Download Free ISACA CISM Real Exam Questions Download [Q102-Q117]

4.6/5 - (5 votes)

Download Free ISACA CISM Real Exam Questions Download

Latest ISACA CISM Real Exam Dumps PDF

NO.102 An information security team has discovered that users are sharing a login account to an application with sensitive information, in violation of the access policy. Business management indicates that the practice creates operational efficiencies. What is the information security manager’s BEST course of action?

Enforce the policy.

Modify the policy.

Present the risk to senior management.

Create an exception for the deviation.

NO.103 An email digital signature will:

protect the confidentiality of an email message.

verify to recipient the integrity of an email message.

automatically correct unauthorized modification of an email message.

prevent unauthorized modification of an email message.

NO.104 An organization wants to migrate a proprietary application to be hosted by a third-party cloud hosting provider using a Platform as a Service (PaaS) model. Prior to selecting the cloud provider, what is MOST important for the organization to ensure?

The cloud provider can meet recovery point objectives (RPOs).

The cloud provider adheres to applicable regulations.

The cloud provider’s service level agreement (SLA) includes availability requirements.

The hosting contract has a termination clause.

NO.105 Labeling information according to its security classification:

affects the consequences if information is handled insecurely,

induces the number and type of counter measures required

enhances the likelihood of people handling information securely,

reduces the need to identify baseline controls for each classification.

NO.106 Which of the following eradication methods is MOST appropriate when responding to an incident resulting in malware on an application server?

Disconnect the system from the network.

Change passwords on the compromised system.

Restore the system from a known good backup.

Perform operation system hardening.

NO.107 Which of the following is the MOST important reason to consider the role of the IT service desk when developing incident handling procedures?

The service desk provides a source for the identification of security incidents.

Service desk personnel have information on how to resolve common systems issues

The service desk provides information to prioritize systems recovery based on user demand

Untrained service desk personnel may be a cause of security incidents.

NO.108 Which of the following is the BEST way to contain an SQL injection attack that has been detected by a web application firewall?

Force password changes on the SQL database.

Reconfigure the web application firewall to block the attack.

Update the detection patterns on the web application firewall.

Block the IPs from where the attack originates.

NO.109 A security incident has been reported within an organization When should an information security manager contact the information owner?

After the incident has been mitigated

After the incident has been confirmed.

After the potential incident has been togged

After the incident has been contained

NO.110 Which of the following should be the PRIMARY basis for establishing metrics that measure the effectiveness of an information security program?

Residual risk

Regulatory requirements

Risk tolerance

Control objectives

NO.111 Which of the following should be the FIRST step in patch management procedures when receiving an emergency security patch?

Schedule patching based on the criticality.

Install the patch immediately to eliminate the vulnerability.

Conduct comprehensive testing of the patch.

Validate the authenticity of the patch.

NO.112 An extranet server should be placed:

outside the firewall.

on the firewall server.

on a screened subnet.

on the external router.

NO.113 Prior to having a third party perform an attack and penetration test against an organization, the MOST important action is to ensure that:

the third party provides a demonstration on a test system.

goals and objectives are clearly defined.

the technical staff has been briefed on what to expect.

special backups of production servers are taken.

NO.114 What is the MOST important item to be included in an information security policy?

The definition of roles and responsibilities

The scope of the security program

The key objectives of the security program

Reference to procedures and standards of the security program

NO.115 Which of the following security mechanisms is MOST effective in protecting classified data that have been encrypted to prevent disclosure and transmission outside the organization’s network?

Configuration of firewalls

Strength of encryption algorithms

Authentication within application

Safeguards over keys

NO.116 Nonrepudiation can BEST be ensured by using:

strong passwords.

a digital hash.

symmetric encryption.

digital signatures.

NO.117 Data owners must provide a safe and secure environment to ensure confidentiality, integrity and availability of the transaction. This is an example of an information security:

baseline.

strategy.

procedure.

policy.

PDF (New 2025) Actual ISACA CISM Exam Questions: https://www.dumpleader.com/CISM_exam.html

Leave a Reply Cancel reply