CISM Exam Dumps - Isaca Certification Questions and Answers

Local regulations are the main concern for the information security manager when implementing a corporate security policy for managing PII, as different countries or regions may have different legal, regulatory or contractual requirements for the protection, processing, storage and transfer of PII. The information security manager should ensure that the policy complies with the applicable local regulations and respects the rights and preferences of the data subjects. The policy should also address the risks and challenges of cross-border data transfers and the use of cloud services.

References = CISM Review Manual, 27th Edition, Chapter 4, Section 4.2.1, page 2191; CISM Online Review Course, Module 4, Lesson 2, Topic 12; Comparitech, PII Compliance: What is it and How to Implement it3

 Role-based access control (RBAC) is a policy-neutral access control mechanism that assigns access privileges to defined roles in the organization and then makes each user a member of the appropriate roles. RBAC reduces security administration efforts by simplifying the management of access rights across different users and resources. RBAC also enables consistent and efficient enforcement of the principle of least privilege, which grants users only the minimum rights required to perform their assigned tasks. RBAC can also facilitate the implementation of separation of duties, which prevents users from having conflicting or incompatible responsibilities. RBAC is among the most widely used methods in the information security tool kit1. References = CIS Control 6: Access Control Management - Netwrix, CISSP certification: RBAC (Role based access control), What is RBAC? (Role Based Access Control) - IONOS

During the initiation phase of the system development life cycle (SDLC) for a software project, information security activities should address security objectives, which are derived from the business objectives and the risk assessment. Security objectives define the desired level of protection for the system and its data, and guide the selection of security controls in later phases. Baseline security controls are predefined sets of security requirements that apply to common types of systems or environments. Benchmarking security metrics is a process of comparing the performance of security processes or controls against a standard or best practice. Cost-benefit analyses are used to evaluate the feasibility and effectiveness of security controls, and are usually performed in the acquisition/development phase or the implementation phase of the SDLC. References = CISM Review Manual, 16th Edition, page 1021; CISM Review Questions, Answers & Explanations Manual, 10th Edition, page 772

Learn more:

1. isaca.org2. amazon.com3. gov.uk

The correct answer is C because standards define mandatory minimum requirements and baselines that must be followed to comply with policy. In information security governance, policies state management intent and high-level requirements, while standards translate those requirements into specific mandatory control baselines. For example, a password policy may state that access must be protected, while a password standard defines minimum length, complexity, history, and expiration requirements. Procedures provide step-by-step instructions for performing tasks, and guidelines provide recommended but usually nonmandatory advice. The question asks specifically for the minimum technical baseline, which is the function of standards. Standards ensure consistency across systems, technologies, and business units by defining the minimum acceptable level of security. This supports governance, compliance, and control implementation. In CISM practice, policies, standards, procedures, and guidelines form a hierarchy, with standards serving as enforceable requirements derived from policy.

Purchasing cybersecurity insurance is a textbook example of risk transfer — transferring financial risk to a third party (the insurer).

“Risk transfer shifts the impact of a risk to another party, such as through insurance or outsourcing.”

— CISM Review Manual 15th Edition, Chapter 2: Risk Management, Section: Risk Treatment*

Information security program metrics are the best way to demonstrate the status of an organization’s information security program to the board of directors, as they provide relevant and meaningful information on the performance, effectiveness, and value of the program, as well as the current and emerging risks and the corresponding mitigation strategies. Information security program metrics should be aligned with the business objectives and risk appetite of the organization, and should be presented in a clear and concise manner that enables the board of directors to make informed decisions and provide oversight. (From CISM Review Manual 15th Edition)

The correct answer is A because regular security awareness training is the most effective method for communicating general information security responsibilities to all personnel. Awareness training reinforces expected behaviors, reporting obligations, policy requirements, and individual accountability in a way that employees can understand and apply in daily work. Requiring staff to sign confidentiality agreements is important, but it mainly creates legal acknowledgment and does not ensure understanding of broader security responsibilities. Publishing the information security policy on the intranet makes the policy available, but passive publication is not enough to confirm communication or understanding. A RACI matrix is useful for defining roles and responsibilities for specific processes or functions, but it is generally too detailed and role-specific to communicate broad responsibilities across the entire organization. CISM emphasizes that security awareness, communication, and training are essential to building a security-aware culture and ensuring that all individuals understand their responsibilities for protecting information assets.

