? ISACA, CISM Review Questions, Answers & Explanations Database, 12th Edition, 2020, question ID 1009.

NEW QUESTION 19
- (Topic 1)
Which of the following is the BEST way to help ensure an organization's risk appetite will be considered as part of the risk treatment process?

A. Establish key risk indicators (KRIs).

B. Use quantitative risk assessment methods.
C. Provide regular reporting on risk treatment to senior management
D. Require steering committee approval of risk treatment plans.

Answer: D

Explanation:
= Requiring steering committee approval of risk treatment plans is the best way to help ensure an organization’s risk appetite will be considered as part of the risk
treatment process because the steering committee is composed of senior management and key stakeholders who are responsible for defining and communicating
the risk appetite and ensuring that it is aligned with the business objectives and strategy. The steering committee can review and approve the risk treatment plans
proposed by the information security manager and ensure that they are consistent with the risk appetite and the risk tolerance levels. The steering committee can
also monitor and evaluate the effectiveness of the risk treatment plans and provide feedback and guidance to the information security manager. Establishing key
risk indicators (KRIs), using quantitative risk assessment methods, and providing regular reporting on risk treatment to senior management are not the best ways
to help ensure an organization’s risk appetite will be considered as part of the risk treatment process, although they may be useful tools and techniques to support
the risk management process. KRIs are metrics that measure the level of risk exposure and the performance of risk controls. Quantitative risk assessment
methods are techniques that use numerical values and probabilities to estimate the likelihood and impact of risk events. Regular reporting on risk treatment to
senior management is a way to communicate the status and results of the risk treatment process and to obtain feedback and support from senior management.
However, none of these methods can ensure that the risk treatment plans are approved and aligned with the risk appetite, which is the role of the steering
committee. References = CISM Review Manual 2023, Chapter 2, Section 2.4.3, page 76; CISM Review Questions, Answers & Explanations Database - 12 Month
Subscription, Question ID: 121.

NEW QUESTION 23
- (Topic 1)
Which of the following should be the FIRST step to gain approval for outsourcing to address a security gap?

A. Collect additional metrics.

B. Perform a cost-benefit analysis.
C. Submit funding request to senior management.
D. Begin due diligence on the outsourcing company.

Answer: B

Explanation:
The first step to gain approval for outsourcing to address a security gap is to perform a cost-benefit analysis, because it helps to evaluate the feasibility and
viability of the outsourcing option and compare it with other alternatives. A cost-benefit analysis is a method of estimating and comparing the costs and benefits of
a project or a decision, in terms of financial, operational, and strategic aspects. A cost-benefit analysis can help to:
? Identify and quantify the expected costs and benefits of outsourcing, such as the initial and ongoing expenses, the potential savings and revenues, the quality
and efficiency of the service, the risks and opportunities, and the alignment with the business objectives and requirements
? Assess and prioritize the criticality and urgency of the security gap, and the impact and likelihood of the related threats and vulnerabilities
? Determine the optimal level and scope of outsourcing, such as the type, duration, and frequency of the service, the roles and responsibilities of the parties
involved, and the performance and security standards and metrics
? Justify and communicate the rationale and value proposition of outsourcing, and provide evidence and support for the decision making process
? Establish and document the criteria and process for selecting and evaluating the outsourcing provider, and the contractual and legal terms and conditions
A cost-benefit analysis should be performed before submitting a funding request to senior management, because it can help to demonstrate the need and the
return on investment of the outsourcing project, and to secure the budget and the resources. A cost-benefit analysis should also be performed before beginning
due diligence on the outsourcing company, because it can help to narrow down the list of potential candidates and to focus on the most relevant and suitable ones.
Collecting additional metrics may be a part of the cost-benefit analysis, but it is not the first step, because it requires a clear definition and understanding of the
objectives and scope of the outsourcing project.
References = CISM Review Manual, 16th Edition, ISACA, 2021, pages 173-174, 177-178.

NEW QUESTION 24
- (Topic 1)
Which of the following tasks should be performed once a disaster recovery plan (DRP) has been developed?

A. Develop the test plan.

B. Analyze the business impact.
C. Define response team roles.
D. Identify recovery time objectives (RTOs).

Passing Certification Exams Made Easy visit - https://www.2PassEasy.com

 Welcome to download the Newest 2passeasy CISM dumps
https://www.2passeasy.com/dumps/CISM/ (415 New Questions)

Answer: A

Explanation:
= Developing the test plan is the task that should be performed once a disaster recovery plan (DRP) has been developed. The test plan is a document that
describes the objectives, scope, methods, and procedures for testing the DRP. The test plan should also define the roles and responsibilities of the test team, the
test scenarios and criteria, the test schedule and resources, and the test reporting and evaluation. The purpose of testing the DRP is to verify its effectiveness,
identify any gaps or weaknesses, and improve its reliability and usability. Testing the DRP also helps to increase the awareness and readiness of the staff and
stakeholders involved in the disaster recovery process. Analyzing the business impact, defining response team roles, and identifying recovery time objectives
(RTOs) are all tasks that should be performed before developing the DRP, not after. These tasks are part of the business continuity planning (BCP) process, which
aims to identify the critical business functions and assets, assess the potential threats and impacts, and determine the recovery strategies and requirements. The
DRP is a subset of the BCP that focuses on restoring the IT systems and services after a disaster. Therefore, the DRP should be based on the results of the BCP
process, and tested after it has been developed. References = CISM Review Manual 2023, page 218 1; CISM Practice Quiz 2

NEW QUESTION 26
- (Topic 1)
Which of the following BEST helps to ensure a risk response plan will be developed and executed in a timely manner?

A. Establishing risk metrics

B. Training on risk management procedures
C. Reporting on documented deficiencies
D. Assigning a risk owner

Answer: D

Explanation:
Assigning a risk owner is the best way to ensure a risk response plan will be developed and executed in a timely manner, because a risk owner is responsible for
monitoring, controlling, and reporting on the risk, as well as implementing the appropriate risk response actions. A risk owner should have the authority,
accountability, and resources to manage the risk effectively. Establishing risk metrics, training on risk management procedures, and reporting on documented
deficiencies are all important aspects of risk management, but they do not guarantee that a risk response plan will be executed promptly and properly. Risk metrics
help to measure and communicate the risk level and performance, but they do not assign any responsibility or action. Training on risk management procedures
helps to increase the awareness and competence of the staff involved in risk management, but it does not ensure that they will follow the procedures or have the
authority to do so. Reporting on documented deficiencies helps to identify and communicate the gaps and weaknesses in the risk management process, but it
does not provide any solutions or corrective actions. References = CISM Review Manual, 16th Edition, ISACA, 2021, pages 125-126, 136-137.

NEW QUESTION 28
- (Topic 1)
A security incident has been reported within an organization. When should an inforrnation security manager contact the information owner? After the:

A. incident has been confirmed.

B. incident has been contained.
C. potential incident has been logged.
D. incident has been mitigated.

Answer: A

Explanation:
= The information security manager should contact the information owner after the incident has been confirmed, as this is the first step of the incident response
process. The information owner is the person who has the authority and responsibility for the information asset that is affected by the incident. The information
owner needs to be informed of the incident as soon as possible, as they may have to make decisions or take actions regarding the protection, recovery, or
restoration of the information asset. The information owner may also have to communicate with other stakeholders, such as the business units, customers,
regulators, or media, depending on the nature and impact of the incident.
The other options are not the correct time to contact the information owner, as they occur later in the incident response process. Contacting the information owner
after the incident has been contained, mitigated, or logged may delay the notification and escalation of the incident, as well as the involvement and collaboration of
the information owner. Moreover, contacting the information owner after the incident has been contained or mitigated may imply that the incident response team
has already taken actions that may affect the information asset without the consent or approval of the information owner. Contacting the information owner after a
potential incident has been logged may cause unnecessary alarm or confusion, as the potential incident may not be a real or significant incident, or it may not
affect the information owner’s asset. References =
? CISM Review Manual, 16th Edition, ISACA, 2022, pp. 219-220, 226-227.
? CISM Questions, Answers & Explanations Database, ISACA, 2022, QID 1009.

NEW QUESTION 33
- (Topic 1)
Which of the following is MOST important to consider when determining asset valuation?

A. Asset recovery cost

B. Asset classification level
C. Cost of insurance premiums
D. Potential business loss

Answer: D

Explanation:
Potential business loss is the most important factor to consider when determining asset valuation, as it reflects the impact of losing or compromising the asset on
the organization’s objectives and operations. Asset recovery cost, asset classification level, and cost of insurance premiums are also relevant, but not as important
as potential business loss, as they do not capture the full value of the asset to the organization. References = CISM Review Manual 2023, page 461; CISM Review
Questions, Answers & Explanations Manual 2023, page 292

NEW QUESTION 37
- (Topic 1)

Passing Certification Exams Made Easy visit - https://www.2PassEasy.com

 Welcome to download the Newest 2passeasy CISM dumps
https://www.2passeasy.com/dumps/CISM/ (415 New Questions)

IT projects have gone over budget with too many security controls being added post- production. Which of the following would MOST help to ensure that relevant
controls are applied to a project?

A. Involving information security at each stage of project management

B. Identifying responsibilities during the project business case analysis
C. Creating a data classification framework and providing it to stakeholders
D. Providing stakeholders with minimum information security requirements

Answer: A

Explanation:
The best way to ensure that relevant controls are applied to a project is to involve information security at each stage of project management. This will help to
identify and address the security risks and requirements of the project from the beginning, and to integrate security controls into the project design, development,
testing, and implementation. This will also help to avoid adding unnecessary or ineffective controls post- production, which can increase the project cost and
complexity, and reduce the project performance and quality. By involving information security at each stage of project management, the information security
manager can ensure that the project delivers the expected security value and aligns with the organization’s security strategy and objectives. References = CISM
Review Manual 15th Edition, page 41.

