Isaca CISM Quiz 228 Topic 3 Questions 1136-1140

Question: 1

Which of the following will BEST ensure that risk is evaluated on system level changes?

ASenior management must sign-off on changes.

BSecurity should be integrated in the change control process.

CSystem development staff receives regular security training.

DImplement a centralized change management system.

Show Answer

Question: 2

Which of the following stakeholders would provide the BEST guidance in aligning the information security strategy with organizational goals?

ABoard of directors

BChief information officer (CIO)

CChief information security officer (CISO)

Dinformation security steering committee

Show Answer

Question: 3

Which of the following is MOST relevant for an information security manager to communicate to business units?

ARisk ownership

BVulnerability assessments

CBusiness impact analysis (BIA)

DThreat assessments

Show Answer

Question: 4

Which of the following metrics would provide management with the MOST useful information about the effectiveness of a security awareness program?

ADecreased number of phishing attacks

BDecreased number of security incidents

CIncreased number of reported security incidents

DIncreased number of downloads of the organization's security policy

Show Answer

Question: 5

When aligning an organization's information security program with other risk and control activities, it is MOST important to:

Aensure adequate financial resources are available,.

Bhave information security management report to the chief risk officer.

Cintegrate security within the system development life cycle.

Ddevelop an information security governance framework.

Show Answer

Isaca CISM Quiz:228 Topic:3 Questions:1136-1140