Instant Access ISACA.CISM.v2026-03-07.q241 Actual Practice Test Engine for Free (Page 27)

Welcome to DumpsDB

- Passing Exams, Dumps for Free

Request Exam Contact

Home
Popular Exams
- Oracle
- Fortinet
- Juniper
- Microsoft
- Cisco
- Citrix
- CompTIA
- VMware
- ISC
- SAP
- EMC
- PMI
- HP
- Salesforce
View All Exams
New Dumps
Upload

Oracle
Fortinet
Juniper
Microsoft
Cisco
Citrix
CompTIA
VMware
ISC
SAP
EMC
PMI
HP
Salesforce

Home
ISACA Certification
CISM Exam
ISACA.CISM.v2026-03-07.q241 Dumps

««
«
…
22
23
24
25
26
27
28
29
30
31
…
»
»»

Question 126

Risk assessment should be built into which of the following systems development phases to ensure that risks are addressed in a development project?

A.Programming
B.Specification
C.User testing
D.Feasibility

Correct Answer: D

Risk should be addressed as early as possible in the development cycle. The feasibility study should include risk assessment so that the cost of controls can be estimated before the project proceeds. Risk should also be considered in the specification phase where the controls are designed, but this would still be based on the assessment carried out in the feasibility study. Assessment would not be relevant in choice A or C.

Comment: *

Name: *

Email: *

Verification: *

insert code

Question 127

Which of the following BEST describes a buffer overflow?

A.A function is carried out with more data than the function can handle
B.A program contains a hidden and unintended function that presents a security risk
C.Malicious code designed to interfere with normal operations
D.A type of covert channel that captures data

Correct Answer: A

A buffer overflow is a software coding error or vulnerability that occurs when a function is carried out with more data than the function can handle, resulting in adjacent memory locations being overwritten or corrupted by the excess data1. A program contains a hidden and unintended function that presents a security risk is not a buffer overflow, but rather a backdoor2. Malicious code designed to interfere with normal operations is not a buffer overflow, but rather malware3. A type of covert channel that captures data is not a buffer overflow, but rather a keylogger. References: 1 https://www.fortinet.com/resources/cyberglossary/buffer-overflow 2
https://www.fortinet.com/resources/cyberglossary/backdoor 3 https://www.fortinet.com/resources
/cyberglossary/malware https://www.fortinet.com/resources/cyberglossary/keylogger

Comment: *

Name: *

Email: *

Verification: *

insert code

Question 128

Which of the following individuals would be in the BEST position to sponsor the creation of an information security steering group?

A.Information security manager
B.Chief operating officer (COO)
C.Internal auditor
D.Legal counsel

Correct Answer: B

The chief operating officer (COO) is highly-placed within an organization and has the most knowledge of business operations and objectives. The chief internal auditor and chief legal counsel are appropriate members of such a steering group. However, sponsoring the creation of the steering committee should be initiated by someone versed in the strategy and direction of the business. Since a security manager is looking to this group for direction, they are not in the best position to oversee formation of this group.

Comment: *

Name: *

Email: *

Verification: *

insert code

Question 129

Investment in security technology and processes should be based on:

A.clear alignment with the goals and objectives of the organization.
B.success cases that have been experienced in previous projects.
C.best business practices.
D.safeguards that are inherent in existing technology.

Correct Answer: A

Organization maturity level for the protection of information is a clear alignment with goals and objectives of the organization. Experience in previous projects is dependent upon other business models which may not be applicable to the current model. Best business practices may not be applicable to the organization's business needs. Safeguards inherent to existing technology are low cost but may not address all business needs and/or goals of the organization.

Comment: *

Name: *

Email: *

Verification: *

insert code

Question 130

Which of the following is the MOST important consideration for an organization interacting with the media during a disaster?

A.Communicating specially drafted messages by an authorized person
B.Refusing to comment until recovery
C.Referring the media to the authorities
D.Reporting the losses and recovery strategy to the media

Correct Answer: A

Section: INCIDENT MANAGEMENT AND RESPONSE
Explanation:
Proper messages need to be sent quickly through a specific identified person so that there are no rumors or statements made that may damage reputation. Choices B, C and D are not recommended until the message to be communicated is made clear and the spokesperson has already spoken to the media.

Comment: *

Name: *

Email: *

Verification: *

insert code

««
«
…
22
23
24
25
26
27
28
29
30
31
…
»
»»

[×]

Download PDF File

Enter your email address to download ISACA.CISM.v2026-03-07.q241 Dumps

Email:

We are the Largest and the most Updated website for all vendors Certification Exam materials around the world.

Using resources of we provide, we strive using dumps to strengthen the community of High level Certification professionals for free.

DMCA
About
Contact Us
Privacy Policy
Terms & Conditions

©2026 DumpsDB

www.dumpsdb.com materials do not contain actual questions and answers from Cisco's certification exams.

Web Analytics