NEW QUESTION 40
- (Topic 1)
If civil litigation is a goal for an organizational response to a security incident, the PRIMARY step should be to:

A. contact law enforcement.

B. document the chain of custody.
C. capture evidence using standard server-backup utilities.
D. reboot affected machines in a secure area to search for evidence.

Answer: B

Explanation:
Documenting the chain of custody is the PRIMARY step for an organizational response to a security incident if civil litigation is a goal because it ensures the
integrity, authenticity, and admissibility of the evidence collected from the incident. The chain of custody is the process of documenting the history of the evidence,
including its identification, collection, preservation, transportation, analysis, storage, and presentation in court. The chain of custody should include information
such as the date, time, location, description, source, owner, handler, and purpose of each evidence item, as well as any changes, modifications, or transfers that
occurred to the evidence. Documenting the chain of custody can help to prevent the evidence from being tampered with, altered, lost, or destroyed, and to
demonstrate that the evidence is relevant, reliable, and original12. Contacting law enforcement (A) is not the PRIMARY step for an organizational response to a
security incident if civil litigation is a goal, but rather a possible or optional step depending on the nature, severity, and jurisdiction of the incident. Contacting law
enforcement may help to obtain legal assistance, guidance, or support, but it may also involve risks such as loss of control, confidentiality, or reputation. Therefore,
contacting law enforcement should be done after careful consideration of the legal obligations, contractual agreements, and organizational policies12. Capturing
evidence using standard server-backup utilities © is not the PRIMARY step for an organizational response to a security incident if civil litigation is a goal, but rather
a technical step that should be done after documenting the chain of custody. Capturing evidence using standard server-backup utilities may help to preserve the
state of the systems or networks involved in the incident, but it may also introduce changes or errors that could compromise the validity or quality of the evidence.
Therefore, capturing evidence using standard server-backup utilities should be done using forensically sound methods and tools, and following the documented
chain of custody12. Rebooting affected machines in a secure area to search for evidence (D) is not the PRIMARY step for an organizational response to a security
incident if civil litigation is a goal, but rather a technical step that should be done after documenting the chain of custody. Rebooting affected machines in a secure
area may help to isolate and analyze the systems or networks involved in the incident, but it may also cause the loss or alteration of the evidence, such as volatile
memory, temporary files, or logs. Therefore, rebooting affected machines in a secure area should be done with caution and following the documented chain of
custody12. References = 1: CISM Review Manual 15th Edition, page 310-3111; 2: CISM Domain 4: Information Security Incident Management (ISIM) [2022
update]2

NEW QUESTION 43
- (Topic 1)
An information security manager developing an incident response plan MUST ensure it includes:

A. an inventory of critical data.

B. criteria for escalation.
C. a business impact analysis (BIA).
D. critical infrastructure diagrams.

Answer: B

Explanation:
An incident response plan is a set of procedures and guidelines that define the roles and responsibilities of the incident response team, the steps to follow in the
event of an incident, and the communication and escalation protocols to ensure timely and effective resolution of incidents. One of the essential components of an
incident response plan is the criteria for escalation, which specify the conditions and thresholds that trigger the escalation of an incident to a higher level of
authority or a different function within the organization. The criteria for escalation may depend on factors such as the severity, impact, duration, scope, and
complexity of the incident, as well as the availability and capability of the incident response team. The criteria for escalation help to ensure that incidents are
handled by the appropriate personnel, that management is kept informed and involved, and that the necessary resources and support are provided to resolve the
incident. References = https://blog.exigence.io/a-practical-approach-to-incident- management-escalation
https://www.uc.edu/content/dam/uc/infosec/docs/Guidelines/Information_Security_Incident_Response_Escalation_Guideline.pdf

NEW QUESTION 48
- (Topic 1)
Which of the following should be done FIRST when establishing a new data protection program that must comply with applicable data privacy regulations?

A. Evaluate privacy technologies required for data protection.

B. Encrypt all personal data stored on systems and networks.
C. Update disciplinary processes to address privacy violations.
D. Create an inventory of systems where personal data is stored.

Passing Certification Exams Made Easy visit - https://www.2PassEasy.com

 Welcome to download the Newest 2passeasy CISM dumps
https://www.2passeasy.com/dumps/CISM/ (415 New Questions)

Answer: D

Explanation:
= The first step when establishing a new data protection program that must comply with applicable data privacy regulations is to create an inventory of systems
where personal data is stored. Personal data is any information that relates to an identified or identifiable natural person, such as name, address, email, phone
number, identification number, location data, biometric data, or online identifiers. Data privacy regulations are laws and rules that govern the collection, processing,
storage, transfer, and disposal of personal data, and that grant rights and protections to the data subjects, such as the right to access, rectify, erase, or restrict the
use of their personal data. Examples of data privacy regulations are the General Data Protection Regulation (GDPR) in the European Union, the California
Consumer Privacy Act (CCPA) in the United States, and the Personal Data Protection Act (PDPA) in Singapore. Creating an inventory of systems where personal
data is stored is essential for the data protection program, because it helps to:
? Identify the sources, types, and locations of personal data that the organization collects and holds, and the purposes and legal bases for which they are used.
? Assess the risks and impacts associated with the personal data, and the compliance requirements and obligations under the applicable data privacy regulations.
? Implement appropriate technical and organizational measures to protect the personal data from unauthorized or unlawful access, use, disclosure, modification, or
loss, such as encryption, pseudonymization, access control, backup, or audit logging.
? Establish policies, procedures, and processes to manage the personal data throughout their life cycle, and to respond to the requests and complaints from the
data subjects or the data protection authorities.
? Monitor and review the performance and effectiveness of the data protection
program, and report and resolve any data breaches or incidents.
References = CISM Review Manual, 16th Edition, Chapter 3: Information Security Program Development and Management, Section: Data Protection, pages
202-2051; CISM Review Questions, Answers & Explanations Manual, 10th Edition, Question 71, page 662.

NEW QUESTION 53
- (Topic 1)
How does an incident response team BEST leverage the results of a business impact analysis (BIA)?

A. Assigning restoration priority during incidents

B. Determining total cost of ownership (TCO)
C. Evaluating vendors critical to business recovery
D. Calculating residual risk after the incident recovery phase

Answer: A

Explanation:
The incident response team can best leverage the results of a business impact analysis (BIA) by assigning restoration priority during incidents. A BIA is a process
that identifies and evaluates the criticality and dependency of the organization’s business functions, processes, and resources, and the potential impacts and
consequences of their disruption or loss. The BIA results provide the basis for determining the recovery objectives, strategies, and plans for the organization’s
business continuity and disaster recovery. By using the BIA results, the incident response team can prioritize the restoration of the most critical and time-sensitive
business functions, processes, and resources, and allocate the appropriate resources, personnel, and time to minimize the impact and duration of the incident.
Determining total cost of ownership (TCO) (B) is not a relevant way to leverage the results of a BIA, as it is not directly related to incident response. TCO is a
financial metric that estimates the total direct and indirect costs of owning and operating an asset or a system over its lifecycle. TCO may be useful for evaluating
the cost-effectiveness and return on investment of different security solutions or alternatives, but it does not help the incident response team to respond to or
recover from an incident.
Evaluating vendors critical to business recovery © is also not a relevant way to leverage the results of a BIA, as it is not a primary responsibility of the incident
response team. Evaluating vendors critical to business recovery is a part of the vendor management process, which involves selecting, contracting, monitoring,
and reviewing the vendors that provide essential products or services to support the organization’s business continuity and disaster recovery. Evaluating vendors
critical to business recovery may be done before or after an incident, but not during an incident, as it does not contribute to the incident response or restoration
activities.
Calculating residual risk after the incident recovery phase (D) is also not a relevant way to leverage the results of a BIA, as it is not a timely or effective use of the
BIA results. Residual risk is the risk that remains after the implementation of risk treatment or mitigation measures. Calculating residual risk after the incident
recovery phase may be done as a part of the incident review or improvement process, but not during the incident response or restoration phase, as it does not help
the incident response team to resolve or contain the incident.
References = CISM Review Manual, 16th Edition, Chapter 4: Information Security Incident Management, Section: Incident Response Plan, Subsection: Business
Impact Analysis, page 182-1831

NEW QUESTION 58
- (Topic 1)
An information security team has discovered that users are sharing a login account to an application with sensitive information, in violation of the access policy.
Business management indicates that the practice creates operational efficiencies. What is the information security manager's BEST course of action?

A. Enforce the policy.

B. Modify the policy.
C. Present the risk to senior management.
D. Create an exception for the deviation.

Answer: C

Explanation:
The information security manager’s best course of action is to present the risk to senior management, because this is a case of conflicting objectives and priorities
between the information security team and the business management. The information security manager should explain the potential impact and likelihood of a
security breach due to the violation of the access policy, as well as the possible legal, regulatory, and reputational consequences. The information security
manager should also provide alternative solutions that can achieve both operational efficiency and security compliance, such as implementing single sign-on, role-
based access control, or multi-factor authentication. The information security manager should not enforce the policy without senior management’s approval,
because this could cause operational disruption and business dissatisfaction. The information security manager should not modify the policy without a proper risk
assessment and approval process, because this could weaken the security posture and expose the organization to more threats. The information security manager
should not create an exception for the deviation without a formal risk acceptance and documentation process, because this could create inconsistency and
ambiguity in the policy enforcement and accountability. References = CISM Review Manual, 16th Edition, ISACA, 2021, pages 127- 128, 138-139, 143-144.

