- (Topic 3)
Which of the following is the BEST method to protect the confidentiality of data transmitted over the Internet?

1. A. Network address translation (NAT)
2. B. Message hashing
3. C. Transport Layer Security (TLS)
4. D. Multi-factor authentication

Correct Answer: C
Transport Layer Security (TLS) is a protocol that provides encryption, authentication, and integrity for data transmitted over the Internet. TLS protects the confidentiality of data by encrypting it before sending it and decrypting it after receiving it. TLS also verifies the identity of the communicating parties by using certificates and prevents data tampering by using message authentication codes. References = CISM Review Manual, 16th Edition, Chapter 4, Section 4.3.2.11

- (Topic 3)
Which of the following is the PRIMARY objective of information asset classification?

1. A. Vulnerability reduction
2. B. Compliance management
3. C. Risk management
4. D. Threat minimization

Correct Answer: C
The primary objective of information asset classification is C. Risk management. This is because information asset classification is a process of assigning labels or categories to information assets based on their value, sensitivity, and criticality to the organization. Information asset classification helps the organization to identify, assess, and treat the risks associated with the information assets, and to apply the appropriate level of protection and controls to them. Information asset classification also helps the organization to comply with the legal, regulatory, and contractual obligations regarding the information assets, and to optimize the use of resources and costs for information security.
Information asset classification is a process of assigning labels or categories to information assets based on their value, sensitivity, and criticality to the organization. Information asset classification helps the organization to identify, assess, and treat the risks associated with the information assets, and to apply the appropriate level of protection and controls to them. (From CISM Manual or related resources)
References = CISM Review Manual 15th Edition, Chapter 2, Section 2.2.1, page 751; CISM Review Questions, Answers & Explanations Manual 9th Edition, Question 7, page 3; Certified Information Security Manager Exam Prep Guide - Packt Subscription2

- (Topic 3)
Which of the following would BEST mitigate accidental data loss events?

1. A. Conduct periodic user awareness training.
2. B. Obtain senior management support for the information security strategy.
3. C. Conduct a data loss prevention (DLP) audit.
4. D. Enforce a data hard drive encryption policy.

Correct Answer: A
Conducting periodic user awareness training is the best way to mitigate accidental data loss events because it can educate the users on the causes, consequences, and prevention of data loss, and increase their awareness of the security policies and procedures of the organization. User awareness training can also help users to identify and report potential data loss incidents, and to adopt good practices such as backing up data, encrypting data, and using secure channels for data transmission and storage. References: The article Mistakes Happen—Mitigating Unintentional Data Loss from the ISACA Journal 2018 states that “user awareness training is the most effective way to prevent unintentional data loss” and that “user awareness training should include information on the types and sources of data loss, the impact and cost of data loss, the legal and regulatory requirements for data protection, the organization’s data security policies and procedures, the roles and responsibilities of users in data security, the best practices and tools for data security, and the reporting and escalation process for data loss incidents” (p. 2)1. The Data Spill Management Guide from the Cyber.gov.au website also states that “user awareness training is an important preventative measure to reduce the likelihood of data spills” and that “user awareness training should cover topics such as data classification, data handling, data storage, data transmission, data disposal, and data spill reporting” (p. 2)

- (Topic 3)
Which of the following should an information security manager do FIRST to address the risk associated with a new third-party cloud application that will not meet organizational security requirements?

1. A. Update the risk register.
2. B. Consult with the business owner.
3. C. Restrict application network access temporarily.
4. D. Include security requirements in the contract.

Correct Answer: B
The information security manager should first consult with the business
owner to understand the business needs and objectives for using the new cloud application, and to discuss the possible alternatives or compensating controls that can mitigate the risk. Updating the risk register, restricting application network access, or including security requirements in the contract are possible actions to take after consulting with the business owner.
References = CISM Review Manual, 16th Edition eBook1, Chapter 1: Information Security Governance, Section: Risk Management, Subsection: Risk Treatment, Page 49.

