ISACA Certified Information Security
Manager
Which of the following is the primary step in control implementation for a new business
application? -
D. Risk assessment
When implementing an information security program, in which phase of the
implementation should metrics be established to assess the effectiveness of the
program over time?" -
Either
B. Initiation
C. Design
Data owners are concerned and responsible for who has access to their resources and
therefore need to be concerned with the strategy of how to mitigate risk of data resource
usage. Which of the following actions facilitates that responsibility? -
B. Entitlement changes
Which of the following is the best method to determine the effectiveness of the incident
response process? -
C. Post-incident review
When properly implemented, a risk management program should be designed to reduce
an organization's risk to: -
C. A level at which the organization is willing to accept
What controls the process of introducing changes to systems to ensure that unintended
changes are not introduced? -
C. Change management
All actions dealing with incidents must be worked with cyclical consideration. What is
the primary post-incident review takeaway? -
Either
A. Pursuit of legal action
B. Identify personnel failures