NEW QUESTION 61
- (Topic 1)
Which of the following BEST enables an information security manager to determine the comprehensiveness of an organization's information security strategy?

Passing Certification Exams Made Easy visit - https://www.2PassEasy.com

 Welcome to download the Newest 2passeasy CISM dumps
https://www.2passeasy.com/dumps/CISM/ (415 New Questions)

A. Internal security audit

B. External security audit
C. Organizational risk appetite
D. Business impact analysis (BIA)

Answer: C

Explanation:
The organizational risk appetite is the best indicator of the comprehensiveness of an information security strategy. The risk appetite defines the level of risk that
the organization is willing to accept in pursuit of its objectives. The information security strategy should align with the risk appetite and provide a framework for
managing the risks that the organization faces. An internal or external security audit can assess the effectiveness of the information security strategy, but not its
comprehensiveness. A business impact analysis (BIA) can identify the critical business processes and assets that need to be protected, but not the overall scope
and direction of the information security strategy. References = CISM Review Manual 2023, page 36 1; CISM Practice Quiz 2

NEW QUESTION 63
- (Topic 1)
When properly implemented, secure transmission protocols protect transactions:

A. from eavesdropping.
B. from denial of service (DoS) attacks.
C. on the client desktop.
D. in the server's database.

Answer: A

Explanation:
Secure transmission protocols are network protocols that ensure the integrity and security of data transmitted across network connections. The specific network
security protocol used depends on the type of protected data and network connection. Each protocol defines the techniques and procedures required to protect the
network data from unauthorized or malicious attempts to read or exfiltrate information1. One of the most common threats to network data is eavesdropping, which
is the interception and analysis of network traffic by an unauthorized third party. Eavesdropping can compromise the confidentiality, integrity, and availability of
network data, and can lead to data breaches, identity theft, fraud, espionage, and sabotage2. Therefore, secure transmission protocols protect transactions from
eavesdropping by using encryption, authentication, and integrity mechanisms to prevent unauthorized access and modification of network data. Encryption is the
process of transforming data into an unreadable format using a secret key, so that only authorized parties can decrypt and access the data. Authentication is the
process of verifying the identity and legitimacy of the parties involved in a network communication, using methods such as passwords, certificates, tokens, or
biometrics. Integrity is the process of ensuring that the data has not been altered or corrupted during transmission, using methods such as checksums, hashes, or
digital signatures3. Some examples of secure transmission protocols are:
? Secure Sockets Layer (SSL) and Transport Layer Security (TLS), which are widely used protocols for securing web, email, and other application layer
communications over the Internet. SSL and TLS use symmetric encryption, asymmetric encryption, and digital certificates to establish secure sessions between
clients and servers, and to encrypt and authenticate the data exchanged.
? Internet Protocol Security (IPsec), which is a protocol and algorithm suite that secures data transferred over public networks like the Internet. IPsec operates at
the network layer and provides end-to-end security for IP packets. IPsec uses two main protocols: Authentication Header (AH), which provides data integrity and
authentication, and Encapsulating Security Payload (ESP), which provides data confidentiality, integrity, and authentication. IPsec also uses two modes: transport
mode, which protects the payload of IP packets, and tunnel mode, which protects the entire IP packet.
? Secure Shell (SSH), which is a protocol that allows secure remote login and command execution over insecure networks. SSH uses encryption, authentication,
and integrity to protect the data transmitted between a client and a server. SSH also supports port forwarding, which allows secure tunneling of other network
services through SSH connections.
References = 1: 6 Network Security Protocols You Should Know | Cato Networks 2: Eavesdropping Attacks - an overview | ScienceDirect Topics 3: Network
Security Protocols
- an overview | ScienceDirect Topics : SSL/TLS (Secure Sockets Layer/Transport Layer Security) - Definition : IPsec - Wikipedia : Secure Shell - Wikipedia

NEW QUESTION 67
- (Topic 1)
Which of the following MUST be defined in order for an information security manager to evaluate the appropriateness of controls currently in place?

A. Security policy
B. Risk management framework
C. Risk appetite
D. Security standards

Answer: C

Explanation:
= Risk appetite is the amount and type of risk that an organization is willing to accept in pursuit of its objectives. It is a key factor that influences the information
security strategy and objectives, as well as the selection and implementation of security controls. Risk appetite must be defined in order for an information security
manager to evaluate the appropriateness of controls currently in place, as it provides the basis for determining whether the controls are sufficient, excessive, or
inadequate to address the risks faced by the organization. The information security manager should align the controls with the risk appetite of the organization,
ensuring that the controls are effective, efficient, and economical. References = CISM Review Manual 15th Edition, page 29, page 31.

NEW QUESTION 69
- (Topic 1)
Which of the following is MOST important to include in a post-incident review following a data breach?

A. An evaluation of the effectiveness of the information security strategy

B. Evaluations of the adequacy of existing controls
C. Documentation of regulatory reporting requirements
D. A review of the forensics chain of custom

Answer: B

Explanation:

Passing Certification Exams Made Easy visit - https://www.2PassEasy.com

 Welcome to download the Newest 2passeasy CISM dumps
https://www.2passeasy.com/dumps/CISM/ (415 New Questions)

= A post-incident review is a process of analyzing and learning from a security incident, such as a data breach, to improve the security posture and resilience of an
organization. A post-incident review should include the following elements12:
? A clear and accurate description of the incident, including its scope, impact, timeline, root cause, and contributing factors.
? A detailed assessment of the effectiveness and efficiency of the incident response process, including the roles and responsibilities, communication channels,
coordination mechanisms, escalation procedures, tools and resources, documentation, and reporting.
? An evaluation of the adequacy of existing controls, such as policies, standards, procedures, technical measures, awareness, and training, to prevent, detect, and
mitigate similar incidents in the future.
? A list of actionable recommendations and improvement plans, based on the lessons learned and best practices, to address the identified gaps and weaknesses
in the security strategy, governance, risk management, and incident management.
? A follow-up and monitoring mechanism to ensure the implementation and verification of the recommendations and improvement plans.
The most important element to include in a post-incident review following a data breach is the evaluation of the adequacy of existing controls, because it directly
relates to the security objectives and requirements of the organization, and provides the basis for enhancing the security posture and resilience of the organization.
Evaluating the existing controls helps to identify the vulnerabilities and risks that led to the data breach, and to determine the appropriate corrective and preventive
actions to reduce the likelihood and impact of similar incidents in the future. Evaluating the existing controls also helps to align the security strategy and
governance with the business goals and objectives, and to ensure the compliance with legal, regulatory, and contractual obligations.
The other elements, such as an evaluation of the effectiveness of the information security strategy, documentation of regulatory reporting requirements, and a
review of the forensics chain of custody, are also important, but not as important as the evaluation of the existing controls. An evaluation of the effectiveness of the
information security strategy is a broader and more strategic activity that may not be directly relevant to the specific incident, and may require more time and
resources to conduct. Documentation of regulatory reporting requirements is a necessary and mandatory task, but it does not provide much insight or value for
improving the security posture and resilience of the organization. A review of the forensics chain of custody is a technical and procedural activity that ensures the
integrity and admissibility of the digital evidence collected during the incident investigation, but it does not address the root cause or the mitigation of the incident.
References = 1: CISM Exam Content Outline | CISM Certification | ISACA 2: CISM Review Manual 15th Edition, page 147

NEW QUESTION 74
- (Topic 1)
Which of the following should be the PRIMARY objective of the information security incident response process?

A. Conducting incident triage

B. Communicating with internal and external parties
C. Minimizing negative impact to critical operations
D. Classifying incidents

Answer: C

Explanation:
The primary objective of the information security incident response process is to minimize the negative impact to critical operations. An information security
incident is an event that threatens or compromises the confidentiality, integrity, or availability of the organization’s information assets or processes. The
information security incident response process is a process that defines the roles, responsibilities, procedures, and tools for detecting, analyzing, containing,
eradicating, recovering, and learning from information security incidents. The main goal of the information security incident response process is to restore the
normal operations as quickly and effectively as possible, and to prevent or reduce the harm or loss caused by the incident to the organization, its stakeholders, or
its environment.
Conducting incident triage (A) is an important activity of the information security incident response process, but not the primary objective. Incident triage is the
process of prioritizing and assigning the incidents based on their severity, urgency, and impact. Incident triage helps to allocate the appropriate resources,
personnel, and time to handle the incidents, and to escalate the incidents to the relevant authorities or parties if needed. However, incident triage is not the ultimate
goal of the information security incident response process, but a means to achieve it.
Communicating with internal and external parties (B) is also an important activity of the information security incident response process, but not the primary
objective. Communicating with internal and external parties is the process of informing and updating the stakeholders, such as management, employees,
customers, partners, regulators, or media, about the incident status, actions, and outcomes. Communicating with internal and external parties helps to maintain the
trust, confidence, and reputation of the organization, and to comply with the legal and contractual obligations, such as notification or reporting requirements.
However, communicating with internal and external parties is not the ultimate goal of the information security incident response process, but a means to achieve it.
Classifying incidents (D) is also an important activity of the information security incident response process, but not the primary objective. Classifying incidents is the
process of categorizing and labeling the incidents based on their type, source, cause, or impact. Classifying incidents helps to identify and understand the nature
and scope of the incidents, and to apply the appropriate response procedures and controls. However, classifying incidents is not the ultimate goal of the
information security incident response process, but a means to achieve it.
References = CISM Review Manual, 16th Edition, Chapter 4: Information Security Incident Management, Section: Incident Response Plan, page 1811

NEW QUESTION 78
- (Topic 1)
The PRIMARY advantage of involving end users in continuity planning is that they:

A. have a better understanding of specific business needs.

B. are more objective than information security management.
C. can see the overall impact to the business.
D. can balance the technical and business risks.

