Information Governance Frameworks and Standards CISM Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company is required to implement a set of security controls that are prioritized based on the most common cyber attacks. The CISO wants to use a framework that is practical and provides a clear roadmap for implementation. Which framework should the CISO choose?

   • ANIST SP 800-53
   • BCOBIT
   • CCIS Controls
   • DISO/IEC 27001
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A mid-sized company is considering adopting a governance framework but has limited resources and needs to quickly improve its security posture. The CISO wants a framework that is practical, prioritized, and widely recognized. Which framework would best meet these needs?

   • ANIST Cybersecurity Framework
   • BCIS Controls
   • CISO/IEC 27001
   • DCOBIT
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A public sector organization is required to align its information security program with a national cybersecurity framework. The organization also wants to ensure that its governance structure supports accountability and continuous improvement. Which component of an information governance framework is most important for achieving continuous improvement?

   • ADefining roles and responsibilities for security personnel
   • BEstablishing a process for regular review and updating of the framework
   • CCreating a one-time risk assessment report
   • DSelecting a specific technology solution for security monitoring
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following is a key information security standard that provides requirements for establishing, implementing, maintaining, and continually improving an information security management system (ISMS)?

   • AISO/IEC 27001
   • BNIST SP 800-53
   • CTOGAF
   • DCOBIT 2019
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A retail company is implementing an information governance framework to improve data classification and handling. The CISO wants to ensure that the framework is integrated with the company's existing enterprise risk management (ERM) process. Which component of the framework is most critical for this integration?

   • ADefining data classification categories and handling procedures
   • BCreating an incident response plan
   • CSelecting a cloud service provider for data storage
   • DEstablishing a risk appetite statement that aligns with the organization's ERM
   Reveal Solution Discussion Select an answer first