Discuss Isaca CISM Exam Topic 7 Question 1

To gain a clear understanding of the impact that a new regulatory will have on an organization's security control, an information manager should FIRST.

AConduct a risk assessment

BInterview senior management

CPerform a gap analysis

DConduct a cost-benefit analysis

Suggested Answer: C

Get Premium CISM Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

14 comments · newest first

Natalie 11 months ago

Totally agree with starting with a risk assessment!

Lilli 12 months ago

Surprised that cost-benefit analysis is even an option here!

Blondell 12 months ago

Gap analysis should come after the risk assessment, right?

Brunilda 12 months ago

I think interviewing senior management is more important.

Gerald 1 year ago

A risk assessment is definitely the first step!

Nakisha 1 year ago

Cost-benefit analysis seems important, but I feel like we need to understand the risks before diving into costs.

Sheldon 1 year ago

Gap analysis sounds familiar, but I can't recall if it should be the first action. I might be mixing it up with other processes.

Clay 1 year ago

I think the first step should be conducting a risk assessment, but I'm not entirely sure if that's the best approach.

Karrie 1 year ago

I remember a practice question where interviewing senior management was emphasized, but I feel like that might come after assessing the risks.

Amina 1 year ago

This looks like a pretty straightforward systems integration question. I'd start by mapping out the data flows between the different systems and identifying any potential bottlenecks or areas for optimization.

Sunny 1 year ago

Hmm, I'm not sure about this one. I'll have to think it through carefully.

Louis 1 year ago

Hmm, I'm a bit unsure about this one. There are a few options that seem plausible, but I'm not totally confident in my understanding of how port scanners are typically defended against. I'll have to think this through carefully.

Sarah 1 year ago

Okay, I've got this. The key is to identify which of these elements is not actually an input to assessing organizational readiness. I'll eliminate the options one by one.

Penney 1 year ago

I'm not entirely sure about this one, but I'll give it my best shot and hope for the best.

Isaca CISM Exam - Topic 7 Question 1 Discussion