Answer: A

Explanation:
= End users are the primary stakeholders of the business processes and functions that need to be protected and recovered in the event of a disruption. They have
the most knowledge and experience of the specific business needs, requirements, and dependencies that affect the continuity planning. Involving them in the
planning process can help to ensure that the continuity plan is aligned with the business objectives and expectations, and that the critical activities and resources
are prioritized and protected accordingly. End users can also provide valuable feedback and suggestions to improve the plan and its implementation. References =
CISM Review Manual 15th Edition, page 2291; CISM Practice Quiz, question 1182

NEW QUESTION 83
- (Topic 1)
Which of the following would be the MOST effective way to present quarterly reports to the board on the status of the information security program?

A. A capability and maturity assessment

B. Detailed analysis of security program KPIs

Passing Certification Exams Made Easy visit - https://www.2PassEasy.com

 Welcome to download the Newest 2passeasy CISM dumps
https://www.2passeasy.com/dumps/CISM/ (415 New Questions)

C. An information security dashboard

D. An information security risk register

Answer: C

Explanation:
An information security dashboard is the most effective way to present quarterly reports to the board on the status of the information security program, because it
provides a concise, visual, and high-level overview of the key performance indicators (KPIs), metrics, and trends of the information security program. An
information security dashboard can help the board to quickly and easily understand the current state, progress, and performance of the information security
program, and to identify any gaps, issues, or
areas of improvement. An information security dashboard can also help the board to align the information security program with the organization’s business goals
and strategies, and to support the decision-making and oversight functions of the board.
A capability and maturity assessment is a way of measuring the effectiveness and efficiency of the information security program, and of identifying the strengths
and weaknesses of the program. However, a capability and maturity assessment is not the most effective way to present quarterly reports to the board, because it
may not provide a clear and timely picture of the status of the information security program, and it may not reflect the changes and dynamics of the information
security environment. A capability and maturity assessment is more suitable for periodic or annual reviews, rather than quarterly reports.
A detailed analysis of security program KPIs is a way of evaluating the performance and progress of the information security program, and of determining the
extent to which the program meets the predefined objectives and targets. However, a detailed analysis of security program KPIs is not the most effective way to
present quarterly reports to the board, because it may be too technical, complex, or lengthy for the board to comprehend and appreciate. A detailed analysis of
security program KPIs is more suitable for operational or tactical level reporting, rather than strategic level reporting.
An information security risk register is a tool for recording and tracking the information security risks that affect the organization, and for documenting the risk
assessment, treatment, and monitoring activities. However, an information security risk register is not the most effective way to present quarterly reports to the
board, because it may not provide a comprehensive and balanced view of the information security program, and it may not highlight the achievements and benefits
of the program. An information security risk register is more suitable for risk management or audit purposes, rather than performance reporting. References =
? ISACA, CISM Review Manual, 16th Edition, 2020, pages 47-48, 59-60, 63-64, 67-68.
? ISACA, CISM Review Questions, Answers & Explanations Database, 12th Edition, 2020, question ID 1019.
An information security dashboard is an effective way to present quarterly reports to the board on the status of the information security program. It allows the board
to quickly view key metrics and trends at a glance and to drill down into more detailed information as needed. The dashboard should include metrics such as total
incidents, patching compliance, vulnerability scanning results, and more. It should also include high-level overviews of the security program and its components,
such as the security policy, security architecture, and security controls.

NEW QUESTION 87
- (Topic 1)
Security administration efforts will be greatly reduced following the deployment of which of the following techniques?

A. Discretionary access control

B. Role-based access control
C. Access control lists
D. Distributed access control

Answer: B

Explanation:
Role-based access control (RBAC) is a policy-neutral access control mechanism that assigns access privileges to defined roles in the organization and then
makes each user a member of the appropriate roles. RBAC reduces security administration efforts by simplifying the management of access rights across different
users and resources. RBAC also enables consistent and efficient enforcement of the principle of least privilege, which grants users only the minimum rights
required to perform their assigned tasks. RBAC can also facilitate the implementation of separation of duties, which prevents users from having conflicting or
incompatible responsibilities. RBAC is among the most widely used methods in the information security tool kit1. References = CIS Control 6: Access Control
Management - Netwrix, CISSP certification: RBAC (Role based access control), What is RBAC? (Role Based Access Control) - IONOS

NEW QUESTION 88
- (Topic 1)
Which of the following is the BEST course of action for an information security manager to align security and business goals?

A. Conducting a business impact analysis (BIA)

B. Reviewing the business strategy
C. Defining key performance indicators (KPIs)
D. Actively engaging with stakeholders

Answer: D

Explanation:
= According to the CISM Review Manual, the information security manager should actively engage with stakeholders to align security and business goals. This
means understanding the business needs, expectations, and risk appetite of the stakeholders, and communicating the value and benefits of security initiatives to
them. By engaging with stakeholders, the information security manager can also gain their support and commitment for security programs and projects, and
ensure that security objectives are aligned with business strategy and priorities. References = CISM Review Manual, 16th Edition, ISACA, 2020, page 23.

NEW QUESTION 92
- (Topic 1)
When deciding to move to a cloud-based model, the FIRST consideration should be:

A. storage in a shared environment.

B. availability of the data.
C. data classification.
D. physical location of the data.

Answer: C

Explanation:
The first consideration when deciding to move to a cloud-based model should be data classification, because it helps the organization to identify the sensitivity,

Passing Certification Exams Made Easy visit - https://www.2PassEasy.com

 Welcome to download the Newest 2passeasy CISM dumps
https://www.2passeasy.com/dumps/CISM/ (415 New Questions)

value, and criticality of the data that will be stored, processed, or transmitted in the cloud. Data classification can help the organization to determine the appropriate
level of protection, encryption, and access control for the data, and to comply with the relevant legal, regulatory, and contractual requirements. Data classification
can also help the organization to evaluate the suitability, compatibility, and trustworthiness of the cloud service provider and the cloud service model, and to
negotiate the terms and conditions of the cloud service contract.
Storage in a shared environment, availability of the data, and physical location of the data are all important considerations when deciding to move to a cloud-based
model, but they are not the first consideration. Storage in a shared environment can affect the security, privacy, and integrity of the data, as the data may be co-
located with other customers’ data, and may be subject to unauthorized access, modification, or deletion. Availability of the data can affect the reliability,
performance, and continuity of the data, as the data may be inaccessible, corrupted, or lost due to network failures, service outages, or disasters. Physical location
of the data can affect the compliance, sovereignty, and jurisdiction of the data, as the data may be stored or transferred across different countries or regions, and
may be subject to different laws, regulations, or policies. However, these considerations depend on the data classification, as different types of data may have
different levels of risk, impact, and expectation in the cloud environment. References =
? ISACA, CISM Review Manual, 16th Edition, 2020, pages 95-96, 99-100, 103-104, 107-108.
? ISACA, CISM Review Questions, Answers & Explanations Database, 12th Edition, 2020, question ID 1031.

NEW QUESTION 96
- (Topic 1)
Which of the following is an information security manager's MOST important course of action when responding to a major security incident that could disrupt the
business?

A. Follow the escalation process.

B. Identify the indicators of compromise.
C. Notify law enforcement.
D. Contact forensic investigators.

Answer: A

Explanation:
When responding to a major security incident that could disrupt the business, the information security manager’s most important course of action is to follow the
escalation process. The escalation process is a predefined set of steps and procedures that define who should be notified, when, how, and with what information in
the event of a security incident. The escalation process helps to ensure that the appropriate stakeholders, such as senior management, business units, legal
counsel, public relations, and external parties, are informed and involved in the incident response process. The escalation process also helps to coordinate the
actions and decisions of the incident response team and the business continuity team, and to align the incident response objectives with the business priorities and
goals. The escalation process should be documented and communicated as part of the incident response plan, and should be reviewed and updated regularly to
reflect the changes in the organization’s structure, roles, and responsibilities. References =
? CISM Review Manual 15th Edition, page 1631
? CISM 2020: Incident Management and Response, video 32
? Incident Response Models3

NEW QUESTION 100

- (Topic 1)
Which is the BEST method to evaluate the effectiveness of an alternate processing site when continuous uptime is required?

A. Parallel test
B. Full interruption test
C. Simulation test
D. Tabletop test

Answer: A

Explanation:
A parallel test is the best method to evaluate the effectiveness of an alternate processing site when continuous uptime is required. A parallel test involves
processing the same transactions or data at both the primary and the alternate site simultaneously, and comparing the results for accuracy and consistency. A
parallel test can validate the functionality, performance, and reliability of the alternate site without disrupting the normal operations at the primary site. A parallel
test can also identify and resolve any issues or discrepancies between the two sites before a real disaster occurs. A parallel test can provide a high level of
assurance and confidence that the alternate site can support the organization’s continuity requirements.
References = CISM Review Manual, 16th Edition, Chapter 3: Information Security Program Development and Management, Section: Business Continuity Plan
(BCP) Testing, page 1861; CISM Review Questions, Answers & Explanations Manual, 10th Edition, Question 56, page 522.
A parallel test is the best method to evaluate the effectiveness of an alternate processing site when continuous uptime is required because it involves processing
data at both the primary and alternate sites simultaneously without disrupting the normal operations1. A full interruption test would cause downtime and potential
loss of data or revenue2. A simulation test would not provide a realistic assessment of the alternate site’s capabilities3. A tabletop test would only involve a
discussion of the procedures and scenarios without actually testing the site4.
1: CISM Exam Content Outline | CISM Certification | ISACA 2: CISM - ISACA Certified Information Security Manager Exam Prep - NICCS 3: Prepare for the
ISACA Certified Information Security Manager Exam: CISM … 4: CISM: Certified Information Systems Manager | Official ISACA … - NICCS

NEW QUESTION 103

- (Topic 1)
Which of the following processes BEST supports the evaluation of incident response effectiveness?

