CISM Practice Test

When scoping a risk assessment, assets need to be classified by:

A.

likelihood and impact

B.

sensitivity and criticality

C.

redundancy and recoverability.

D.

threats and opportunities

Executive leadership has decided to engage a consulting firm to develop and implement a
comprehensive security framework for the organization to allow senior management to
remain focused on business priorities. Which of the following poses the GREATEST
challenge to the successful implementation of the new security governance framework?

A.

Executive leadership becomes involved in decisions about information security
governance.

B.

Information security management does not fully accept the responsibility for information
security governance.

C.

Executive leadership views information security governance

Which of the following is the BEST course of action if the business activity residual risk is
lower than the acceptable risk level?

A.

Monitor the effectiveness of controls

B.

Review the risk probability and impact

C.

Review the inherent risk level

D.

Update the risk assessment framework.

Which of the following is BEST determined by using technical metrics?

A.

How well the security strategy is aligned with organizational objectives

B.

Whether security resources are adequately allocated

C.

How well security risk is being managed

D.

Whether controls are operating effectively

For an enterprise implementing a bring your own device (BYOD) program, which of the
following would provide the BEST security of corporate
data residing on unsecured mobile devices?

A.

Acceptable use policy

B.

Data loss prevention (DLP)

C.

Device certification processContainerization solution

D.

Containerization solution