Information Security Strategy Development CISM Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   In the information security strategy development process, what is the primary purpose of conducting an environmental analysis?

   • ATo understand internal and external factors that may affect the organization's security posture
   • BTo document all security incidents that have occurred in the past year
   • CTo select specific security products and vendors for implementation
   • DTo calculate the exact return on investment for each security initiative
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is a key element of strategy formulation?

   • ADefining strategic objectives and initiatives
   • BReviewing security incident logs
   • CConducting a vulnerability scan
   • DInstalling security patches
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is a key element of a roadmap for strategy implementation?

   • AA set of security policies
   • BPrioritized initiatives and milestones
   • CA detailed network diagram
   • DA list of all security incidents
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary basis for defining the target state of information security?

   • AThe current security controls in place
   • BBusiness needs and the organization's risk appetite
   • CThe latest security technologies and trends
   • DThe security budgets of competitor organizations
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is an output of a gap analysis?

   • AA list of all security incidents from the past year
   • BA prioritized list of security initiatives to close identified gaps
   • CA detailed network diagram of the current infrastructure
   • DA set of security policies and procedures
   Reveal Solution Discussion Select an answer first