QUESTION NO: 1393 During the security review of organizational servers, it was found
that a file server containingconfidential human resources (HR) data was accessible
to all user IDs. As a FIRST step, thesecurity manager should:A. copy sample files as
evidence.B. remove access privileges to the folder containing the data.C. report
this situation to the data owner.D. train the HR team on properly controlling file
permissions.Answer: CExplanation: The data owner should be notified prior to any
action being taken. Copying sample files asevidence is not advisable since it
breaches confidentiality requirements on the file. Removingaccess privileges to the
folder containing the data should be done by the data owner or by thesecurity
manager in consultation with the data owner, however, this would be done only
afterformally reporting the incident. Training the human resources (MR) team on
properly controllingfile permissions is the method to prevent such incidents in the
future, but should take place oncethe incident reporting and investigation
activities are completed.QUESTION NO: 1394 If an organization considers taking legal
action on a security incident, the information securitymanager should focus
PRIMARILY on:A. obtaining evidence as soon as possible.B. preserving the integrity
of the evidence.Isaca CISM Exam"Pass Any Exam. Any Time." - www.actualtests.com782
A risk profile support effective security decisions PRIMARILY because it:A. defines
how the best mitigate future risks.B. identifies priorities for risk reduction.C.
enables comparison with industry best practices.D. describes security
threats.Answer: BExplanation: QUESTION NO: 1431 The PRIMARY goal of a post-incident
review should be to:A. determine why the incident occurred.B. determine how to
improve the incident handling process.C. identify policy changes to prevent a
recurrence.D. establish the cost of the incident to the business.Answer:
CExplanation: QUESTION NO: 1432 Which of the following activities is used to
determine the effect of a disruptive event?Isaca CISM Exam"Pass Any Exam. Any Time."
- www.actualtests.com805
A. Require sign-off on acceptable use policies.B. Require regular security awareness
training.C. Provide detailed security procedures.D. Perform a gap analysis.Answer:
CExplanation: QUESTION NO: 1477 Which of the following is the MOST effective way to
address an organization's security concernsduring contract negotiations with a third
party?A. Ensure security is involved in the procurement process.B. Communicate
security policy with the third-party vendor.C. Review the third-party contract with
the organization's legal department.D. Conduct an information security audit on the
third-party vendor.Answer: AExplanation: QUESTION NO: 1478 Which of the following is
the BEST method to ensure that data owners take responsibility forimplementing
information security processes?Isaca CISM Exam"Pass Any Exam. Any Time." www.actualtests.com828
Explanation: QUESTION NO: 1518 What should be an information security manager's
FIRST course of action upon learning of asecurity threat that has occurred in the
industry for the first time?A. Update the relevant information security policy.B.
Perform a control gap analysis of the organization's environment.C. Revise the
organization's incident response plan.D. Examine responses of victims that have been
exposed to similar threats.Answer: BExplanation: QUESTION NO: 1519 An organization
was forced to pay a ransom to regain access to a critical database that had
beenencrypted in a ransomware attack. What would have BEST prevented the need to
make thisransom payment?A. Storing backups on a segregated networkB. Training
employees on ransomwareC. Ensuring all changes are approvedD. Verifying the firewall
is configured properlyIsaca CISM Exam"Pass Any Exam. Any Time." -
www.actualtests.com849
Answer: AExplanation: QUESTION NO: 1546 During an incident, which of the following
entities would MOST likely be contacted directly by anorganization's incident
response team without management approval?A. Industry regulatorsB. Technology
vendorC. Law enforcementD. Internal auditAnswer: DExplanation: QUESTION NO: 1547 The
BEST way to minimize errors in the response to an incident is to:A. follow standard
operating procedures.B. analyze the situation during the incident.C. implement
vendor recommendations.D. reference system administration manuals.Answer: AIsaca
CISM Exam"Pass Any Exam. Any Time." - www.actualtests.com863
Answer: AExplanation: QUESTION NO: 1564 When implementing a new risk assessment
methodology, which of the following is the MOSTimportant requirement?A. Risk
assessments must be conducted by certified staff.B. The methodology must be approved
by the chief executive officer.C. Risk assessments must be reviewed annually.D. The
methodology used must be consistent across the organization.Answer: DExplanation:
QUESTION NO: 1565 Over the last year, an information security manager has performed
risk assessments on multiplethird-party vendors. Which of the following criteria
would be MOST helpful in determining theassociated level of risk applied to each
vendor?A. Corresponding breaches associated with each vendorB. Compensating controls
in place to protect information securityC. Compliance requirements associated with
the regulationD. Criticality of the service to the organizationIsaca CISM Exam"Pass
Any Exam. Any Time." - www.actualtests.com872
Explanation: QUESTION NO: 1586 Which of the following is the BEST method to protect
against data exposure when a mobile deviceis stolen?A. Remote wipe capabilityB.
Password protectionC. InsuranceD. EncryptionAnswer: AExplanation: QUESTION NO: 1587
Which of the following is MOST helpful in protecting against hacking attempts on the
productionnetwork?A. Intrusion prevention systems (IPSs)B. Network penetration
testingC. Security information and event management (SIEM) toolsD. Decentralized
honeypot networksAnswer: AIsaca CISM Exam"Pass Any Exam. Any Time." www.actualtests.com883
Explanation: QUESTION NO: 1588 An information security manager has discovered an
external break-in to the corporate network.Which of the following actions should be
taken FIRST?A. Switch on trace logging.B. Copy event logs to a different server.C.
Isolate the affected portion of the network.D. Shut down the network.Answer:
CExplanation: QUESTION NO: 1589 Which of the following is MOST important for an
information security manager to verify whenselecting a third-party forensics
provider?A. Technical capabilities of the providerB. Existence of the provider’s
incident response planC. Results of the provider’s business continuity testsD.
Existence of a right-to-audit clauseAnswer: AIsaca CISM Exam"Pass Any Exam. Any
Time." - www.actualtests.com884
Explanation: QUESTION NO: 1590 An online trading company discovers that a network
attack has penetrated the firewall. Whatshould be the information security manager’s
FIRST response?A. Notify the regulatory agency of the incidentB. Evaluate the impact
to the business.C. Implement mitigating controlsD. Examine firewall logs to identify
the attacker.Answer: CExplanation: QUESTION NO: 1591 Which of the following is an
organization’s BEST approach for media communications whenexperiencing a disaster?A.
Defer public comment until partial recovery has been achieved.B. Report high-level
details of the losses and recovery strategy to the media.C. Authorize a qualified
representative to convey specially drafted messages.D. Hold a press conference and
advise the media to refer to legal authorities.Answer: CIsaca CISM Exam"Pass Any
Exam. Any Time." - www.actualtests.com885
Explanation: Isaca CISM Exam"Pass Any Exam. Any Time." - www.actualtests.com886