Disagreement ranking

CISM — most debated topics

Community-voted ranking of 64 topics, sorted by disagreement level. A higher dispute score means more test-takers disagree on the answer.

Full ranking

64 topics · highest disagreement first

  1. How Should Unpatched Systems Violating Policy Be Treated?

    A-grade Dispute: 57% 4 comments

  2. How to Keep a Business Continuity Plan Current?

    S-grade Dispute: 50% 5 comments

  3. Best Defense Against DDoS Attacks in Enterprise Networks?

    S-grade Dispute: 50% 5 comments

  4. When Should a Business Continuity Plan Be Primarily Triggered?

    S-grade Dispute: 50% 6 comments

  5. Which Approach Best Communicates Security to Senior Management?

    S-grade Dispute: 50% 4 comments

  6. Who decides to change a specific control?

    A-grade Dispute: 50% 3 comments

  7. How to Ensure Effective Execution of a Disaster Recovery Plan?

    S-grade Dispute: 47% 5 comments

  8. What Best Facilitates Developing Information Security Procedures?

    A-grade Dispute: 46% 3 comments

  9. First Step in Aligning InfoSec Strategy with Business Goals?

    S-grade Dispute: 45% 6 comments

  10. What is Most Important When Establishing Security Metrics for Executive Reporting?

    A-grade Dispute: 43% 4 comments

  11. Best Input for a Business Case Addressing System Vulnerabilities?

    S-grade Dispute: 42% 5 comments

  12. Best Indicator of Integrating Information Security Governance with Corporate Governance

    S-grade Dispute: 40% 5 comments

  13. Validating Business Continuity Readiness via Testing Methods

    S-grade Dispute: 40% 5 comments

  14. What Is Most Important When Choosing a Shared Alternate Site?

    S-grade Dispute: 40% 3 comments

  15. Greatest Concern When Outsourcing HR Data Processing?

    A-grade Dispute: 40% 4 comments

  16. How to Determine Security Program Alignment with Business Strategy?

    A-grade Dispute: 40% 4 comments

  17. Essential Practices for Forensic Investigation Workstations

    S-grade Dispute: 40% 3 comments

  18. How to Ensure Third-Party Vendor Security Effectively?

    S-grade Dispute: 37% 6 comments

  19. What Is Most Important When Reviewing an Incident Response Plan?

    S-grade Dispute: 36% 5 comments

  20. Preserving Evidence Integrity During Server Intrusion Response

    A-grade Dispute: 36% 3 comments

  21. Most Important Element in an Information Security Framework?

    S-grade Dispute: 33% 5 comments

  22. When Should Risk Assessment Occur Before a Business Case?

    S-grade Dispute: 33% 5 comments

  23. Primary Preventive Method for Privileged Account Risks

    S-grade Dispute: 33% 5 comments

  24. What Is the Primary Objective of an InfoSec Program?

    A-grade Dispute: 33% 4 comments

  25. Executive Role in Security Governance

    A-grade Dispute: 33% 4 comments

  26. Best method for comparing IaaS and internal hosting risk scenarios?

    A-grade Dispute: 33% 4 comments

  27. What Is the First Step in Malware Incident Triage?

    A-grade Dispute: 33% 3 comments

  28. Identifying Emerging Technology Threats

    A-grade Dispute: 33% 4 comments

  29. How Should an ISM Support Cloud Application Migration?

    A-grade Dispute: 33% 3 comments

  30. Which Plan Best Prepares an Organization to Recover from Disaster-Related Revenue Loss?

    S-grade Dispute: 29% 5 comments

  31. What Does an Information Security Strategy Primarily Input To?

    A-grade Dispute: 29% 3 comments

  32. Best control for detecting zero-day targeted attacks

    A-grade Dispute: 29% 4 comments

  33. Who Enforces Access Controls for CRM Data in CISM?

    S-grade Dispute: 27% 7 comments

  34. How to Encourage Business Units to Adopt Security Roles?

    S-grade Dispute: 27% 6 comments

  35. How to Best Enhance Incident Response Plan Processes?

    A-grade Dispute: 25% 4 comments

  36. Justifying Security Investments for Critical Applications

    A-grade Dispute: 25% 4 comments

  37. What is Most Important for Effective Cybersecurity Incident Management?

    S-grade Dispute: 20% 6 comments

  38. What Is Most Important When Planning Cyberattack Eradication?

    S-grade Dispute: 20% 5 comments

  39. What is a Key Consideration in Quantitative Risk Analysis?

    A-grade Dispute: 20% 4 comments

  40. Best Control for Protecting Cloud-Stored Customer Personal Information

    A-grade Dispute: 20% 4 comments

  41. What is the Most Important Objective When Recommending Controls?

    A-grade Dispute: 20% 3 comments

  42. When Is an Information Security Control No Longer Relevant?

    S-grade Dispute: 17% 6 comments

  43. Greatest impact on information classification scheme development

    A-grade Dispute: 17% 3 comments

  44. Greatest Risk of a Poorly Trained Incident Response Team?

    S-grade Dispute: 17% 4 comments

  45. Best Method to Determine System Activities During a Cyber Incident

    A-grade Dispute: 14% 3 comments

  46. What is the Primary Advantage of Using DRaaS?

    A-grade Dispute: 14% 4 comments

  47. Most Useful Tool for Data Center Business Continuity Strategy?

    A-grade Dispute: 14% 3 comments

  48. How Does Data Discovery Assist With Data Classification?

    A-grade Dispute: 12% 3 comments

  49. Which IDS Performance Trend Causes Greatest Concern?

    A-grade Dispute: 10% 3 comments

  50. What Does a Business Impact Analysis Best Enable an Organization to Establish?

    A-grade Dispute: 0% 3 comments

  51. What Is the First Step After an Undisclosed Vendor Breach?

    A-grade Dispute: 0% 3 comments

  52. Primary objective of a security culture

    A-grade Dispute: 0% 3 comments

  53. Aligning Incident Response Plan with Corporate Strategy

    A-grade Dispute: 0% 3 comments

  54. Risk Appetite Influence on Regulatory Response

    A-grade Dispute: 0% 3 comments

  55. Best metric to gain senior management support for risk treatment?

    A-grade Dispute: 0% 3 comments

  56. Who owns risk of unauthorized application data access?

    A-grade Dispute: 0% 3 comments

  57. Most Important Security Measure for Remote Employees?

    A-grade Dispute: 0% 4 comments

  58. Best way to improve departmental risk management effectiveness?

    A-grade Dispute: 0% 3 comments

  59. Third-Party Security Vendor Selection Criteria

    A-grade Dispute: 0% 6 comments

  60. How to Determine Application Resilience Requirements?

    A-grade Dispute: 0% 3 comments

  61. First Step for Actively Exploited Application Vulnerability

    A-grade Dispute: 0% 3 comments

  62. What is most important when selecting CISM key risk indicators?

    A-grade Dispute: 0% 4 comments

  63. First Action for Information Security Budget Cuts

    A-grade Dispute: 0% 3 comments

  64. What Is Most Important When Engaging an External Penetration Test?

    A-grade Dispute: 0% 4 comments

← Back to CISM ISACA Certified Information Security Manager Study Guide