Online Access Free CISM Practice Test

Which of the following should be of GREATEST concern to an information security manager when evaluating a cloud service provider?

• A.Security controls offered by the provider are inadequate
• B.There is no right to audit the security of the provider
• C.Data retention policies are not documented
• D.The provider is new to the market and lacks references

Which of the following BEST supports effective communication during information security incidents?

• A.Predetermined service level agreements (SLAs)
• B.Responsibilities defined within role descriptions
• C.Centralized control monitoring capabilities
• D.Frequent incident response training sessions

Which of the following should be the PRIMARY basis for determining the value of assets?

• A.Business cost when assets are not available
• B.Original cost of the assets minus depreciation
• C.Cost of replacing the assets
• D.Total cost of ownership (TCO)

What should be the PRIMARY objective of an information classification scheme?

• A.To implement controls proportionate to risk
• B.To define data retention requirements
• C.To develop an asset inventory
• D.To meet legislative and regulatory requirements

Which of the following should be the GREATEST consideration when determining the recovery time objective (RTO) for an in-house critical application, database, or server?

• A.Determination of recovery point objective (RPO)
• B.Results of recovery testing
• C.Direction from senior management
• D.Impact of service interruption