CISM Practice Test

A large organization is in the process of developing its information security program that
involves working with several complex o organizational functions. Which of the following
will BEST enable the successful implementation of this program?

A.

Security policy

B.

Security metrics

C.

Security governance

D.

Security guidelines

An executive's personal mobile device used for business purposes is reported lost. The
information security manager should respond based on:

A.

asset management guidelines

B.

the acceptable use policy

C.

the business impact analysis (BIA),

D.

incident classification

The ULTIMATE responsibility for ensuring the objectives of an information security
framework are being met belongs to:

A.

the steering committee

B.

the board of directors

C.

the internal audit manager.

D.

the information security officer.

Which of the following is MOST important to consider when determining the effectiveness
of the information security governance program?

A.

Risk tolerance levels

B.

Key risk indicators (KRIs)

C.

Maturity models

D.

Key performance indicators (KPIs)

An information security manager discovers that the organization's new information security
policy is not being followed across all departments, Which of the following should be of
GREATEST concern to the information security manager?

A.

Different communication methods may be required for each business unit.

B.

The corresponding controls are viewed as prohibitive to business operations

C.

The wording of the policy is not tailored to the audience.

D.

Business unit management has not emphasized the importance of the new policy