Discuss Isaca CISM Exam Topic 6 Question 64

Which of the following is the PRIMARY role of the information security manager in application development?

ATo ensure security is integrated into the system development life cycle (SDLC)

BTo ensure compliance with industry best practice

CTo ensure enterprise security controls are implemented

DTo ensure control procedures address business risk

Suggested Answer: A

When preventive controls to appropriately mitigate risk are not feasible, the most important action for the information security manager is to manage the impact, which means taking measures to reduce the likelihood or severity of the consequences of the risk. Managing the impact can involve using alternative controls, such as engineering, administrative, or personal protective controls, that can lower the exposure or harm to the organization. The other options, such as identifying unacceptable risk levels, assessing vulnerabilities, or evaluating potential threats, are part of the risk assessment process, but they are not actions to mitigate risk when preventive controls are not feasible. Reference:

https://bcmmetrics.com/risk-mitigation-evaluating-your-controls/

https://www.osha.gov/safety-management/hazard-prevention

https://www.cdc.gov/niosh/topics/hierarchy/default.html

Get Premium CISM Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

43 comments · newest first

Malcolm 10 months ago

D sounds good, but isn't it more about the overall security strategy?

Wenona 11 months ago

Wow, I didn't realize how much security impacts development!

Catarina 11 months ago

C is crucial too, but I think A is the primary focus.

Martina 11 months ago

I’m not so sure, B seems just as important for compliance.

Kristofer 11 months ago

Definitely A, integrating security in SDLC is key!

Alpha 12 months ago

I’m leaning towards ensuring control procedures address business risk, but I could see how integrating security into the SDLC is also critical.

Trevor 12 months ago

I feel like implementing enterprise security controls is important too, but it might not be the main focus during development.

Genevive 12 months ago

I remember a practice question that focused on compliance with industry best practices, but that might be more of a secondary role.

Merri 1 year ago

I think the primary role is to ensure security is integrated into the SDLC, but I'm not completely sure.

Gregg 1 year ago

I'm feeling pretty confident about this one. Based on my understanding, the information security manager's primary role in application development is to ensure security is integrated into the SDLC. That seems like the most fundamental and important responsibility.

Nakisha 1 year ago

I'm a little confused by this question. All the options seem relevant to the information security manager's role, so it's hard to pick just one as the "primary" responsibility. I'll need to think this through carefully.

Claudia 1 year ago

Okay, I think I've got this. The primary role of the information security manager is to ensure security is integrated into the system development life cycle (SDLC). That makes the most sense to me as the core responsibility.

Winifred 1 year ago

Hmm, I'm a bit unsure about this one. The options all seem related to the information security manager's role, but I'm not sure which one is the "primary" responsibility. I'll need to re-read the question and options closely.

Devon 1 year ago

This seems like a straightforward question about the role of the information security manager in application development. I'll need to carefully consider the options and think about which one best describes the primary responsibility.

Aleta 1 year ago

I'm a bit confused by the different options. I'll need to double-check the schema and make sure I understand how to properly associate a device with the AddUser operation.

Yuki 1 year ago

Hmm, I'm a bit unsure about this one. I know ulimit is used for setting resource limits, but I can't remember if it's specifically for core file size. I'll have to think this through carefully.

Elke 1 year ago

My notes say DNS plays a key role in routing decisions, so I'm leaning towards true for this one!

Brendan 1 year ago

Hmm, I'm a bit unsure about this one. I know the contract is important, but I'm not sure if that's the only mechanism the customer has. Let me re-read the question and think through the options.

Hayley 1 year ago

I'm with Dorthy on this one. The security manager's job is to make sure the developers don't accidentally unleash a new cybersecurity nightmare. Option A is the way to go, folks!

Claudia 1 year ago

↳ replying to Hayley

C) To ensure enterprise security controls are implemented

Martina 1 year ago

↳ replying to Hayley

B) To ensure compliance with industry best practice

Chana 1 year ago

↳ replying to Hayley

D) To ensure control procedures address business risk

Tamar 1 year ago

↳ replying to Hayley

C) To ensure enterprise security controls are implemented

Daniel 1 year ago

↳ replying to Hayley

A) To ensure security is integrated into the system development life cycle (SDLC)

Fanny 1 year ago

↳ replying to Hayley

A) To ensure security is integrated into the system development life cycle (SDLC)

Bronwyn 1 year ago

While the other options are important, option A really gets to the heart of the matter. Security should be a fundamental part of the development process, not an afterthought.

Cecil 1 year ago

↳ replying to Bronwyn

I agree, security should definitely be integrated into the development process.

Leota 1 year ago

↳ replying to Bronwyn

D) To ensure control procedures address business risk

Una 1 year ago

↳ replying to Bronwyn

C) To ensure enterprise security controls are implemented

Alecia 1 year ago

↳ replying to Bronwyn

A) To ensure security is integrated into the system development life cycle (SDLC)

Dorthy 1 year ago

Haha, good one. The information security manager's role is to ensure the developers don't accidentally create the next 'Heartbleed' or 'Shellshock' disaster. Option A all the way!

Ellen 1 year ago

I'm leaning towards option D. At the end of the day, the security manager needs to make sure the controls address the actual business risks, not just some generic industry standards.

Jeff 1 year ago

↳ replying to Ellen

User 2: I agree, but I still think D is the primary role to address specific business risks.

Lezlie 1 year ago

↳ replying to Ellen

User 1: I think option A is also important to make sure security is integrated from the start.

Marci 1 year ago

↳ replying to Ellen

User 2: I agree with you, but I also think option D is important to address specific business risks.

Cora 1 year ago

↳ replying to Ellen

User 1: I think option A is the primary role, security should be integrated into the development process.

Dan 1 year ago

But what about ensuring compliance with industry best practice? That's also crucial for security.

Melissa 1 year ago

I agree with Frederica. It's important to have security from the beginning of development.

Flo 2 years ago

Option A is the clear winner here. The information security manager's primary role is to make sure security is baked into the SDLC from the ground up. Anything less is just playing catch-up.

Leah 1 year ago

↳ replying to Flo

D) To ensure control procedures address business risk

Raylene 1 year ago

↳ replying to Flo

C) To ensure enterprise security controls are implemented

Temeka 1 year ago

↳ replying to Flo

A) To ensure security is integrated into the system development life cycle (SDLC)

Frederica 2 years ago

I think the primary role is to ensure security is integrated into the SDLC.

Isaca CISM Exam - Topic 6 Question 64 Discussion