Top Tips Of CISM preparation exams

Our Isaca CISM exam goods contain study guide, Pdf files and check engine. The study guide are shown chapter by chapter. In the event you have no idea to be able to prepare for the Isaca CISM exam, you can discover all the necessary information in the CISM study guide. Both the Pdf files and check engine software are free downloadable soon after purchasing. And the Pdf files are also printable and essential for the Isaca Isaca exam preparation. The check engine can easily create a real Isaca CISM environment.

2021 Feb CISM test question

Q141. The MOST effective use of a risk register is to: 

A. identify risks and assign roles and responsibilities for mitigation. 

B. identify threats and probabilities. 

C. facilitate a thorough review of all IT-related risks on a periodic basis. 

D. record the annualized financial amount of expected losses due to risks. 



A risk register is more than a simple list—it should lie used as a tool to ensure comprehensive documentation, periodic review and formal update of all risk elements in the enterprise's IT and related organization. Identifying risks and assigning roles and responsibilities for mitigation are elements of the register. Identifying threats and probabilities are two elements that are defined in the risk matrix, as differentiated from the broader scope of content in, and purpose for, the risk register. While the annualized loss expectancy (ALE) should be included in the register, this quantification is only a single element in the overall risk analysis program. 

Q142. The recovery point objective (RPO) requires which of the following? 

A. Disaster declaration 

B. Before-image restoration 

C. System restoration 

D. After-image processing 



The recovery point objective (RPO) is the point in the processing flow at which system recovery should occur. This is the predetermined state of the application processing and data used to restore the system and to continue the processing flow. Disaster declaration is independent of this processing checkpoint. Restoration of the system can occur at a later date, as does the return to normal, after-image processing. 

Q143. On a company's e-commerce web site, a good legal statement regarding data privacy should include: 

A. a statement regarding what the company will do with the information it collects. 

B. a disclaimer regarding the accuracy of information on its web site. 

C. technical information regarding how information is protected. 

D. a statement regarding where the information is being hosted. 



Most privacy laws and regulations require disclosure on how information will be used. A disclaimer is not necessary since it does not refer to data privacy. Technical details regarding how information is protected are not mandatory to publish on the web site and in fact would not be desirable. It is not mandatory to say where information is being hosted. 

Q144. Which of the following factors is a PRIMARY driver for information security governance that does not require any further justification? 

A. Alignment with industry best practices 

B. Business continuity investment 

C. Business benefits 

D. Regulatory compliance 



Regulatory compliance can be a standalone driver for an information security governance measure. No further analysis nor justification is required since the entity has no choice in the regulatory requirements. Buy-in from business managers must be obtained by the information security manager when an information security governance measure is sought based on its alignment with industry best practices. Business continuity investment needs to be justified by business impact analysis. When an information security governance measure is sought based on qualitative business benefits, further analysis is required to determine whether the benefits outweigh the cost of the information security governance measure in question. 

Q145. Which of the following would be MOST relevant to include in a cost-benefit analysis of a two-factor authentication system? 

A. Annual loss expectancy (ALE) of incidents 

B. Frequency of incidents 

C. Total cost of ownership (TCO) 

D. Approved budget for the project 



The total cost of ownership (TCO) would be the most relevant piece of information in that it would establish a cost baseline and it must be considered for the full life cycle of the control. Annual loss expectancy (ALE) and the frequency of incidents could help measure the benefit, but would have more of an indirect relationship as not all incidents may be mitigated by implementing a two-factor authentication system. The approved budget for the project may have no bearing on what the project may actually cost. 

Renew CISM free question:

Q146. To justify its ongoing security budget, which of the following would be of MOST use to the information security' department? 

A. Security breach frequency 

B. Annualized loss expectancy (ALE) 

C. Cost-benefit analysis 

D. Peer group comparison 



Cost-benefit analysis is the legitimate way to justify budget. The frequency of security breaches may assist the argument for budget but is not the key tool; it does not address the impact. Annualized loss expectancy (ALE) does not address the potential benefit of security investment. Peer group comparison would provide a good estimate for the necessary security budget but it would not take into account the specific needs of the organization. 

Q147. Acceptable levels of information security risk should be determined by: 

A. legal counsel. 

B. security management. 

C. external auditors. 

D. die steering committee. 



Senior management, represented in the steering committee, has ultimate responsibility for determining what levels of risk the organization is willing to assume. Legal counsel, the external auditors and security management are not in a position to make such a decision. 

Q148. Which of the following groups would be in the BEST position to perform a risk analysis for a business? 

A. External auditors 

B. A peer group within a similar business 

C. Process owners 

D. A specialized management consultant 



Process owners have the most in-depth knowledge of risks and compensating controls within their environment. External parties do not have that level of detailed knowledge on the inner workings of the business. Management consultants are expected to have the necessary skills in risk analysis techniques but are still less effective than a group with intimate knowledge of the business. 

Q149. Before conducting a formal risk assessment of an organization's information resources, an information security manager should FIRST: 

A. map the major threats to business objectives. 

B. review available sources of risk information. 

C. identify the value of the critical assets. 

D. determine the financial impact if threats materialize. 



Risk mapping or a macro assessment of the major threats to the organization is a simple first step before performing a risk assessment. Compiling all available sources of risk information is part of the risk assessment. Choices C and D are also components of the risk assessment process, which are performed subsequent to the threats-business mapping. 

Q150. The MOST important reason for conducting periodic risk assessments is because: 

A. risk assessments are not always precise. 

B. security risks are subject to frequent change. 

C. reviewers can optimize and reduce the cost of controls. 

D. it demonstrates to senior management that the security function can add value. 



Risks are constantly changing. A previously conducted risk assessment may not include measured risks that have been introduced since the last assessment. Although an assessment can never be perfect and invariably contains some errors, this is not the most important reason for periodic reassessment. The fact that controls can be made more efficient to reduce costs is not sufficient. Finally, risk assessments should not be performed merely to justify the existence of the security function. 

see more CISM dumps