CISM Day1

Which of the following requirements would have the lowest level of priority in information security?

• Technical

• Regulatory

• Privacy

• Business

The PRIMARY goal in developing an information security strategy is to:

• establish security metrics and performance monitoring

• educate business process owners regarding their duties

• ensure that legal and regulatory requirements are met.

• support the business objectives of the organization

Senior management commitment and support for information security can BEST be enhanced through:

• a formal security policy sponsored by the chief executive officer (CEO).

• regular security awareness training for employees.

• periodic review of alignment with business management goals.

• senior management signoff on the information security strategy

Which of the following MOST commonly falls within the scope of an information security governance steering committee?

• Interviewing candidates for information security specialist positions

• Developing content for security awareness programs

• Prioritizing information security initiatives

• Approving access to critical financial systems

Which of the following is the MOST important factor when designing information security architecture?

• Technical platform interfaces

• Scalability of the network

• Development methodologies

• Stakeholder requirements

What will have the HIGHEST impact on standard information security governance models?

• Number of employees

• Distance between physical locations

• Complexity of organizational structure

• Organizational budget

In order to highlight to management the importance of integrating information security in the business processes, a newly hired information security officer should

FIRST:

• prepare a security budget.

• conduct a risk assessment.

• develop an information security policy.

• obtain benchmarking information.

An outcome of effective security governance is:

• business dependency assessment.

• strategic alignment.

• risk assessment.

• planning.

How would an information security manager balance the potentially conflicting requirements of an international organization’s security standards and local regulation?

• Give organization standards preference over local regulations

• Follow local regulations only

• Make the organization aware of those standards where local regulations causes conflicts

• Negotiate a local version of the organization standards

Which of the following should drive the risk analysis for an organization?

• Senior management

• Security manager

• Quality manager

• Legal department