A. Root cause analysis

B. Post-incident review
C. Chain of custody
D. Incident logging

Answer: B

Explanation:
A post-incident review (PIR) is the process of evaluating the effectiveness of the incident response after the incident has been resolved. A PIR aims to identify the
strengths and weaknesses of the response process, the root causes and impacts of the incident, the lessons learned and best practices, and the
recommendations and action plans for improvement1. A PIR can help an organization enhance its incident response capabilities, reduce the likelihood and severity
of future incidents, and increase its resilience and maturity2.

Passing Certification Exams Made Easy visit - https://www.2PassEasy.com

 Welcome to download the Newest 2passeasy CISM dumps
https://www.2passeasy.com/dumps/CISM/ (415 New Questions)

A PIR is the best process to support the evaluation of incident response effectiveness, because it provides a systematic and comprehensive way to assess the
performance and outcomes of the response process, and to identify and implement the necessary changes and improvements. A PIR involves collecting and
analyzing relevant data and feedback from various sources, such as incident logs, reports, evidence, metrics, surveys, interviews, and observations. A PIR also
involves comparing the actual response with the expected or planned response, and measuring the achievement of the response objectives and the satisfaction of
the stakeholders3. A PIR also involves documenting and communicating the findings, conclusions, and recommendations of the evaluation, and ensuring that they
are followed up and implemented.
The other options are not as good as a PIR in supporting the evaluation of incident response effectiveness, because they are either more specific, limited, or
dependent on a PIR. A root cause analysis (RCA) is a technique to identify the underlying factors or reasons that caused the incident, and to prevent or mitigate
their recurrence. An RCA can help an organization understand the nature and origin of the incident, and to address the problem at its source, rather than its
symptoms. However, an RCA is not sufficient to evaluate the effectiveness of the response process, because it does not cover other aspects, such as the
response performance, outcomes, impacts, lessons, and best practices. An RCA is usually a part of a PIR, rather than a separate process. A chain of custody
(CoC) is a process of maintaining and documenting the integrity and security of the evidence collected during the incident response. A CoC can help an
organization ensure that the evidence is reliable, authentic, and admissible in legal or regulatory proceedings. However, a CoC is not a process to evaluate the
effectiveness of the response process, but rather a requirement or a standard to follow during the response process. A CoC does not provide any feedback or
analysis on the response performance, outcomes, impacts, lessons, or best practices. An incident logging is a process of recording and tracking the details and
activities of the incident response. An incident logging can help an organization monitor and manage the response process, and to provide an audit trail and a
source of information for the evaluation. However, an incident logging is not a process to evaluate the effectiveness of the response process, but rather an input or
a tool for the evaluation. An incident logging does not provide any assessment or measurement on the response performance, outcomes, impacts, lessons, or best
practices. References = 1: CISM Review Manual 15th Edition, Chapter 5, Section 5.5 2: Post-Incident Review: A Guide to Effective Incident Response 3: Post-
Incident Review: A Guide to Effective Incident Response : CISM Review Manual 15th Edition, Chapter 5, Section 5.5 : CISM Review Manual 15th Edition, Chapter
5, Section 5.5 : CISM Review Manual 15th Edition, Chapter 5, Section 5.4 : CISM Review Manual 15th Edition, Chapter 5, Section 5.3

NEW QUESTION 107

- (Topic 1)
Which of the following is MOST important to ensure when developing escalation procedures for an incident response plan?

A. Each process is assigned to a responsible party.

B. The contact list is regularly updated.
C. Minimum regulatory requirements are maintained.
D. Senior management approval has been documented.

Answer: B

Explanation:
= The contact list is the most important element of the escalation procedures for an incident response plan, as it ensures that the appropriate stakeholders are
notified and involved in the incident management process. A contact list should include the names, roles, responsibilities, phone numbers, email addresses, and
backup contacts of the key personnel involved in the incident response, such as the incident response team, senior management, legal counsel, public relations,
law enforcement, and external service providers. The contact list should be regularly updated and tested to ensure its accuracy and availability123. References =
? 1: Information Security Incident Response Escalation Guideline2, page 4
? 2: A Practical Approach to Incident Management Escalation1, section “Step 2: Log the escalation and record the related incident problems that occurred”
? 3: Computer Security Incident Handling Guide4, page 18

NEW QUESTION 111

- (Topic 1)
Which of the following is MOST critical when creating an incident response plan?

A. Identifying vulnerable data assets

B. Identifying what constitutes an incident
C. Decumenting incident notification and escalation processes
D. Aligning with the risk assessment process

Answer: C

Explanation:
= Documenting incident notification and escalation processes is the most critical step when creating an incident response plan, as this ensures that the
appropriate stakeholders are informed and involved in the response process. Identifying vulnerable data assets, what constitutes an incident, and aligning with the
risk assessment process are important, but not as critical as documenting the communication and escalation procedures. References = CISM Review Manual
2023, page 1631; CISM Review Questions, Answers & Explanations Manual 2023, page 282

NEW QUESTION 113

- (Topic 1)
Which of the following is the PRIMARY reason to monitor key risk indicators (KRIs) related to information security?

A. To alert on unacceptable risk

B. To identify residual risk
C. To reassess risk appetite
D. To benchmark control performance

Answer: A

Explanation:
Key risk indicators (KRIs) are metrics that measure the level of risk exposure and the likelihood of occurrence of potential adverse events that can affect the
organization’s objectives and performance. KRIs are used to monitor changes in the risk environment and to provide early warning signals for potential issues that
may require management attention or intervention. KRIs are also used to communicate the risk status and trends to the relevant stakeholders and to support risk-
based decision making12.
The primary reason to monitor KRIs related to information security is to alert on unacceptable risk. Unacceptable risk is the level of risk that exceeds the
organization’s risk appetite, tolerance, or threshold, and that poses a significant threat to the organization’s assets, operations, reputation, or compliance.
Unacceptable risk can result from internal or external factors, such as cyberattacks, data breaches, system failures, human errors, fraud, natural disasters, or
regulatory changes. Unacceptable risk can have severe consequences for the organization, such as financial losses, legal liabilities, operational disruptions,
customer dissatisfaction, or reputational damage12.

Passing Certification Exams Made Easy visit - https://www.2PassEasy.com

 Welcome to download the Newest 2passeasy CISM dumps
https://www.2passeasy.com/dumps/CISM/ (415 New Questions)

By monitoring KRIs related to information security, the organization can identify and assess the sources, causes, and impacts of unacceptable risk, and take timely
and appropriate actions to mitigate, transfer, avoid, or accept the risk. Monitoring KRIs can also help the organization to evaluate the effectiveness and efficiency
of the existing information security controls, policies, and procedures, and to identify and implement any necessary improvements or enhancements. Monitoring
KRIs can also help the organization to align its information security strategy and objectives with its business strategy and objectives, and
to ensure compliance with the relevant laws, regulations, standards, and best practices12. While monitoring KRIs related to information security can also serve
other purposes, such as identifying residual risk, reassessing risk appetite, or benchmarking control performance, these are not the primary reason for monitoring
KRIs. Residual risk is the level of risk that remains after applying the risk treatment options, and it should be within the organization’s risk appetite, tolerance, or
threshold. Reassessing risk appetite is the process of reviewing and adjusting the amount and type of risk that the organization is willing to take in pursuit of its
objectives, and it should be done periodically or when there are significant changes in the internal or external environment. Benchmarking control performance is
the process of comparing the organization’s information security controls with those of other organizations or industry standards, and it should be done to identify
and adopt the best practices or to demonstrate compliance12. References = Integrating KRIs and KPIs for Effective Technology Risk Management, The Power of
KRIs in Enterprise Risk Management (ERM) - Metricstream, What Is a Key Risk Indicator? With Characteristics and Tips, KRI Framework for Operational Risk
Management | Workiva, Key risk indicator - Wikipedia

NEW QUESTION 114

- (Topic 1)
Which of the following is the BEST way to ensure the organization's security objectives are embedded in business operations?

A. Publish adopted information security standards.

B. Perform annual information security compliance reviews.
C. Implement an information security governance framework.
D. Define penalties for information security noncompliance.

Answer: C

Explanation:
The best way to ensure the organization’s security objectives are embedded in business operations is to implement an information security governance
framework. An information security governance framework is a set of policies, procedures, standards, guidelines, roles, and responsibilities that define and direct
how the organization manages and measures its information security activities. An information security governance framework helps to align the information
security strategy with the business strategy and the organizational culture, and to ensure that the information security objectives are consistent with the business
objectives and the stakeholder expectations. An information security governance framework also helps to establish the authority, accountability, and
communication channels for the information security function, and to provide the necessary resources, tools, and controls to implement and monitor the information
security program. By implementing an information security governance framework, the organization can embed the information security objectives in business
operations, and ensure that the information security function supports and enables the business processes and functions, rather than hinders or restricts them.
References = CISM Review Manual, 16th Edition, Chapter 1: Information Security Governance, Section: Information Security Governance Framework, page 181;
CISM Review Questions, Answers & Explanations Manual, 10th Edition, Question 75, page 702.

