Isaca CISM Certified Information Security Manager Exam Exam Practice Test Questions

• Question 1

  - (Exam Topic 2) Which of the following is MOST important to convey to employees in building a security risk-aware culture?

  • Personal information requires different security controls than sensitive information.
  • Employee access should be based on the principle of least privilege.
  • Understanding an information asset's value is critical to risk management.
  • The responsibility for security rests with all employees.

  Show Answer Answer: D Next

• Question 2

  - (Exam Topic 2) The BEST way to ensure that frequently encountered incidents are reflected in the user security awareness training program is to include:

  • results of exit interviews.
  • previous training sessions.
  • examples of help desk requests.
  • responses to security questionnaires.

  Show Answer Answer: C Next

• Question 3

  - (Exam Topic 1) An organization recently outsourced the development of a mission-critical business application. Which of the following would be the BEST way to test for the existence of backdoors?

  • Scan the entire application using a vulnerability scanning tool.
  • Run the application from a high-privileged account on a test system.
  • Perform security code reviews on the entire application.
  • Monitor Internet traffic for sensitive information leakage.

  Show Answer Answer: C Next

• Question 4

  - (Exam Topic 1) Which of the following is MOST important to ensure when developing escalation procedures for an incident response plan?

  • Each process is assigned to a responsible party.
  • The contact list is regularly updated.
  • Minimum regulatory requirements are maintained.
  • Senior management approval has been documented.

  Show Answer Answer: B Next

• Question 5

  - (Exam Topic 3) An information security manager has identified that security risks are not being treated in a timely manner. Which of the following

  • Provide regular updates about the current state of the risks.
  • Re-perform risk analysis at regular intervals.
  • Assign a risk owner to each risk
  • Create mitigating controls to manage the risks.

  Show Answer Answer: B Next