Cyber Monday 2023! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: CM25OFF
Welcome to Pass4Success

- Free Preparation Discussions

Isaca Certified Information Security Manager Exam

Certification Provider: Isaca
Exam Name: Certified Information Security Manager
Duration: 120 Minutes
Number of questions in our database: 415
Exam Version: Dec. 03, 2023
Exam Official Topics:
  • Topic 1: Information Security Management/ Identity Management
  • Topic 2: Information Network Security Management Expectaions
  • Topic 3: Information Security Governance
  • Topic 4: InformationRisk Management
  • Topic 5: Information Security Program
  • Topic 6: Development and Management
  • Topic 7: Information Security Incident Management

Free Isaca Certified Information Security Manager Exam Actual Questions

The questions for Certified Information Security Manager were last updated On Dec. 03, 2023

Question #1

An information security manager has identified that privileged employee access requests to production servers are approved; but user actions are not logged. Which of the following should be the GREATEST concern with this situation?

Reveal Solution Hide Solution
Correct Answer: B

The greatest concern with the situation of privileged employee access requests to production servers being approved but not logged is the lack of accountability, which means the inability to trace or verify the actions and decisions of the privileged users. Lack of accountability can lead to security risks such as unauthorized changes, data breaches, fraud, or misuse of privileges. Logging user actions is a key component of privileged access management (PAM), which helps to monitor, detect, and prevent unauthorized privileged access to critical resources. The other options, such as lack of availability, improper authorization, or inadequate authentication, are not directly related to the situation of not logging user actions. Reference:

https://www.microsoft.com/en-us/security/business/security-101/what-is-privileged-access-management-pam

https://www.ekransystem.com/en/blog/privileged-user-monitoring-best-practices

https://www.beyondtrust.com/resources/glossary/privileged-access-management-pam


Question #2

When preventive controls to appropriately mitigate risk are not feasible, which of the following is the MOST important action for the information security manager?

Reveal Solution Hide Solution
Correct Answer: A

When preventive controls to appropriately mitigate risk are not feasible, the most important action for the information security manager is to manage the impact, which means taking measures to reduce the likelihood or severity of the consequences of the risk. Managing the impact can involve using alternative controls, such as engineering, administrative, or personal protective controls, that can lower the exposure or harm to the organization. The other options, such as identifying unacceptable risk levels, assessing vulnerabilities, or evaluating potential threats, are part of the risk assessment process, but they are not actions to mitigate risk when preventive controls are not feasible. Reference:

https://bcmmetrics.com/risk-mitigation-evaluating-your-controls/

https://www.osha.gov/safety-management/hazard-prevention

https://www.cdc.gov/niosh/topics/hierarchy/default.html


Question #3

Which of the following is MOST important when defining how an information security budget should be allocated?

Reveal Solution Hide Solution
Correct Answer: B

Information security strategy is the most important factor when defining how an information security budget should be allocated because it helps to align the security objectives and initiatives with the business goals and priorities. An information security strategy is a high-level plan that defines the vision, mission, scope, and direction of the security program, as well as the roles and responsibilities, governance structures, policies and standards, risk management approaches, and performance measurement methods. An information security strategy helps to identify and prioritize the security needs and requirements of the organization, as well as to allocate the resources and funding accordingly. An information security strategy also helps to communicate the value and benefits of security to the stakeholders and justify the security investments. Therefore, information security strategy is the correct answer.


https://www.techtarget.com/searchsecurity/tip/Cybersecurity-budget-breakdown-and-best-practices

https://www.csoonline.com/article/3671108/how-2023-cybersecurity-budget-allocations-are-shaping-up.html

https://www.statista.com/statistics/1319677/companies-it-budget-allocated-to-security-worldwide/

Question #4

When preventive controls to appropriately mitigate risk are not feasible, which of the following is the MOST important action for the information security manager?

Reveal Solution Hide Solution
Correct Answer: A

When preventive controls to appropriately mitigate risk are not feasible, the most important action for the information security manager is to manage the impact, which means taking measures to reduce the likelihood or severity of the consequences of the risk. Managing the impact can involve using alternative controls, such as engineering, administrative, or personal protective controls, that can lower the exposure or harm to the organization. The other options, such as identifying unacceptable risk levels, assessing vulnerabilities, or evaluating potential threats, are part of the risk assessment process, but they are not actions to mitigate risk when preventive controls are not feasible. Reference:

https://bcmmetrics.com/risk-mitigation-evaluating-your-controls/

https://www.osha.gov/safety-management/hazard-prevention

https://www.cdc.gov/niosh/topics/hierarchy/default.html


Question #5

When preventive controls to appropriately mitigate risk are not feasible, which of the following is the MOST important action for the information security manager?

Reveal Solution Hide Solution
Correct Answer: A

When preventive controls to appropriately mitigate risk are not feasible, the most important action for the information security manager is to manage the impact, which means taking measures to reduce the likelihood or severity of the consequences of the risk. Managing the impact can involve using alternative controls, such as engineering, administrative, or personal protective controls, that can lower the exposure or harm to the organization. The other options, such as identifying unacceptable risk levels, assessing vulnerabilities, or evaluating potential threats, are part of the risk assessment process, but they are not actions to mitigate risk when preventive controls are not feasible. Reference:

https://bcmmetrics.com/risk-mitigation-evaluating-your-controls/

https://www.osha.gov/safety-management/hazard-prevention

https://www.cdc.gov/niosh/topics/hierarchy/default.html



Unlock all Certified Information Security Manager Exam Questions with Advanced Practice Test Features:
  • Select Question Types you want
  • Set your Desired Pass Percentage
  • Allocate Time (Hours : Minutes)
  • Create Multiple Practice tests with Limited Questions
  • Customer Support
Get Full Access Now
Disscuss Isaca Certified Information Security Manager Topics, Questions or Ask Anything Related

Save Cancel