NEW QUESTION 118

- (Topic 1)
An organization finds it necessary to quickly shift to a work-fromhome model with an increased need for remote access security.
Which of the following should be given immediate focus?

A. Moving to a zero trust access model

B. Enabling network-level authentication
C. Enhancing cyber response capability
D. Strengthening endpoint security

Answer: D

Explanation:
Strengthening endpoint security is the most immediate focus when shifting to a work-from- home model with an increased need for remote access security, as this
reduces the risk of unauthorized access, data leakage, malware infection, and other threats that may compromise the confidentiality, integrity, and availability of
the organization’s information assets. Moving to a zero trust access model, enabling network-level authentication, and enhancing cyber response capability are
also important, but not as urgent as strengthening endpoint security, as they require more time, resources, and planning to implement effectively. References =
CISM Review Manual 2023, page 1561; CISM Review Questions, Answers & Explanations Manual 2023, page 302; ISACA CISM - iSecPrep, page 153

NEW QUESTION 121

- (Topic 3)
Which of the following BEST enables an organization to enhance its incident response plan processes and procedures?

A. Security risk assessments

B. Lessons learned analysis
C. Information security audits
D. Key performance indicators (KPIs)

Answer: B

Explanation:
Lessons learned analysis is the best way to enable an organization to enhance its incident response plan processes and procedures because it helps to identify
the strengths and weaknesses of the current plan, capture the feedback and recommendations from the incident responders and stakeholders, and implement the
necessary improvements and corrective actions for future incidents. Security risk assessments are not directly related to enhancing the incident response plan, but
rather to identifying and evaluating the security risks and controls of the organization. Information security audits are not directly related to enhancing the incident
response plan, but rather to verifying and validating the compliance and effectiveness of the security policies and standards of the organization. Key performance
indicators (KPIs) are not directly related to enhancing the incident response plan, but rather to measuring and reporting the performance and progress of the
security objectives and initiatives of the organization. References: https://www.isaca.org/resources/isaca-journal/issues/2017/volume-5/incident-response-lessons-
learned https://www.isaca.org/resources/isaca-journal/issues/2017/volume-1/security-risk-assessment-for-a-cloud-based-enterprise- resource-planning-system
https://www.isaca.org/resources/isaca-journal/issues/2016/volume-6/how-to-measure-the-effectiveness-of-information-security- using-iso-27004
https://www.isaca.org/resources/isaca-journal/issues/2017/volume-3/how-to-measure-the-effectiveness-of-your-information-security-management-system

Passing Certification Exams Made Easy visit - https://www.2PassEasy.com

 Welcome to download the Newest 2passeasy CISM dumps
https://www.2passeasy.com/dumps/CISM/ (415 New Questions)

NEW QUESTION 122

- (Topic 3)
When developing a categorization method for security incidents, the categories MUST:

A. align with industry standards.

B. be created by the incident handler.
C. have agreed-upon definitions.
D. align with reporting requirements.

Answer: C

Explanation:
When developing a categorization method for security incidents, the categories must have agreed-upon definitions. This means that the categories should be
clear, consistent, and understandable for all the parties involved in the incident response process, such as the incident handlers, the stakeholders, the
management, and the external authorities. Having agreed-upon definitions for the categories can help to ensure that the incidents are classified and reported
accurately, that the appropriate actions and resources are allocated, and that the communication and coordination are effective. Aligning with industry standards,
creating by the incident handler, and aligning with reporting requirements are not mandatory for developing a categorization method for security incidents, although
they may be desirable or beneficial depending on the context and objectives of the organization. Aligning with industry standards can help to adopt best practices
and benchmarks for incident response, but it may not be feasible or suitable for all types of incidents or organizations. Creating by the incident handler can allow
for flexibility and customization of the categories, but it may also introduce inconsistency and ambiguity if the definitions are not shared or agreed upon by others.
Aligning with reporting requirements can help to comply with legal or contractual obligations, but it may not cover all the aspects or dimensions of the incidents that
need to be categorized. References = CISM Review Manual, 16th Edition, pages 200-2011; CISM Review Questions, Answers & Explanations Manual, 10th
Edition, page 822
When developing a categorization method for security incidents, the categories MUST have agreed-upon definitions. This is because having clear and consistent
definitions for each category of incidents will help to ensure a common understanding and communication among the incident response team and other
stakeholders. It will also facilitate the accurate and timely identification, classification, reporting and analysis of incidents. Having agreed- upon definitions will also
help to avoid confusion, ambiguity and inconsistency in the incident management process

NEW QUESTION 126

- (Topic 3)
Which of the following metrics is MOST appropriate for evaluating the incident notification process?

A. Average total cost of downtime per reported incident

B. Elapsed time between response and resolution
C. Average number of incidents per reporting period
D. Elapsed time between detection, reporting, and response

Answer: D

Explanation:
Elapsed time between detection, reporting, and response is the most appropriate metric for evaluating the incident notification process because it measures how
quickly and effectively the organization identifies, communicates, and responds to security incidents. The incident notification process is a critical part of the
incident response plan that defines the roles and responsibilities, procedures, and channels for reporting and escalating security incidents to the relevant
stakeholders. Elapsed time between detection, reporting, and response helps to assess the performance and efficiency of the incident notification process, as well
as to identify any bottlenecks or delays that may affect the incident resolution and recovery. Therefore, elapsed time between detection, reporting, and response is
the correct answer.
References:
? https://www.atlassian.com/incident-management/kpis/common-metrics
? https://securityscorecard.com/blog/how-to-use-incident-response-metrics/
? https://www.cisa.gov/sites/default/files/publications/Incident-Response-Plan- Basics_508c.pdf

NEW QUESTION 130

- (Topic 3)
A small organization has a contract with a multinational cloud computing vendor. Which of the following would present the GREATEST concern to an information
security manager if omitted from the contract?

A. Authority of the subscriber to approve access to its data

B. Right of the subscriber to conduct onsite audits of the vendor
C. Commingling of subscribers' data on the same physical server
D. Escrow of software code with conditions for code release

Answer: A

Explanation:
Authority of the subscriber to approve access to its data is the greatest concern for an information security manager if omitted from the contract, as it may expose
the subscriber’s data to unauthorized or inappropriate access by the vendor or third parties. The subscriber should have the right to control who can access its
data, for what purposes, and under what conditions. The contract should also specify the vendor’s obligations to protect the confidentiality, integrity, and
availability of the subscriber’s data, and to notify the subscriber of any breaches or incidents.
References = CISM Review Manual, 27th Edition, Chapter 4, Section 4.2.1, page 2201; Drafting and Negotiating Effective Cloud Computing Agreements2; CISM
Online Review Course, Module 4, Lesson 2, Topic 13

NEW QUESTION 134

- (Topic 3)
Which of the following is MOST important when defining how an information security budget should be allocated?

A. Regulatory compliance standards

B. Information security strategy
C. Information security policy
D. Business impact assessment

Passing Certification Exams Made Easy visit - https://www.2PassEasy.com

 Welcome to download the Newest 2passeasy CISM dumps
https://www.2passeasy.com/dumps/CISM/ (415 New Questions)

Answer: B

Explanation:
Information security strategy is the most important factor when defining how an information security budget should be allocated because it helps to align the
security objectives and initiatives with the business goals and priorities. An information security strategy is a high-level plan that defines the vision, mission, scope,
and direction of the security program, as well as the roles and responsibilities, governance structures, policies and standards, risk management approaches, and
performance measurement methods. An information security strategy helps to identify and prioritize the security needs and requirements of the organization, as
well as to allocate the resources and funding accordingly. An information security strategy also helps to communicate the value and benefits of security to the
stakeholders and justify the security investments. Therefore, information security strategy is the correct answer.
References:
? https://www.techtarget.com/searchsecurity/tip/Cybersecurity-budget-breakdown- and-best-practices
? https://www.csoonline.com/article/3671108/how-2023-cybersecurity-budget-allocations-are-shaping-up.html
? https://www.statista.com/statistics/1319677/companies-it-budget-allocated-to- security-worldwide/

NEW QUESTION 137

- (Topic 3)
When management changes the enterprise business strategy which of the following processes should be used to evaluate the existing information security
controls as well as to select new information security controls?

A. Configuration management
B. Risk management
C. Access control management
D. Change management

Answer: D

Explanation:
According to the CISM Review Manual (Digital Version), Chapter 3, Section 3.2.2, change management is the process of identifying, assessing, approving,
implementing, and monitoring changes to information systems and information security controls1. Change management is essential for ensuring that changes are
aligned with the organization’s business strategy and objectives, as well as complying with applicable laws and regulations1.
The CISM Review Manual (Digital Version) also states that change management should be performed in conjunction with other processes, such as configuration
management, access control management, and risk management1. Configuration management is the process of identifying, documenting, controlling, and
verifying the configuration items (CIs) of an information system1. Access control management is the process of granting or denying access to information systems
and information assets based on predefined policies and procedures1. Risk management is the process of identifying, analyzing, evaluating, treating, monitoring,
and communicating risks to information systems and information assets1.
The CISM Exam Content Outline also covers the topic of change management in Domain 3
— Information Security Program Development and Management (27% exam weight)2. The subtopics include:
? 3.2.2 Change Management
? 3.2.3 Change Control
? 3.2.4 Change Implementation
? 3.2.5 Change Monitoring
I hope this answer helps you prepare for your CISM exam. Good luck!

