Instant Access ISACA.CISM.v2026-03-07.q241 Actual Practice Test Engine for Free (Page 45)

40%off

CISM Premium Dumps

Latest CISM Exam Premium Dumps provide by TrainingQuiz.com to help you Passing CISM Exam! TrainingQuiz.com offers the updated CISM exam dumps, the TrainingQuiz.com CISM exam questions has been updated to correct Answer. Get the latest TrainingQuiz.com CISM pdf dumps with Exam Engine here:

(1041 Q&As Dumps, 40%OFF Special Discount: DumpsDB)

Question 216

At the conclusion of a disaster recovery test, which of the following should ALWAYS be performed prior to leaving the vendor's hot site facility?

A.Erase data and software from devices
B.Conduct a meeting to evaluate the test
C.Complete an assessment of the hot site provider
D.Evaluate the results from all test scripts

Question 217

Which of the following MOST effectively identifies issues related to noncompliance with legal, regulatory, and contractual requirements?

A.Independent compliance audit
B.Compliance gap analysis
C.Compliance benchmarking data
D.Compliance maturity assessment

Question 218

Which of the following is MOST helpful for aligning security operations with the IT governance framework?

A.Security risk assessment
B.Security operations program
C.Information security policy
D.Business impact analysis (BIA)

Correct Answer: C

An information security policy is the MOST helpful for aligning security operations with the IT governance framework because it defines the security objectives, principles, standards, and guidelines that guide the security operations activities and processes. An information security policy also establishes the roles and responsibilities, authorities and accountabilities, and reporting and communication mechanisms for security operations. An information security policy should be aligned with the IT governance framework, which provides the direction, structure, and oversight for the effective management and delivery of IT services and resources. An information security policy should also be consistent with the enterprise governance framework, which sets the vision, mission, values, and goals of the organization12. A security risk assessment (A) is helpful for identifying and evaluating the security risks that may affect the security operations and the IT governance framework, but it is not the MOST helpful for aligning them. A security risk assessment should be based on the information security policy, which defines the risk appetite, tolerance, and criteria for the organization12. A security operations program (B) is helpful for implementing and executing the security operations activities and processes that support the IT governance framework, but it is not the MOST helpful for aligning them. A security operations program should be derived from the information security policy, which provides the strategic direction and guidance for the security operations12. A business impact analysis (BIA) (D) is helpful for determining the criticality and priority of the business processes and functions that depend on the security operations and the IT governance framework, but it is not the MOST helpful for aligning them. A BIA should be conducted in accordance with the information security policy, which specifies the business continuity and disaster recovery requirements and objectives for the organization12. Reference = 1: CISM Review Manual 15th Edition, page 75-76, 81-82, 88-89, 93-941; 2: CISM Domain 1: Information Security Governance (ISG) [2022 update]2

Question 219

An organization recently outsourced the development of a mission-critical business application. Which of the following would be the BEST way to test for the existence of backdoors?

A.Scan the entire application using a vulnerability scanning tool.
B.Run the application from a high-privileged account on a test system.
C.Perform security code reviews on the entire application.
D.Monitor Internet traffic for sensitive information leakage.

Question 220

Which of the following is the MOST likely to change an organization's culture to one that is more security conscious?

A.Adequate security policies and procedures
B.Periodic compliance reviews
C.Security steering committees
D.Security awareness campaigns