Vce CISM Questions Latest

A SIEM system provides the ability to collect, correlate, and analyze security events, enabling effective prioritization of incidents based on risk and impact. SIEM solutions also support tracking incidents from detection through resolution, as stated in the CISM Review Manual under incident management and monitoring.

The best approach for selecting security controls is to assess the effectiveness of each control in reducing residual risk (B). CISM emphasizes that control selection must be risk-based and outcome-focused, with the primary objective of reducing risk to within the organization’s defined risk appetite. When multiple controls are available, the information security manager should evaluate how well each option mitigates the identified risk—specifically data exfiltration—and determine the resulting residual risk after implementation.

Implementing controls solely because they are recommended by a framework (A) may not adequately address the organization’s specific threat scenario or business context. Prioritizing controls based on ease of implementation or available resources (C) shifts focus away from risk reduction and may result in insufficient protection. Cost-benefit analysis (D) is an important supporting activity, but in CISM it is secondary to understanding risk reduction effectiveness.

CISM guidance consistently states that security controls should be selected based on their ability to reduce risk exposure in a measurable and meaningful way, ensuring alignment with business objectives, risk tolerance, and governance expectations.

The information security manager should first obtain legal guidance when there is a conflict between the organization’s information security policy and a local regulation, because this will help to understand the implications and consequences of the conflict, and to identify the possible options and solutions for resolving it. The information security manager should also consult with the relevant stakeholders, such as senior management, business owners, and information owners, to determine the best course of action that aligns with the organization’s objectives, risk appetite, and compliance obligations. Enforcing the local regulation or the organization’s information security policy without legal guidance may expose the organization to legal liabilities, security risks, or operational disruptions. Obtaining an independent assessment of the regulation may be helpful, but it is not the first step to take.

References = CISM Review Manual, 16th Edition, page 691; A Guide to ISACA CISM Domains & Domain 1: Information Security Governance2

 The organization’s vision and mission should be the PRIMARY basis for an information security strategy, as they define the purpose and direction of the organization and its information security needs. A comprehensive gap analysis is a tool to identify the current state and desired state of information security, and the actions needed to close the gap. Information security policies are the high-level statements of management’s intent and expectations for information security, and are derived from the information security strategy. Audit and regulatory requirements are external factors that influence the information security strategy, but are not the primary basis for it. References = CISM Review Manual, 16th Edition, pages 17-181; CISM Review Questions, Answers & Explanations Manual, 10th Edition, page 782

The primary basis for an information security strategy should be the organization ' s vision and mission. The organization ' s vision and mission should be the foundation for the security strategy, and should inform and guide the security policies, procedures, and practices that are implemented. The results of a comprehensive gap analysis, information security policies, and audit and regulatory requirements should all be taken into consideration when developing the security strategy, but should not be the primary basis.