Reimaging the systems (B) is the most reliable method to eradicate malware because it ensures complete removal of malicious code, including hidden persistence mechanisms. Malware scanning (A) may miss advanced threats, while blocking access (C) is a containment action, not eradication. Vulnerability assessments (D) help identify weaknesses but do not remove existing malware. CISM incident management guidance prioritizes thorough eradication to prevent reinfection and restore system integrity.

The most important information for influencing management’s support of information security is an demonstration of alignment with the business strategy because it shows how information security contributes to the achievement of the organization’s goals and objectives, and adds value to the organization’s performance and competitiveness. An identification of the overall threat landscape is not very important because it does not indicate how information security addresses or mitigates the threats or risks. A report of a successful attack on a competitor is not very important because it does not indicate how information security prevents or responds to such attacks. An identification of organizational risks is not very important because it does not indicate how information security manages or reduces the risks. References: https://www.isaca.org/resources/isaca-journal/issues/2016/volume-4/technical-security-standards-for-information-systems https://www.isaca.org/resources/isaca-journal/issues/2017/volume-2/how-to-align-security-initiatives-with-business-goals-and-objectives

Integrating security activities within the development process is the best option to lower the cost to implement application security controls because it ensures that security is considered and addressed throughout the software development life cycle (SDLC), from design to deployment, and reduces the likelihood and impact of security flaws or vulnerabilities that may require costly fixes or patches later on. Performing security tests in the development environment is not the best option because it may not detect or prevent all security issues that may arise in different environments or scenarios. Performing a risk analysis after project completion is not a good option because it may be too late to identify or mitigate security risks that may have been introduced during the project. Including standard application security requirements is not a good option because it may not account for specific or unique security needs or challenges of different applications or projects. References: https://www.isaca.org/resources/isaca-journal/issues/2017/volume-2/secure-software-development-lifecycle https://www.isaca.org/resources/isaca-journal/issues/2016/volume-4/technical-security-standards-for-information-systems

The first step should be to identify all information assets in the legacy environment . Managing security risk during data transfer requires understanding what data and information assets exist before evaluating impact, assigning ownership, testing, or selecting controls. CISM risk management emphasizes that asset identification is foundational because organizations cannot protect, classify, transfer, or assign accountability for assets they do not know exist. A business impact analysis may help prioritize critical processes and recovery requirements, but it does not replace the need to identify the data assets being transferred. Security testing of legacy systems may be useful later, especially if the systems remain operational during migration, but it is not the first step. Assigning owners is necessary, but ownership can only be accurately assigned after assets are identified. Unsupported legacy systems often contain undocumented data, obsolete interfaces, and unknown dependencies. Therefore, the first risk management activity must be creating an accurate inventory of information assets in the legacy environment.

= The method of operation used by the attacker is the most useful information for an information security manager when conducting a post-incident review of an attack. This information can help identify the root cause of the incident, the vulnerabilities exploited, the impact and severity of the attack, and the effectiveness of the existing security controls. The method of operation can also provide insights into the attacker’s motives, skills, and resources, which can help improve the organization’s threat intelligence and risk assessment. The cost of the attack to the organization, the location of the attacker, and the details from IDS logs are all relevant information for a post-incident review, but they are not as useful as the method of operation for improving the incident handling process and preventing future attacks. References = CISM Review Manual 2022, page 316; CISM Item Development Guide 2022, page 9; ISACA CISM: PRIMARY goal of a post-incident review should be to?

A business case best demonstrates return on investment in risk management when requesting investment in new tools. In CISM, a business case connects the proposed investment to business objectives, risk reduction, cost, benefits, alternatives, and expected value. For a BYOD policy expanded to include wearable technologies, management needs to understand why new tools are required, what risks they reduce, what costs are involved, and how the investment supports acceptable risk levels. A risk assessment is an important input because it identifies and analyzes risks associated with wearable technologies, but it does not itself demonstrate ROI. A risk audit report provides assurance or findings, not the investment justification. A BIA supports continuity planning and impact prioritization, but it is not the best document for presenting investment value. The strategy committee needs a decision-oriented justification. Therefore, the business case is the best answer because it translates security needs and risk reduction into management-level investment rationale.

The most effective way to prevent information security incidents is to implement a security awareness training program for employees. Security awareness training provides employees with the knowledge and skills they need to identify potential security threats and protect their systems from unauthorized access and malicious activity. Security awareness training also helps to ensure that employees understand their roles and responsibilities when it comes to information security, and can help to reduce the risk of information security incidents by making employees more aware of potential risks. Additionally, implementing a security information and event management (SIEM) tool, deploying a consistent incident response approach, and deploying intrusion detection tools in the network environment can also help to reduce the risk of security incidents