Isaca CISM Quiz 296 Topic 4 Questions 1476-1480

Question: 1

When selecting metrics to monitor the risks associated with an information security program, it is MOST

important for an information security manager to:

Aleverage industry benchmarks.

Bconsider the organization's business strategy.

Cidentify the program's risk and compensating controls.

Dconsider the strategic objectives of the program.

Show Answer

Question: 2

Which of the following is the PRIMARY reason to conduct a post-incident review?

ATo determine whether digital evidence is admissible

BTo improve the response process

CTo notify regulatory authorities

DTo aid in future risk assessments

Show Answer

Question: 3

Which of the following is the FIRST step when assessing risk?

AIdentifying vulnerabilities

BIdentifying assets

CAnalyzing existing threats

DAnalyzing existing controls

Show Answer

Question: 4

Which of the following is MOST helpful in identifying external and internal factors that could influence the organization's future information security posture?

ASWOT analysis

BPenetration testing

CCurrent risk tolerance

DIT balanced scorecard

Show Answer

Question: 5

An organization plans to process marketing data using a Software as a Service (SaaS) application via the Internet To mitigate the associated risk, what is the information security manager's MOST important course of action?

AInclude service level agreements (SLAs) in the contract

BEvaluate the application functionality

CInclude right to audit in the contract

DConduct a vendor security assessment

Show Answer

Isaca CISM Quiz:296 Topic:4 Questions:1476-1480