CISM Practice Test

A n employee has just reported the loss of a personal mobile device containing corporate
information. Which of the following should the information security manager do FIRST?

A.

Initiate a device reset.

B.

Initiate incident response.

C.

Disable remote access.

D.

Conduct a risk assessment.

Which of the following will MOST effectively minimize the chance of inadvertent disclosure
of confidential information?

A.

Following the principle of least privilege

B.

Restricting the use of removable media

C.

Applying data classification rules

D.

Enforcing penalties for security policy violations

An organization's IT department needs to implement security patches. Recent reports
indicate these patches could result in stability issues. Which of the following is the
information security manager's
BEST recommendation?

A.

Research compensating security controls

B.

Research alternative software solutions

C.

Evaluate the patches in a test environment

D.

Increase monitoring after patch implementation

Which of the following should be the PRIMARY driver for delaying the delivery of an information security awareness program?

A.

Risk appetite

B.

Change in senior management

C.

High employee turnover

D.

Employee acceptance

A critical server for a hospital has been encrypted by ransomware. The hospital is unable to
function effectively without this server. Which of the
following would MOST effectively allow the hospital to avoid paying the ransom?

A.

A continual server replication process

B.

Employee training on ransomware

C.

A property configured firewall

D.

properly tested offline backup system