NEW QUESTION 138

- (Topic 3)
Which of the following BEST enables an information security manager to obtain organizational support for the implementation of security controls?

A. Conducting periodic vulnerability assessments

B. Communicating business impact analysis (BIA) results
C. Establishing effective stakeholder relationships
D. Defining the organization's risk management framework

Answer: C

Explanation:
The best way to obtain organizational support for the implementation of security controls is to establish effective stakeholder relationships. Stakeholders are the
individuals or groups that have an interest or influence in the organization’s information security objectives, activities, and outcomes. They may include senior
management, business owners, users, customers, regulators, auditors, vendors, and others. By establishing effective stakeholder relationships, the information
security manager can communicate the value and benefits of security controls to the organization’s performance, reputation, and competitiveness. The information
security manager can also solicit feedback and input from stakeholders to ensure that the security controls are aligned with the organization’s needs and
expectations. The information security manager can also foster collaboration and cooperation among stakeholders to facilitate the implementation and operation of
security controls. The other options are not the best way to obtain organizational support for the implementation of security controls, although they may be some
steps or outcomes of the process. Conducting periodic vulnerability assessments is a technical activity that can help identify and prioritize the security weaknesses
and gaps in the organization’s information assets and systems. However, it does not necessarily obtain organizational support for the implementation of security
controls unless the results are communicated and justified to the stakeholders. Communicating business impact analysis (BIA) results is a reporting activity that
can help demonstrate the potential consequences of disruptions or incidents on the organization’s critical business processes and functions. However, it does not
necessarily obtain organizational support for the implementation of security controls unless the results are linked to the organization’s risk appetite and tolerance.
Defining the organization’s risk management framework is a strategic activity that can help establish the policies, procedures, roles, and responsibilities for
managing information security risks in a consistent and effective manner. However, it does not necessarily obtain organizational support for the implementation of
security controls unless the framework is endorsed and enforced by the stakeholders

NEW QUESTION 141

- (Topic 3)
For the information security manager, integrating the various assurance functions of an organization is important PRIMARILY to enable:

A. consistent security.
B. comprehensive audits
C. a security-aware culture
D. compliance with policy

Passing Certification Exams Made Easy visit - https://www.2PassEasy.com

 Welcome to download the Newest 2passeasy CISM dumps
https://www.2passeasy.com/dumps/CISM/ (415 New Questions)

Answer: A

Explanation:
Consistent security is the primary reason for integrating the various assurance functions of an organization for the information security manager because it
ensures that the security policies and standards are applied uniformly and effectively across different domains, processes, and systems of the organization.
Comprehensive audits are not the primary reason for integrating the various assurance functions, but rather a possible outcome or benefit of doing so. A security-
aware culture is not the primary reason for integrating the various assurance functions, but rather a desirable state or goal of the organization. Compliance with
policy is not the primary reason for integrating the various assurance functions, but rather a basic requirement or expectation of the organization. References:
https://www.isaca.org/resources/isaca- journal/issues/2016/volume-4/integrating-assurance-functions https://www.isaca.org/resources/isaca-
journal/issues/2017/volume-3/how-to-measure-the-effectiveness-of-your-information-security-management-system

NEW QUESTION 146

- (Topic 3)
Which of the following is the MOST effective way to identify changes in an information security environment?

A. Business impact analysis (BIA)

B. Annual risk assessments
C. Regular penetration testing
D. Continuous monitoring

Answer: D

Explanation:
Continuous monitoring is the most effective way to identify changes in an information security environment, as it provides ongoing awareness of the security
status, vulnerabilities, and threats that may affect the organization’s information assets and risk posture. Continuous monitoring also helps to evaluate the
performance and effectiveness of the security controls and processes, and to detect and respond to any deviations or incidents in a timely manner. (From CISM
Review Manual 15th Edition and NIST Special Publication 800-1371)
References: CISM Review Manual 15th Edition, page 181, section 4.3.2.4; NIST Special Publication 800-1371, page 1, section 1.1.

NEW QUESTION 149

- (Topic 3)
An information security manager has been asked to provide both one-year and five-year plans for the information security program. What is the PRIMARY purpose
for the long-term plan?

A. To facilitate the continuous improvement of the IT organization

B. To ensure controls align with security needs
C. To create and document required IT capabilities
D. To prioritize security risks on a longer scale than the one-year plan

Answer: B

Explanation:
The primary purpose for the long-term plan for the information security program is to ensure controls align with security needs. This is because the long-term plan
provides a strategic vision and direction for the information security program, and defines the goals, objectives, and initiatives that support the organization’s
mission, vision, and values. The long-term plan also helps to identify and prioritize the security risks and opportunities that may arise in the future, and to align the
information security controls with the changing business and technology environment. The long-term plan also facilitates the allocation and optimization of the
resources and budget for the information security program, and enables the measurement and evaluation of the program’s performance and value.
The long-term plan provides a strategic vision and direction for the information security program, and defines the goals, objectives, and initiatives that support the
organization’s mission, vision, and values. The long-term plan also helps to identify and prioritize the security risks and opportunities that may arise in the future,
and to align the information security controls with the changing business and technology environment. (From CISM Manual or related resources)
References = CISM Review Manual 15th Edition, Chapter 3, Section 3.1.1, page 1261; CISM domain 3: Information security program development and
management [2022
update] | Infosec2; CISM: Information Security Program Development and Management Part 1 Online, Self-Paced3

NEW QUESTION 150

- (Topic 1)
Which of the following is the PRIMARY reason for granting a security exception?

A. The risk is justified by the cost to the business.

B. The risk is justified by the benefit to security.
C. The risk is justified by the cost to security.
D. The risk is justified by the benefit to the business.

Answer: D

Explanation:
= A security exception is a formal authorization to deviate from a security policy, standard, or control, due to a valid business reason or requirement. The primary
reason for granting a security exception is that the risk associated with the deviation is justified by the benefit to the business, such as increased efficiency,
productivity, customer satisfaction, or competitive advantage. The security exception should be approved by the appropriate authority, such as the senior
management or the risk committee, based on a risk assessment and a cost-benefit analysis. The security exception should also be documented, communicated,
monitored, and reviewed periodically123. References =
? 1: CISM Review Manual 15th Edition, page 364
? 2: CISM Practice Quiz, question 1132
? 3: Security Policy Exception Management, section “Security Policy Exception Management Process”

NEW QUESTION 154

- (Topic 3)
Which of the following should an information security manager do FIRST when there is a conflict between the organization's information security policy and a local
regulation?

Passing Certification Exams Made Easy visit - https://www.2PassEasy.com

 Welcome to download the Newest 2passeasy CISM dumps
https://www.2passeasy.com/dumps/CISM/ (415 New Questions)

A. Enforce the local regulation.

B. Obtain legal guidance.
C. Enforce the organization's information security policy.
D. Obtain an independent assessment of the regulation.

Answer: B

Explanation:
The information security manager should first obtain legal guidance when there is a conflict between the organization’s information security policy and a local
regulation, because this will help to understand the implications and consequences of the conflict, and to identify the possible options and solutions for resolving it.
The information security manager should also consult with the relevant stakeholders, such as senior management, business owners, and information owners, to
determine the best course of action that aligns with the organization’s objectives, risk appetite, and compliance obligations. Enforcing the local regulation or the
organization’s information security policy without legal guidance may expose the organization to legal liabilities, security risks, or operational disruptions. Obtaining
an independent assessment of the regulation may be helpful, but it is not the first step to take.
References = CISM Review Manual, 16th Edition, page 691; A Guide to ISACA CISM Domains & Domain 1: Information Security Governance2

NEW QUESTION 155

- (Topic 3)
Within the confidentiality, integrity, and availability (CIA) triad, which of the following activities BEST supports the concept of confidentiality?

A. Ensuring hashing of administrator credentials

B. Enforcing service level agreements (SLAs)
C. Ensuring encryption for data in transit
D. Utilizing a formal change management process

Answer: C

Explanation:
Ensuring encryption for data in transit is the best activity that supports the concept of confidentiality within the CIA triad, as it protects the data from unauthorized
access or interception while it is being transmitted over a network. Encryption is a technique that transforms data into an unreadable form using a secret key, so
that only authorized parties who have the key can decrypt and access the data. Encryption standards include AES (Advanced Encryption Standard) and DES
(Data Encryption Standard).
References = CISM Review Manual 2022, page 321; CISM Exam Content Outline, Domain 1, Knowledge Statement 1.12; The CIA triad: Definition, components
and examples3; CIA Triad - GeeksforGeeks4

NEW QUESTION 156

- (Topic 3)
When implementing a security policy for an organization handling personally identifiable information (Pll); the MOST important objective should be:

A. strong encryption
B. regulatory compliance.
C. data availability.
D. security awareness training

Answer: B

Explanation:
Regulatory compliance is the most important objective when implementing a security policy for an organization handling personally identifiable information (PII)
because it helps to ensure that the organization meets the legal and ethical obligations to protect the privacy and security of PII. PII is any information that can be
used to identify, contact, or locate an individual, such as name, address, email, phone number, social security number, etc. PII is subject to various laws and
regulations in different jurisdictions, such as the General Data Protection Regulation (GDPR) in the European Union, the California Consumer Privacy Act (CCPA)
in the United States, or the Personal Information Protection and Electronic Documents Act (PIPEDA) in Canada. Failing to comply with these regulations can result
in fines, lawsuits, reputational damage, or loss of trust. Therefore, regulatory compliance is the correct answer.
References:
? https://www.iso.org/obp/ui/en/#iso:std:iso-iec:27018:ed-2:v1:en
? https://www.digitalguardian.com/blog/how-secure-personally-identifiable-information-against-loss-or-compromise
? https://blog.rsisecurity.com/how-to-make-a-personally-identifiable-information- policy/

NEW QUESTION 158

- (Topic 3)
Which of the following is a viable containment strategy for a distributed denial of service (DDoS) attack?

