Certified Information Security Manager v1.0

Which of the following is the BEST way for an organization to determine the maturity level of its information security program?

An organization has identified an increased threat of external brute force attacks in its environment. Which of the following is the MOST effective way to mitigate this risk to the organization's critical systems?

When supporting an organization's privacy officer which of the following is the information security manager's PRIMARY role regarding privacy requirements?

The chief information security officer (CISO) has developed an information security strategy, but is struggling to obtain senior management commitment for funds to implement the strategy. Which of the following is the MOST likely reason?

An organization's CIO has tasked the information security manager with drafting the charter for an information security steering committee. The committee will be comprised of the CIO, the IT shared services manager, the vice president of marketing, and the information security manager. Which of the following is the MOST significant issue with the development of this committee?

What is the PRIMARY purpose of an unannounced disaster recovery exercise?

Labeling information according to its security classification:

Which of the following is the MOST effective approach for determining whether an organization's information security program supports the information security strategy?

When drafting the corporate privacy statement for a public web site, which of the following MUST be included?

An organization is concerned with the potential for exploitation of vulnerabilities in its server systems. Which of the following is the BEST control to mitigate the associated risk?

Which of the following is the MOST important step when establishing guidelines for the use of social networking sites in an organization?

Regular vulnerability scanning on an organization's internal network has identified that many user workstations have unpatched versions of software. What is the
BEST way for the information security manager to help senior management understand the related risk?

Which of the following BEST prepares a computer incident response team for a variety of information security scenarios?

Which of the following BEST protects against phishing attacks?