HikeLetter | PMP Training & Certification Online Course | Project Management Learning

Overview

Course Description

Certification: Certified Information Security Manager (CISM)
Provider: ISACA
Exam code: CISM (ISACA identifies the exam by certification name; no separate numeric exam code listed)
Exam duration: 4 hours
Question count: 150 multiple-choice questions
Passing score: 450 on a 200–800 scaled score
Exam fee (USD): ISACA member: US$575; nonmember: US$760 (verify current regional taxes and
checkout price)

Course Questions

10 Questions

An organization’s board asks how security initiatives should be prioritized. What should the information security manager do FIRST?

A. Select tools based on the latest technology B. Align the security strategy with business objectives and risk appetite C. Copy another company's security policy D. Focus only on passing an audit

A business unit wants to accept a significant information security risk. Who should make the risk acceptance decision?

A. The security analyst alone B. The accountable business or risk owner with appropriate authority C. The software vendor D. Any employee who discovers the risk

A security program has many controls but cannot demonstrate whether they reduce risk. What should the manager do?

A. Add controls without measurement B. Define outcome-based metrics linked to risk and business objectives C. Stop reporting to management D. Measure only the number of policies

A new regulatory requirement affects handling of customer information. What is the best next step?

A. Wait for the next policy review cycle B. Assess the requirement's impact and update policies, controls, owners, and training as needed C. Delete existing policies D. Delegate all accountability to the vendor

A vulnerability is severe but affects a low-impact isolated system. How should remediation be prioritized?

A. By technical severity alone in every case B. Using likelihood, business impact, exposure, and existing controls C. By the system owner's seniority D. Alphabetically by hostname

A critical supplier will process sensitive company data. What should be done before onboarding?

A. Rely on the supplier's marketing claims B. Perform risk-based due diligence and define security obligations in the contract C. Give the supplier unrestricted access D. Review security only after a breach

A major security incident has disrupted a critical service. What is the security manager's primary responsibility?

A. Personally investigate every technical artifact B. Coordinate response governance, escalation, communication, and business-impact decisions C. Wait for the annual audit D. Delete incident records after recovery

A business impact analysis identifies a critical service with a short recovery time objective. What should management ensure?

A. Recovery plans and capabilities can meet the agreed RTO and RPO B. Backups are never tested C. The service has no owner D. Only security policies are updated

Phishing simulations show repeated failures in one department. What is the most effective response?

A. Publicly shame employees B. Provide targeted training and assess whether behavior and reporting improve C. Stop measuring results D. Block all email permanently

A proposed system introduces a new internet-facing service handling regulated data. What should happen before approval?

A. Perform a risk-based security architecture review and ensure required controls are designed B. Approve it because the deadline is close C. Rely only on a firewall D. Wait for the first incident

₹2999.00 ₹999.00

Enroll Now

Certified Information Security Manager (CISM)