A. Block IP addresses used by the attacker

B. Redirect the attacker's traffic
C. Disable firewall ports exploited by the attacker.
D. Power off affected servers

Answer: B

Explanation:
Redirecting the attacker’s traffic is a viable containment strategy for a distributed denial of service (DDoS) attack because it helps to divert the malicious traffic
away from the target server and reduce the impact of the attack. A DDoS attack is an attempt by attackers to overwhelm a server or a network with a large volume
of requests or packets, preventing legitimate users from accessing the service or resource. Redirecting the attacker’s traffic is a technique that involves changing
the DNS settings or routing tables to send the attacker’s traffic to another destination, such as a sinkhole, a honeypot, or a scrubbing center. A sinkhole is a server
that absorbs and discards the malicious traffic. A honeypot is a decoy server that mimics the target server and collects information about the attacker’s behavior
and techniques. A scrubbing center is a service that filters out the malicious traffic and forwards only the legitimate traffic to the target server. Redirecting the
attacker’s traffic helps to contain the DDoS attack by reducing the load on the target server and preserving its availability and performance. Therefore, redirecting
the attacker’s traffic is the correct answer.
References:
? https://www.fortinet.com/resources/cyberglossary/implement-ddos-mitigation- strategy

Passing Certification Exams Made Easy visit - https://www.2PassEasy.com

 Welcome to download the Newest 2passeasy CISM dumps
https://www.2passeasy.com/dumps/CISM/ (415 New Questions)

? https://learn.microsoft.com/en-us/azure/ddos-protection/ddos-response-strategy
? https://www.cloudflare.com/learning/ddos/glossary/sinkholing/.

NEW QUESTION 162

- (Topic 3)
Which of the following functions is MOST critical when initiating the removal of system access for terminated employees?

A. Legal
B. Information security
C. Help desk
D. Human resources (HR)

Answer: B

Explanation:
Information security is the most critical function when initiating the removal of system access for terminated employees, as it is responsible for ensuring that the
access rights of the employees are revoked in a timely and effective manner, and that the security of the organization’s data and systems is maintained.
Information security should coordinate with other functions, such as HR, legal, and help desk, to implement the access removal process, but it is the primary
function that has the authority and capability to disable or delete the access credentials of the terminated employees. The other options are not as critical as
information security, as they may have different roles or responsibilities in the access removal process, or they may not have direct access to the systems or tools
that control the access rights of the employees. References =
CISM Review Manual 15th Edition, page 114: “Information security is responsible for ensuring that access rights are revoked in a timely and effective manner.”
SOC 2 Controls: Access Removal for Terminated or Transferred Users, snippets: “Systems access that is no longer required for terminated or transferred users is
removed within one business day. For terminated employees, access to key IT systems is revoked in a timely manner. A termination checklist and ticket are
completed, and access is revoked for employees as a component of the employee termination process.”
IT Involvement in Employee Termination, A Checklist, snippets: “Disable all network access. If your company uses a master access list of active passwords, tell
the system to deny any passcodes associated with the user being terminated. If your system doesn’t have a deny function, delete the user and their associated
passwords. Monitor employee access.”
Human resources (HR) is the most critical function when initiating the removal of system access for terminated employees because it is responsible for notifying
the relevant parties, such as information security, help desk, and legal, of the employee’s termination status and date. HR also ensures that the employee’s exit
process is completed and documented, and that the employee returns any company-owned devices or assets. HR also coordinates with the employee’s manager
and team to ensure a smooth transition of work and responsibilities.

NEW QUESTION 165

- (Topic 3)
Which of the following should be established FIRST when implementing an information security governance framework?

A. Security architecture
B. Security policies
C. Security incident management team
D. Security awareness training program

Answer: A

Explanation:
This is the most urgent and effective action to prevent further damage or compromise of the organization’s network and data. The other options are less important
or irrelevant in this situation.
According to How to identify suspicious insider activity using Active Directory, one of the steps to detect and respond to suspicious activity is to isolate the affected
device from the network. This can be done by disabling the network adapter, unplugging the network cable, or blocking the device’s IP address on the firewall1.
This will prevent the device from communicating with any malicious actors or spreading malware to other devices on the network.

NEW QUESTION 169

- (Topic 3)
A newly appointed information security manager has been asked to update all security- related policies and procedures that have been static for five years or
more. What should be done NEXT?

A. Update in accordance with the best business practices.

B. Perform a risk assessment of the current IT environment.
C. Gain an understanding of the current business direction.
D. Inventory and review current security policies.

Answer: D

Explanation:
The next step for the information security manager should be to inventory and review the current security policies to understand the existing security requirements,
controls, and gaps. This will help to identify the areas that need to be updated, revised, or replaced to align with the current business needs and objectives, as well
as the legal and regulatory requirements. Updating the policies in accordance with the best business practices, performing a risk assessment of the current IT
environment, or gaining an understanding of the current business direction are important activities, but they should be done after reviewing the current security
policies.
References = CISM Review Manual, 16th Edition eBook1, Chapter 1: Information Security Governance, Section: Information Security Policies, Standards,
Procedures and Guidelines, Subsection: Information Security Policies, Page 28.

NEW QUESTION 174

- (Topic 3)
The categorization of incidents is MOST important for evaluating which of the following?

A. Appropriate communication channels

B. Allocation of needed resources
C. Risk severity and incident priority

Passing Certification Exams Made Easy visit - https://www.2PassEasy.com

 Welcome to download the Newest 2passeasy CISM dumps
https://www.2passeasy.com/dumps/CISM/ (415 New Questions)

D. Response and containment requirements

Answer: C

Explanation:
The categorization of incidents is most important for evaluating the risk severity and incident priority, as these factors determine the impact and urgency of the
incident, and the appropriate level of response and escalation. The categorization of incidents helps to classify the incidents based on their type, source, cause,
scope, and affected assets or services. By categorizing incidents, the information security manager can assess the potential or actual harm to the organization, its
stakeholders, and its objectives, and assign a priority level that reflects the need for immediate action and resolution. The risk severity and incident priority also
influence the allocation of resources, the response and containment requirements, and the communication channels, but they are not the primary purpose of
categorization.
References = CISM Review Manual, 27th Edition, Chapter 4, Section 4.4.1, page 2371; CISM Online Review Course, Module 4, Lesson 4, Topic 12; CIRT Case
Classification (Draft) - FIRST3

NEW QUESTION 178

- (Topic 3)
An information security manager has been tasked with developing materials to update the board, regulatory agencies, and the media about a security incident.
Which of the following should the information security manager do FIRST?

A. Set up communication channels for the target audience.

B. Determine the needs and requirements of each audience.
C. Create a comprehensive singular communication
D. Invoke the organization's incident response plan.

Answer: D

Explanation:
The information security manager should do FIRST invoke the organization’s incident response plan, which is a predefined set of procedures and guidelines for
handling security incidents in a timely and effective manner. The incident response plan should include the roles and responsibilities of the incident response team,
the communication protocols and channels, the escalation and reporting procedures, and the documentation and evidence collection requirements. By invoking the
incident response plan, the information security manager can ensure that the incident is properly contained, analyzed, resolved, and reported, and that the
appropriate stakeholders are informed and involved. The other options are not the first actions that the information security manager should take, as they are part
of the communication process that follows the incident response plan. Setting up communication channels for the target audience, determining the needs and
requirements of each audience, and creating a comprehensive singular communication are all important steps for communicating effectively with the board,
regulatory agencies, and the media, but they are not the first priority in the event of a security incident. The information security manager should first follow the
incident response plan to manage the incident and its impact, and then communicate the relevant information to the target audience according to the plan.
References = CISM Review Manual, 16th Edition, page 2261; CISM Review Questions, Answers & Explanations Manual, 10th Edition, page 1012 Determining the
needs and requirements of each audience should be the FIRST step in developing materials to update the board, regulatory agencies, and the media about a
security incident. This is because different audiences have different expectations, interests, and concerns regarding the incident and its impact. By understanding
the needs and requirements of each audience, the information security manager can tailor the communication materials to address them effectively and
appropriately. This will also help to avoid confusion, misinformation, or misinterpretation of the incident details and response actions

NEW QUESTION 183

......

Passing Certification Exams Made Easy visit - https://www.2PassEasy.com

 Welcome to download the Newest 2passeasy CISM dumps
https://www.2passeasy.com/dumps/CISM/ (415 New Questions)

THANKS FOR TRYING THE DEMO OF OUR PRODUCT

Visit Our Site to Purchase the Full Set of Actual CISM Exam Questions With Answers.

We Also Provide Practice Exam Software That Simulates Real Exam Environment And Has Many Self-Assessment Features. Order the CISM
Product From:

https://www.2passeasy.com/dumps/CISM/

Money Back Guarantee

CISM Practice Exam Features:

* CISM Questions and Answers Updated Frequently

* CISM Practice Questions Verified by Expert Senior Certified Staff

* CISM Most Realistic Questions that Guarantee you a Pass on Your FirstTry

* CISM Practice Test Questions in Multiple Choice Formats and Updatesfor 1 Year

Passing Certification Exams Made Easy visit - https://www.2PassEasy.com

Powered by TCPDF (www.tcpdf.org)