Get Sep-2026 updated CISM Certification Exam Sample Questions [Q519-Q539]

Rate this post

Get Sep-2026 updated CISM Certification Exam Sample Questions

CISM Study Guide Cover to Cover as Literally

QUESTION 519
An organization’s IT department is undertaking a large virtualization project to reduce its physical server footprint. Which of the following should be the HIGHEST priority of the information

Selecting the virtualization software

Determining how incidents will be managed

Being involved at the design stage of the project

Ensuring the project has appropriate security funding

QUESTION 520
Documented standards/procedures for the use of cryptography across the enterprise should PRIMARILY:

define the circumstances where cryptography should be used.

define cryptographic algorithms and key lengths.

describe handling procedures of cryptographic keys.

establish the use of cryptographic solutions.

QUESTION 521
Obtaining senior management support for establishing a warm site can BEST be accomplished by:

establishing a periodic risk assessment.

promoting regulatory requirements.

developing a business case.

developing effective metrics.

QUESTION 522
When identifying legal and regulatory issues affecting information security, which of the following would represent the BEST approach to developing information security policies?

Create separate policies to address each regulation

Develop policies that meet all mandated requirements

Incorporate policy statements provided by regulators

Develop a compliance risk assessment

QUESTION 523
A measure of the effectiveness of the incident response capabilities of an organization is the:

reduction of the annual loss expectancy (ALE).

time to closure of incidents.

number of employees receiving incident response training.

number of incidents detected.

QUESTION 524
For an enterprise implementing a bring your own device (BYOD) program, which of the following would provide the BEST security of corporate data residing on unsecured mobile devices?

Acceptable use policy

Device certification process

Containerization solution

Data loss prevention (DLP)

QUESTION 525
A new regulation has been announced that requires mandatory reporting of security incidents that affect personal client information. Which of the following should be the information security manager’s FIRST course of action?

Review the current security policy.

Inform senior management of the new regulation.

Update the security incident management process.

Determine impact to the business.

QUESTION 526
Which of the following is the MOST important requirement for setting up an information security infrastructure for a new system?

Performing a business impact analysis (BIA)

Considering personal information devices as pan of the security policy

Initiating IT security training and familiarization

Basing the information security infrastructure on risk assessment

QUESTION 527
Which of the following BEST enables an organization to enhance its incident response plan processes and procedures?

Security risk assessments

Lessons learned analysis

Information security audits

Key performance indicators (KPIs)

QUESTION 528
An information security manager wishing to establish security baselines would:

include appropriate measurements in the system development life cycle.

implement the security baselines to establish information security best practices.

implement the security baselines to fulfill laws and applicable regulations in different jurisdictions.

leverage information security as a competitive advantage.

QUESTION 529
An information security team is planning a security assessment of an existing vendor. Which of the following approaches is MOST helpful for properly scoping the assessment?

Focus the review on the infrastructure with the highest risk

Review controls listed in the vendor contract

Determine whether the vendor follows the selected security framework rules

Review the vendor’s security policy

QUESTION 530
Which of the following would BEST address the risk of data leakage?

File backup procedures

Database integrity checks

Acceptable use policies

Incident response procedures

QUESTION 531
What should be the FIRST step when an Internet of Things (loT) device in an organization’s network is confirmed to have been hacked?

Monitor the network.

Perform forensic analysis.

Disconnect the device from the network,

Escalate to the incident response team

QUESTION 532
A penetration test against an organization’s external web application shows several vulnerabilities. Which of the following presents the GREATEST concern?

A rules of engagement form was not signed prior to the penetration test

Vulnerabilities were not found by internal tests

Vulnerabilities were caused by insufficient user acceptance testing (UAT)

Exploit code for one of the vulnerabilities is publicly available

QUESTION 533
Which of the following risks would BEST be assessed using qualitative risk assessment techniques?

Theft of purchased software

Power outage lasting 24 hours

Permanent decline in customer confidence

Temporary loss of e-mail due to a virus attack

QUESTION 534
A newly appointed information security manager has been asked to update all security-related policies and procedures that have been static for five years or more. What should be done NEXT?

Update in accordance with the best business practices.

Perform a risk assessment of the current IT environment.

Gain an understanding of the current business direction.

Inventory and review current security policies.

QUESTION 535
When performing a business impact analysis (BIA), who should be responsible for determining the initial recovery time objective (RTO)?

External consultant

Information owners

Information security manager

Business continuity coordinator

QUESTION 536
Application data integrity risk is MOST directly addressed by a design that includes:

reconciliation routines such as checksums, hash totals, and record counts.

strict application of an authorized data dictionary.

application log requirements such as field-level audit trails and user activity logs.

access control technologies such as role-based entitlements.

QUESTION 537
For virtual private network (VPN) access to the corporate network, the information security manager is requiring strong authentication. Which of the following is the strongest method to ensure that logging onto the network is secure?

Biometrics

Symmetric encryption keys

Secure Sockets Layer (SSL)-based authentication

Two-factor authentication

QUESTION 538
Which of the following would BEST help to ensure compliance with an organization’s information security requirements by an IT service provider?

Requiring an external security audit of the IT service provider

Defining the business recovery plan with the IT service provider

Defining information security requirements with internal IT

Requiring regular reporting from the IT service provider

QUESTION 539
Which of the following is the MOST important function of an information security steering committee?

Assigning data classifications to organizational assets

Developing organizational risk assessment processes

Obtaining multiple perspectives from the business

Defining security standards for logical access controls