- (Topic 2)
Which of the following is the BEST way to obtain support for a new organization-wide information security program?

1. A. Benchmark against similar industry organizations
2. B. Deliver an information security awareness campaign.
3. C. Publish an information security RACI chart.
4. D. Establish an information security strategy committee.

Correct Answer: D
= Establishing an information security strategy committee is the best way to obtain support for a new organization-wide information security program because it involves the participation and collaboration of key stakeholders from different business functions and levels who can provide input, guidance, and endorsement for the security program. An information security strategy committee is a governance body that oversees the development, implementation, and maintenance of the security program and aligns it with the organization’s strategic objectives, risk appetite, and culture. An information security strategy committee can help to obtain support for the security program by:
✑ Communicating the vision, mission, and goals of the security program to the organization and demonstrating its value and benefits.
✑ Establishing roles and responsibilities for the security program and ensuring accountability and ownership.
✑ Securing adequate resources and budget for the security program and allocating them appropriately.
✑ Resolving conflicts and issues that may arise during the security program execution and ensuring alignment with other business processes and initiatives.
✑ Monitoring and evaluating the performance and effectiveness of the security program and ensuring continuous improvement and adaptation.
Benchmarking against similar industry organizations is a useful technique to compare and improve the security program, but it is not the best way to obtain support for a new organization-wide information security program. Benchmarking involves measuring and analyzing the security program’s processes, practices, and outcomes against those of other organizations that have similar characteristics, objectives, or challenges. Benchmarking can help to identify gaps, strengths, weaknesses, opportunities, and threats in the security program and to adopt best practices and standards that can enhance the security program’s performance and maturity. However, benchmarking alone does not guarantee the support or acceptance of the security program by the organization, as it may not reflect the organization’s specific needs, risks, or culture.
Delivering an information security awareness campaign is a vital component of the security program, but it is not the best way to obtain support for a new organization-wide information security program. An information security awareness campaign is a set of activities and initiatives that aim to educate and inform the organization’s workforce and other relevant parties about the security program’s policies, standards, procedures, and guidelines, as well as the security risks, threats, and incidents that may affect the organization. An information security awareness campaign can help to increase the security knowledge, skills, and behaviors of the organization’s members and to foster a security risk-aware culture. However, an information security awareness campaign is not sufficient to obtain support for the security program, as it may not address the strategic, operational, or financial aspects of the security program or the expectations and interests of the different stakeholders.
Publishing an information security RACI chart is a helpful tool to define and communicate the security program’s roles and responsibilities, but it is not the best way to obtain support for a new organization-wide information security program. A RACI chart is a matrix that assigns the level of involvement and accountability for each task or activity in the security program to each role or stakeholder. RACI stands for Responsible, Accountable, Consulted, and Informed, which are the four possible levels of participation. A RACI chart can help to clarify the expectations, obligations, and authority of each role or stakeholder in the security program and to avoid duplication, confusion, or conflict. However, a RACI chart does not ensure the support or commitment of the roles or stakeholders for the security program, as it may not address the benefits, challenges, or resources of the security program or the feedback and input of the roles or stakeholders. References =
✑ CISM Review Manual 15th Edition, pages 97-98, 103-104, 107-108, 111-112
✑ Information Security Governance: Guidance for Boards of Directors and Executive Management, 2nd Edition - ISACA1
✑ Information Security Strategy: The Key to Success - ISACA2
Deliver an information security awareness campaign is the BEST approach to obtain support for a new organization-wide information security program. An information security awareness campaign is a great way to raise awareness of the importance of information security and the impact it can have on an organization. It helps to ensure that all stakeholders understand the importance of information security and are aware of the risks associated with it. Additionally, an effective awareness campaign can help to ensure that everyone in the organization is aware of the cybersecurity policies, procedures, and best practices that must be followed.