Why is it important to regularly review and update security policies?

To reduce the number of policies in the organization

To comply with a requirement to update policies annually

To ensure they remain aligned with changing business needs, technologies, and legal requirements

To ensure that all employees are aware of the policies

A software development company has classified its source code as 'Internal'. The development team lead is responsible for the code, while the DevOps team manages the code repository. A new developer joins the team and needs access to the repository. According to the principles of asset ownership and handling, who should authorize the new developer's access?

The CISO, because they are responsible for all security access decisions.

The development team lead, because they are the asset owner and determine who needs access to the source code.

The new developer's manager, because they know the developer's role and responsibilities.

The DevOps team lead, because they manage the repository and control access.

What is the primary difference between a security policy and a security procedure?

A policy is mandatory, while a procedure is optional

A policy is a high-level statement of intent, while a procedure is a detailed set of steps to accomplish a task

A policy is developed by the security team, while a procedure is developed by management

A policy is technical, while a procedure is managerial

Which of the following BEST describes the primary purpose of identifying and aligning security program resources with organizational needs?

To comply with all industry standards and regulations regardless of organizational context

To ensure the program has the right mix of people, tools, and technologies to effectively protect the organization's assets and support its objectives

To ensure the security program has sufficient budget to purchase the latest security technologies

To guarantee that all security tools are fully automated and require minimal human oversight

When selecting a security framework, what is an important factor to consider?

The framework's popularity among security professionals

The framework's age, preferring the oldest available

The framework's alignment with the organization's industry and regulatory requirements

The framework's complexity, regardless of organizational needs

Certified Information Security Manager

Domain 3Objective 1

Program Foundation and Governance CISM Practice Questions (Page 6)

Part of the Domain 3: Information Security Program domain, which accounts for 33% of the CISM exam.

32questions here

7free pages

9concepts

33%of the exam

Questions 26–30

26foundation · easy
Why is it important to regularly review and update security policies?
Select an answer first
27application · medium
A software development company has classified its source code as 'Internal'. The development team lead is responsible for the code, while the DevOps team manages the code repository. A new developer joins the team and needs access to the repository. According to the principles of asset ownership and handling, who should authorize the new developer's access?
Select an answer first
28foundation · easy
What is the primary difference between a security policy and a security procedure?
Select an answer first
29foundation · easy
Which of the following BEST describes the primary purpose of identifying and aligning security program resources with organizational needs?
Select an answer first
30foundation · easy
When selecting a security framework, what is an important factor to consider?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CISM” is a trademark of its owner, used for identification only.