Isaca CISM Exam - Topic 7 Question 30 Discussion

Actual exam question for Isaca's CISM exam

Question #: 30
Topic #: 7

[All CISM Questions]

Which of the following is the BEST evidence of the maturity of an organization's information security program?

AIT security staff implements strict technical security controls.

BThe number of reported incidents has increased

CManagement has approved the information security policy.

DThe number of reported incidents has decreased

Show Suggested Answer

Suggested Answer: C

by Ammie at May 05, 2022, 08:01 PM

Limited Time Offer

25%

Off

Get Premium CISM Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Brande

4 months ago

Agreed, fewer incidents definitely indicates improvement!

upvoted 0 times

...

Naomi

4 months ago

Wait, how can more incidents mean better security? That seems off.

upvoted 0 times

...

Hyun

4 months ago

Management approval of policies is key for a mature program.

upvoted 0 times

...

Reuben

4 months ago

I think a decrease in incidents shows real progress!

upvoted 0 times

...

Ludivina

5 months ago

Strict controls are important, but not the only sign of maturity.

upvoted 0 times

...

Willodean

5 months ago

I recall that an increase in reported incidents could mean better detection, but it doesn't seem like a sign of maturity. I think I lean towards option D being the best evidence.

upvoted 0 times

...

Sherell

5 months ago

I feel like strict technical controls are necessary, but they don't necessarily reflect the overall maturity of the program. I’m a bit confused about this one.

upvoted 0 times

...

Reena

5 months ago

I think I came across a similar question where they emphasized management's role in approving policies. It might be important, but is it the best indicator?

upvoted 0 times

...

Billye

5 months ago

I remember studying that a decrease in reported incidents usually indicates a mature security program, but I'm not entirely sure if that's the best evidence.

upvoted 0 times

...

Stephanie

5 months ago

I think I'll go with option D - creating a roll-up summary field. That seems like the most straightforward way to display the number of open cases related to the account.

upvoted 0 times

...

Melissia

5 months ago

This seems straightforward enough. I'll carefully consider each transaction and apply my knowledge of the OFAC regulations to determine the correct answer.

upvoted 0 times

...

Gwenn

5 months ago

Okay, I think I've got this. The PE router is the provider edge router, so it should connect to at least one other PE router, not a CE (customer edge) device. I'll go with option C.

upvoted 0 times

...