Free ISACA CISM Exam Dumps Questions & Answers

Which of the following is the PRIMARY objective of a cyber resilience strategy?

• A.  Regulatory compliance
• B.  Business continuity
• C.  Executive support
• D.  Employee awareness

An organization plans to utilize Software as a Service (SaaS) and is in the process of selecting a vendor. What should the information security manager do FIRST to support this initiative?

• A.  Review independent security assessment reports for each vendor.
• B.  Analyze the risks and propose mitigating controls.
• C.  Define information security requirements and processes.
• D.  Benchmark each vendor ' s services with industry best practices.

An information security manager has been made aware of a new data protection regulation that will soon go into effect. Which of the following is the BEST way to manage the risk of noncompliance?

• A.  Implement a program of work to comply with the new legislation.
• B.  Understand the cost of noncompliance.
• C.  Consult with senior management on the best course of action.
• D.  Perform a gap analysis.

Which of the following will BEST enable an organization to meet incident response requirements when outsourcing its incident response function?

• A.  Including a right-to-audit clause in service level agreements (SLAs)
• B.  Requiring comprehensive response applications and tools
• C.  Contracting with a well-known incident response provider
• D.  Including response times in service level agreements (SLAs)

When taking a risk-based approach to vulnerability management, which of the following is MOST important to consider when prioritizing a vulnerability?

• A.  Whether patches have been developed and tested
• B.  The information available about the vulnerability
• C.  The sensitivity of the asset and the data it contains
• D.  IT resource availability and constraints