Sie sind auf Seite 1von 2

\

CISM Exam Questions

Copyright www.techeXams.ws2011
CISM Practice Exams, CISM Audio Trainings, CISM Study Guides

14

B. evaluations in trade publications.C. use of new and emerging technologies.D. benefits


in comparison to their costs.
Explanation:
The most fundamental evaluation criterion for the appropriate selection of any security
technologyis its ability to reduce or eliminate business risks. Investments in security
technologies should bebased on their overall value in relation to their cost; the value can
be demonstrated in terms of riskmitigation. This should take precedence over whether
they use new or exotic technologies or howthey are evaluated in trade
publications.Question: 25
Which of the following are seldom changed in response to technological changes?
A. StandardsB. ProceduresC. PoliciesD. Guidelines
Explanation:
Policies are high-level statements of objectives. Because of their high-level nature and
statement of broad operating principles, they are less subject to periodic change.
Security standards andprocedures as well as guidelines must be revised and updated
based on the impact of technologychanges.Question: 26
The MOST important factor in planning for the long-term retention of electronically
storedbusiness records is to take into account potential changes in:
A. storage capacity and shelf life.Answer: AAnswer: C

Copyright www.techeXams.ws2011
CISM Practice Exams, CISM Audio Trainings, CISM Study Guides

15

B. regulatory and legal requirements.C. business strategy and direction.D. application


systems and media.
Explanation:
Long-term retention of business records may be severely impacted by changes in
applicationsystems and media. For example, data stored in nonstandard formats that can
only be read andinterpreted by previously decommissioned applications may be difficult,
if not impossible, torecover. Business strategy and direction do not generally apply, nor
do legal and regulatoryrequirements. Storage capacity and shelf life are important but
secondary issues.Question: 27
Which of the following is characteristic of decentralized information security
managementacross a geographically dispersed organization?
A. More uniformity in quality of serviceB. Better adherence to policiesC. Better alignment
to business unit needsD. More savings in total operating costs
Explanation:
Decentralization of information security management generally results in better
alignment tobusiness unit needs. It is generally more expensive to administer due to the
lack of economies of scale. Uniformity in quality of service tends to vary from unit to
unit.Question: 28
Which of the following is the MOST appropriate position to sponsor the design
andimplementation of a new security infrastructure in a large global enterprise?
A. Chief security officer (CSO)Answer: DAnswer: C
CISM Exam Questions

Copyright www.techeXams.ws2011
CISM Practice Exams, CISM Audio Trainings, CISM Study Guides

16

B. Chief operating officer (COO)C. Chief privacy officer (CPO)D. Chief legal counsel (CLC)
Explanation:
The chief operating officer (COO) is most knowledgeable of business operations and
objectives. Thechief privacy officer (CPO) and the chief legal counsel (CLC) may not have
the knowledge of the day-to-day business operations to ensure proper guidance,
although they have the same influence withinthe organization as the COO. Although the
chief security officer (CSO) is knowledgeable of what isneeded, the sponsor for this task
should be someone with far-reaching influence across theorganization.Question: 29
Which of the following would be the MOST important goal of an information
securitygovernance program?
A. Review of internal control mechanismsB. Effective involvement in business decision
makingC. Total elimination of risk factorsD. Ensuring trust in data
Explanation:
The development of trust in the integrity of information among stakeholders should be
the primarygoal of information security governance. Review of internal control
mechanisms relates more toauditing, while the total elimination of risk factors is not
practical or possible. Proactive involvementin business decision making implies that
security needs dictate business needs when, in fact, just theopposite is true. Involvement
in decision making is important only to ensure business data integrityso that data can be
trusted.Question: 30Answer: BAnswer: D

Copyright www.techeXams.ws2011
CISM Practice Exams, CISM Audio Trainings, CISM Study Guides

17

Relationships among security technologies are BEST defined through which of


thefollowing?
A. Security metricsB. Network topologyC. Security architectureD. Process improvement
models
Explanation:
Security architecture explains the use and relationships of security mechanisms. Security
metricsmeasure improvement within the security practice but do not explain the use and
relationships of security technologies. Process improvement models and network
topology diagrams also do notdescribe the use and relationships of these
technologies.Answer: C
Get Full Version of Exam CISM PDF Q&A
techeXams presents authentic, genuine and valid study material, which promise
100%success in very first attempt. To take optimal results for CISM exam, you need to
buyfull version of CISM question and answer. An average of approximately 10 to 15
hoursshould be spent to study these exam questions and you will surely pass your exam.
Socome join us and quench your thirst for knowledge.
Get completeCISM exam questionsand answers by visiting URL

Das könnte Ihnen auch gefallen