Isaca CISM Quiz 136 Topic 1 Questions 676-680

Question: 1

When introducing security measures into a software development life cycle, which of the following should be the FIRST step?

ACreate a threat model.

BConduct static code analysis.

CPerform benchmarking.

DInstitute a peer review

Show Answer

Question: 2

The selection of security controls is PRIMARILY linked to:

Abusiness impact assessment

Bregulatory requirements

Cbest practices of similar organizations.

Drisk appetite of the organization.

Show Answer

Question: 3

To integrate security into system development life cycle (SDLC) processes, an organization MUST ensure that security:

Aroles and responsibilities have been defined.

Bis a prerequisite for completion of major phases.

Cperformance metrics have been met

Dis represented on the configuration control board.

Show Answer

Question: 4

Which of the following BEST measures the effectiveness of an organization's information security strategy?

AComparison of residual risk to risk appetite

BComparison of mitigated risk to accepted risk

CComparison of current security budget to previous year's budget

DComparison of threats to vulnerabilities

Show Answer

Question: 5

To gain a clear+ understanding of the impact that a new regulatory requirement will have on an organization s information security controls, an information security manager should FIRST:

Ainterview senior management

Bconduct a cost-benefit analysis.

Cconduct a risk assessment

Dperform a gap analysis.

Show Answer

Isaca CISM Quiz:136 Topic:1 Questions:676-680