Isaca CISM Exam - Topic 3 Question 74 Discussion

Actual exam question for Isaca's CISM exam

Question #: 74
Topic #: 3

[All CISM Questions]

Which of the following is MOST helpful in determining an organization's current capacity to mitigate risks?

ACapability maturity model

BVulnerability assessment

CIT security risk and exposure

DBusiness impact analysis (BIA)

Show Suggested Answer

Suggested Answer: C

Data encryption standards are the best information security initiative for creating an enterprise strategy for protecting data across multiple data repositories and different departments because they help to ensure the confidentiality, integrity, and availability of data in transit and at rest. Data encryption is a process of transforming data into an unreadable format using a secret key or algorithm, so that only authorized parties can access and decrypt it. Data encryption standards are the rules or specifications that define how data encryption should be performed, such as the type, strength, and mode of encryption, the key management and distribution methods, and the compliance requirements. Data encryption standards help to protect data from unauthorized access, modification, or theft, as well as to meet the regulatory obligations for data privacy and security. Therefore, data encryption standards are the correct answer.

https://www.techtarget.com/searchdatabackup/tip/20-keys-to-a-successful-enterprise-data-protection-strategy

https://cloudian.com/guides/data-protection/data-protection-strategy-10-components-of-an-effective-strategy/

https://www.veritas.com/information-center/enterprise-data-protection

by Roxane at May 23, 2024, 11:07 AM

Limited Time Offer

25%

Off

Get Premium CISM Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Luis

3 months ago

Surprised that people aren't mentioning IT security risk and exposure!

upvoted 0 times

...

Kristofer

3 months ago

Capability maturity model helps too, but I lean towards B.

upvoted 0 times

...

Mabel

3 months ago

Wait, isn't a business impact analysis more about potential impacts than current capacity?

upvoted 0 times

...

Lilli

4 months ago

Totally agree, B is the way to go!

upvoted 0 times

...

Cordelia

4 months ago

I think a vulnerability assessment is key for understanding current risks.

upvoted 0 times

...

Gaston

4 months ago

Business impact analysis sounds familiar, but I can't recall if it's more about understanding impacts rather than assessing current risk capacity.

upvoted 0 times

...

Jonelle

4 months ago

I feel like IT security risk and exposure could be a strong contender here, especially since it focuses on actual risks faced by the organization.

upvoted 0 times

...

Jennie

4 months ago

I remember practicing with vulnerability assessments in class; they seem crucial for identifying weaknesses, but is that what they mean by "current capacity"?

upvoted 0 times

...

Lura

5 months ago

I think the Capability Maturity Model might be relevant, but I'm not entirely sure how it directly relates to risk mitigation.

upvoted 0 times

...

Charlie

5 months ago

I feel pretty confident that the capability maturity model is the best answer here. It gives a comprehensive view of an organization's risk management processes and capabilities.

upvoted 0 times

...

Pearlie

5 months ago

The business impact analysis (BIA) could also provide useful insights into the organization's risk mitigation capabilities. I'll need to review my notes on these different risk assessment frameworks.

upvoted 0 times

...

Effie

5 months ago

This seems like a straightforward question about risk management. I think the capability maturity model would be the most helpful in determining an organization's current risk mitigation capacity.

upvoted 0 times

...

Vanda

5 months ago

Hmm, I'm not sure about this one. The vulnerability assessment and IT security risk and exposure options also seem relevant. I'll have to think this through carefully.

upvoted 0 times

...

Frederica

5 months ago

I'm a bit confused by some of the terminology in this question. I'll need to review my notes to make sure I'm interpreting everything correctly.

upvoted 0 times

...

Arlyne

5 months ago

I'm not totally sure about this one. I don't want to just tell the customer they're wrong, but I also don't want to share their story with colleagues without their permission. I'll have to re-read the question and options carefully.

upvoted 0 times

...

Winfred

5 months ago

I remember something about the certificate name needing to match. That feels like it could be one of the reasons.

upvoted 0 times

...

Gerald

10 months ago

I'd just build a giant flamethrower to burn down the risks. Problem solved!

upvoted 0 times

Jesusita

8 months ago

C: IT security risk and exposure could also provide valuable insights into our organization's current risk mitigation capabilities.

upvoted 0 times

...

Ernest

8 months ago

B: I agree, a vulnerability assessment would give us a better understanding of where our weaknesses are.

upvoted 0 times

...

Yuriko

9 months ago

A: That might not be the most effective solution. We should consider using a vulnerability assessment to determine our current capacity to mitigate risks.

upvoted 0 times

...

Cherry

10 months ago

Wait, which one lets me use the most buzzwords? I'm going with IT security risk and exposure - that's got to be the winner!

upvoted 0 times

...

Jesusa

10 months ago

Business impact analysis, for sure! That's where you really get to the heart of the organization's risk exposure.

upvoted 0 times

Sharee

8 months ago

Capability maturity model can also provide valuable insights into the organization's risk management capabilities.

upvoted 0 times

...

Tamesha

8 months ago

I think vulnerability assessment is also important to identify potential weaknesses.

upvoted 0 times

...

Evelynn

9 months ago

I agree, business impact analysis is crucial for understanding the risks.

upvoted 0 times

...

Maryann

10 months ago

I think the vulnerability assessment is the way to go. Gotta know where the weaknesses are before you can start mitigating, right?

upvoted 0 times

Verdell

8 months ago

Definitely, vulnerability assessment is crucial for identifying weaknesses.

upvoted 0 times

...

Ailene

8 months ago

I agree, knowing the vulnerabilities is key to improving security.

upvoted 0 times

...

Skye

8 months ago

D) Business impact analysis (BIA)

upvoted 0 times

...

Dacia

8 months ago

C) IT security risk and exposure

upvoted 0 times

...

Ryan

8 months ago

B) Vulnerability assessment

upvoted 0 times

...

Nicolette

9 months ago

A) Capability maturity model

upvoted 0 times

...

Ligia

10 months ago

Hmm, a capability maturity model sounds like the right approach to me. It's all about assessing the organization's overall security posture, isn't it?

upvoted 0 times