Isaca CISM Online Practice Questions and Exam Preparation

Isaca CISM Online Questions & Answers

• Question 1:

  An information security manager is assisting in the development of the request for proposal (RFP) for a new outsourced service. This will require the third party to have access to critical business information. The security manager should focus

  PRIMARILY on defining:

  A. service level agreements (SLAs)
  B. security requirements for the process being outsourced.
  C. risk-reporting methodologies.
  D. security metrics
  B. security requirements for the process being outsourced.

  ---

  Explanation

  An information security manager is assisting in the development of the request for proposal (RFP) for a new outsourced service. This will require the third party to have access to critical business information. The security manager should focus primarily on defining security requirements for the process being outsourced. Security requirements are the specifications of what needs to be done to protect the information assets from unauthorized access, use, disclosure, modification, or destruction. Security requirements should be aligned with the organization's risk appetite and business objectives, and should cover both technical and organizational aspects of the service delivery. Security requirements should also be clear, concise, measurable, achievable, realistic, and testable.

  Security requirements for the process being outsourced are the specifications and standards that the third party must comply with to ensure the confidentiality, integrity and availability of the critical business information. They define the roles and responsi-bilities of both parties, the security controls and measures to be implemented, the se-curity objectives and expectations, the security risks and mitigation strategies, and the security monitoring and reporting mechanisms. Security requirements are essential to protect the information assets of the organization and to establish a clear and en-forceable contractual relationship with the third party.

  References:

  - 1

  Outsourcing Strategies for Information Security: Correlated Losses and Security Exter-nalities - SpringerLink

  - 2 What requirements must outsourcing services comply with for the European market? - CBI

  - 3 Outsourcing cybersecurity: What services to outsource, what to keep in house - Infosec Institute

  - 4 BCFSA outsourcing and information security guidelines - BLG

• Question 2:

  The PRIMARY purpose for conducting cybersecurity risk assessments is to:

  A. Assist in security reporting to senior management
  B. Provide metrics to indicate cybersecurity program effectiveness
  C. Verify compliance across multiple sectors
  D. Understand the organization's current security posture
  D. Understand the organization's current security posture

  ---

  Explanation

  The main goal of a cybersecurity risk assessment is to gain visibility into the organization's current security posture, identify vulnerabilities, evaluate threats, and understand the potential impact of various risks.

  "Risk assessments provide an understanding of the organization's threat landscape, asset vulnerabilities, and residual risk exposure." CISM Review Manual 15th Edition, Chapter 2: Risk Assessment and Risk Identification

  While assessments support reporting and compliance, their primary role is situational awareness.

• Question 3:

  Which of the following would provide the HIGHEST level of confidence in the integrity of data when sent from one party to another?

  A. Harden the communication infrastructure.
  B. Require files to be digitally signed before they are transmitted.
  C. Enforce multi-factor authentication on both ends of the communication.
  D. Require data to be transmitted over a secure connection.
  B. Require files to be digitally signed before they are transmitted.

• Question 4:

  Which of the following is the PRIMARY purpose of a business impact analysis (BIA)?

  A. To define security roles and responsibilities
  B. To determine return on investment (ROI)
  C. To establish incident severity levels
  D. To determine the criticality of information assets
  D. To determine the criticality of information assets

  ---

  Explanation

  A business impact analysis (BIA) is a process that identifies and evaluates the potential effects of disruptions to critical business operations as a result of a disaster, accident or emergency. The primary purpose of a BIA is to determine the criticality of information assets and the impact of their unavailability on the organization's mission, objectives and reputation. (From CISM Review Manual 15th Edition)

  References:

  CISM Review Manual 15th Edition, page 178, section 4.3.2.1.

• Question 5:

  An employee who is a remote user has copied financial data from the corporate server to a laptop using virtual private network (VPN) connectivity.

  Which of the following is the MOST important factor to determine if it should be classified as a data leakage incident?

  A. Review of the audit logs
  B. Ownership of the data
  C. Employee's job role
  D. Valid use case
  D. Valid use case

• Question 6:

  When building support for an information security program, which of the following elements is MOST important?

  A. Identification of existing vulnerabilities
  B. Information risk assessment
  C. Business impact analysis (BIA)
  D. Threat analysis
  C. Business impact analysis (BIA)

• Question 7:

  The PRIMARY advantage of performing black-box control tests as opposed to white-box control tests is that they:

  A. cause fewer potential production issues.
  B. require less IT staff preparation.
  C. simulate real-world attacks.
  D. identify more threats.
  C. simulate real-world attacks.

  ---

  Explanation

  The primary advantage of performing black-box control tests as opposed to white-box control tests is that they simulate real-world attacks. Black-box control tests are a software testing methodology in which the tester analyzes the functionality of an application without a thorough knowledge of its internal design. Conversely, in white-box control tests, the tester is knowledgeable of the internal design of the application and analyzes it during testing. By performing black- box control tests, the tester can mimic the perspective and behavior of an external attacker who does not have access to the source code or the implementation details of the application. This way, the tester can evaluate how the application responds to different inputs and scenarios, and identify any vulnerabilities or errors that may affect its functionality or security. The other options are not the primary advantage of performing black-box control tests, although they may be some benefits or drawbacks depending on the context. Causing fewer potential production issues is not necessarily true, as black-box control tests may still introduce errors or disruptions to the application if not performed carefully. Requiring less IT staff preparation is not always true, as black-box control tests may still require a lot of planning and documentation to ensure adequate test coverage and quality. Identifying more threats is not necessarily true, as black-box control tests may miss some threats that are hidden in the internal logic or structure of the application.

• Question 8:

  An organization that conducts business globally is planning to utilize a third-party service provider to process payroll information.

  Which of the following issues poses the GREATEST risk to the organization?

  A. The third party does not have an independent assessment of controls available for review.
  B. The third party has not provided evidence of compliance with local regulations where data is generated.
  C. The third-party contract does not include an indemnity clause for compensation in the event of a breach.
  D. The third party's service level agreement (SLA) does not include guarantees of uptime.
  B. The third party has not provided evidence of compliance with local regulations where data is generated.

  ---

  Explanation

  The third party's lack of compliance with local regulations poses the greatest risk to the organization, as it may expose the organization to legal, regulatory, or reputational consequences, such as fines, sanctions, lawsuits, or loss of customer trust. Payroll information is considered sensitive personal data that may be subject to different privacy and security laws depending on the jurisdiction where it is generated, processed, or stored. Therefore, the organization should ensure that the third party adheres to the applicable regulations and standards, and obtains the necessary certifications or attestations to demonstrate compliance.

  References:

  CISM Review Manual 2022, page 361; CISM Exam Content Outline, Domain 1, Task 1.22; Ensuring Vendor Compliance and Third-Party Risk Mitigation; How to Manage Access Risk Regarding Third-Party Service Providers

• Question 9:

  Which of the following should be the PRIMARY goal of information security?

  A. Information management
  B. Regulatory compliance
  C. Data governance
  D. Business alignment
  D. Business alignment

• Question 10:

  The MOST important reason for an information security manager to be involved in the change management process is to ensure that:

  A. security controls drive technology changes.
  B. risks have been evaluated.
  C. security controls are updated regularly.
  D. potential vulnerabilities are identified.
  B. risks have been evaluated.