CISM Domain 1

Which document typically requires approval from the CEO or a senior-level executive?

• Standard

• Policy

• Guideline

• Procedure

Which is not an outcome of Information Security Governance?

• Strategic Alignment

• Value Delivery

• Accountability

• Performance Measurement

What is a crucial factor in information security or IT projects, guiding the decision on whether a project should proceed?

• Project timeline

• Technical specifications

• Cost benefit analysis

• Stakeholder engagement

What is a significant challenge faced by information security managers when dealing with third-party relationships, including mergers and acquisitions?

• Cultural differences

• Technological advancements

• Employee training programs

• Marketing strategies

In a publicly traded company, who bears direct responsibility for appointing or dismissing the Chief Executive Officer?

• Shareholders

• Board of Directors

• Chief Financial Officer

• Senior management team

What should organizations establish when implementing new security policies, standards, and procedures to accommodate unforeseen circumstances?

• No exceptions are allowed.

• Create a rigid framework without flexibility

• Provide a mechanism for exceptions.

• Delegate exception approvals to external entities.

Which of the following is a primary consideration for information security?

• Achieving maximum performance

• Creating a high-level conceptual security architecture

• Simultaneously establishing outcomes and objectives

• Aligning with enterprise architecture and managing risk to an acceptable level

In crafting a new security policy for his company, Tom aims to adhere to best practices. Which statement deviates from the recommended approach to policy development?

• Consensus from all stakeholders is essential for the proposed policy.

• The policy should align with standard corporate policy approval procedures.

• Policies should mirror the leadership tone set by senior business executives

• Cybersecurity managers typically handle the communication and implementation of approved security policies.

What is a crucial aspect in strengthening security measures, particularly at the end-user level?

• Hiring of overqualified individuals

• Continuous education programs tailored to enterprise needs

• Strict enforcement of security policies without exception

• Independent development of security skills by individual employees

What is the primary focus of risk assessment?

• Assessing the historical occurrences of specific threats

• Calculating the probable annual loss expectancy

• Evaluating the acceptability of rare threats

• Determining the likelihood and probable magnitude of threats