QUESTION: 33

The PRIMARY goal in developing an information security strategy is to:

establish security metrics and performance monitoring.
educate business process owners regarding their duties.
ensure that legal and regulatory requirements are met
support the business objectives of the organization.

Answer(s): D

Explanation:

The business objectives of the organization supersede all other factors. Establishing metrics and measuring performance, meeting legal and regulatory requirements, and educating business process owners are all subordinate to this overall goal.

Reveal Solution Next Question

QUESTION: 34

Senior management commitment and support for information security can BEST be enhanced through:

a formal security policy sponsored by the chief executive officer (CEO).
regular security awareness training for employees.
periodic review of alignment with business management goals.
senior management signoff on the information security strategy.

Answer(s): C

Explanation:

Ensuring that security activities continue to be aligned and support business goals is critical to obtaining their support. Although having the chief executive officer (CEO) signoff on the security policy and senior management signoff on the security strategy makes for good visibility and demonstrates good tone at the top, it is a one-time discrete event that may be quickly forgotten by senior management. Security awareness training for employees will not have as much effect on senior management commitment.

Reveal Solution Next Question

QUESTION: 35

When identifying legal and regulatory issues affecting information security, which of the following would represent the BEST approach to developing information security policies?

Create separate policies to address each regulation
Develop policies that meet all mandated requirements
Incorporate policy statements provided by regulators
Develop a compliance risk assessment

Answer(s): B

Explanation:

It will be much more efficient to craft all relevant requirements into policies than to create separate versions. Using statements provided by regulators will not capture all of the requirements mandated by different regulators. A compliance risk assessment is an important tool to verify that procedures ensure compliance once the policies have been established.

Reveal Solution Next Question

QUESTION: 36

Which of the following MOST commonly falls within the scope of an information security governance steering committee?

Interviewing candidates for information security specialist positions
Developing content for security awareness programs
Prioritizing information security initiatives
Approving access to critical financial systems

Answer(s): C

Explanation:

Prioritizing information security initiatives is the only appropriate item. The interviewing of specialists should be performed by the information security manager, while the developing of program content should be performed by the information security staff. Approving access to critical financial systems is the responsibility of individual system data owners.

Reveal Solution Next Question

Certified Information Security Manager CISM Exam

QUESTION: 33

Explanation:

QUESTION: 34

Explanation:

QUESTION: 35

Explanation:

QUESTION: 36

Explanation:

Certified Information Security Manager
CISM Exam