CISM — Most Debated Topics

Community-voted ranking of 64 topics, sorted by disagreement level. Higher dispute = more test-takers disagree on the answer.

#1
How Should Unpatched Systems Violating Policy Be Treated?
A-Grade Dispute: 57% 4 comments
#2
How to Keep a Business Continuity Plan Current?
S-Grade Dispute: 50% 5 comments
#3
Best Defense Against DDoS Attacks in Enterprise Networks?
S-Grade Dispute: 50% 5 comments
#4
When Should a Business Continuity Plan Be Primarily Triggered?
S-Grade Dispute: 50% 6 comments
#5
Which Approach Best Communicates Security to Senior Management?
S-Grade Dispute: 50% 4 comments
#6
Who decides to change a specific control?
A-Grade Dispute: 50% 3 comments
#7
How to Ensure Effective Execution of a Disaster Recovery Plan?
S-Grade Dispute: 47% 5 comments
#8
What Best Facilitates Developing Information Security Procedures?
A-Grade Dispute: 46% 3 comments
#9
First Step in Aligning InfoSec Strategy with Business Goals?
S-Grade Dispute: 45% 6 comments
#10
What is Most Important When Establishing Security Metrics for Executive Reporting?
A-Grade Dispute: 43% 4 comments
#11
Best Input for a Business Case Addressing System Vulnerabilities?
S-Grade Dispute: 42% 5 comments
#12
Best Indicator of Integrating Information Security Governance with Corporate Governance
S-Grade Dispute: 40% 5 comments
#13
Validating Business Continuity Readiness via Testing Methods
S-Grade Dispute: 40% 5 comments
#14
What Is Most Important When Choosing a Shared Alternate Site?
S-Grade Dispute: 40% 3 comments
#15
Greatest Concern When Outsourcing HR Data Processing?
A-Grade Dispute: 40% 4 comments
#16
How to Determine Security Program Alignment with Business Strategy?
A-Grade Dispute: 40% 4 comments
#17
Essential Practices for Forensic Investigation Workstations
S-Grade Dispute: 40% 3 comments
#18
How to Ensure Third-Party Vendor Security Effectively?
S-Grade Dispute: 37% 6 comments
#19
What Is Most Important When Reviewing an Incident Response Plan?
S-Grade Dispute: 36% 5 comments
#20
Preserving Evidence Integrity During Server Intrusion Response
A-Grade Dispute: 36% 3 comments
#21
Most Important Element in an Information Security Framework?
S-Grade Dispute: 33% 5 comments
#22
When Should Risk Assessment Occur Before a Business Case?
S-Grade Dispute: 33% 5 comments
#23
Primary Preventive Method for Privileged Account Risks
S-Grade Dispute: 33% 5 comments
#24
What Is the Primary Objective of an InfoSec Program?
A-Grade Dispute: 33% 4 comments
#25
Executive Role in Security Governance
A-Grade Dispute: 33% 4 comments
#26
Best method for comparing IaaS and internal hosting risk scenarios?
A-Grade Dispute: 33% 4 comments
#27
What Is the First Step in Malware Incident Triage?
A-Grade Dispute: 33% 3 comments
#28
Identifying Emerging Technology Threats
A-Grade Dispute: 33% 4 comments
#29
How Should an ISM Support Cloud Application Migration?
A-Grade Dispute: 33% 3 comments
#30
Which Plan Best Prepares an Organization to Recover from Disaster-Related Revenue Loss?
S-Grade Dispute: 29% 5 comments
#31
What Does an Information Security Strategy Primarily Input To?
A-Grade Dispute: 29% 3 comments
#32
Best control for detecting zero-day targeted attacks
A-Grade Dispute: 29% 4 comments
#33
Who Enforces Access Controls for CRM Data in CISM?
S-Grade Dispute: 27% 7 comments
#34
How to Encourage Business Units to Adopt Security Roles?
S-Grade Dispute: 27% 6 comments
#35
How to Best Enhance Incident Response Plan Processes?
A-Grade Dispute: 25% 4 comments
#36
Justifying Security Investments for Critical Applications
A-Grade Dispute: 25% 4 comments
#37
What is Most Important for Effective Cybersecurity Incident Management?
S-Grade Dispute: 20% 6 comments
#38
What Is Most Important When Planning Cyberattack Eradication?
S-Grade Dispute: 20% 5 comments
#39
What is a Key Consideration in Quantitative Risk Analysis?
A-Grade Dispute: 20% 4 comments
#40
Best Control for Protecting Cloud-Stored Customer Personal Information
A-Grade Dispute: 20% 4 comments
#41
What is the Most Important Objective When Recommending Controls?
A-Grade Dispute: 20% 3 comments
#42
When Is an Information Security Control No Longer Relevant?
S-Grade Dispute: 17% 6 comments
#43
Greatest impact on information classification scheme development
A-Grade Dispute: 17% 3 comments
#44
Greatest Risk of a Poorly Trained Incident Response Team?
S-Grade Dispute: 17% 4 comments
#45
Best Method to Determine System Activities During a Cyber Incident
A-Grade Dispute: 14% 3 comments
#46
What is the Primary Advantage of Using DRaaS?
A-Grade Dispute: 14% 4 comments
#47
Most Useful Tool for Data Center Business Continuity Strategy?
A-Grade Dispute: 14% 3 comments
#48
How Does Data Discovery Assist With Data Classification?
A-Grade Dispute: 12% 3 comments
#49
Which IDS Performance Trend Causes Greatest Concern?
A-Grade Dispute: 10% 3 comments
#50
What Does a Business Impact Analysis Best Enable an Organization to Establish?
A-Grade Dispute: 0% 3 comments
#51
What Is the First Step After an Undisclosed Vendor Breach?
A-Grade Dispute: 0% 3 comments
#52
Primary objective of a security culture
A-Grade Dispute: 0% 3 comments
#53
Aligning Incident Response Plan with Corporate Strategy
A-Grade Dispute: 0% 3 comments
#54
Risk Appetite Influence on Regulatory Response
A-Grade Dispute: 0% 3 comments
#55
Best metric to gain senior management support for risk treatment?
A-Grade Dispute: 0% 3 comments
#56
Who owns risk of unauthorized application data access?
A-Grade Dispute: 0% 3 comments
#57
Most Important Security Measure for Remote Employees?
A-Grade Dispute: 0% 4 comments
#58
Best way to improve departmental risk management effectiveness?
A-Grade Dispute: 0% 3 comments
#59
Third-Party Security Vendor Selection Criteria
A-Grade Dispute: 0% 6 comments
#60
How to Determine Application Resilience Requirements?
A-Grade Dispute: 0% 3 comments
#61
First Step for Actively Exploited Application Vulnerability
A-Grade Dispute: 0% 3 comments
#62
What is most important when selecting CISM key risk indicators?
A-Grade Dispute: 0% 4 comments
#63
First Action for Information Security Budget Cuts
A-Grade Dispute: 0% 3 comments
#64
What Is Most Important When Engaging an External Penetration Test?
A-Grade Dispute: 0% 4 comments

Ready to practice?

Access 400 CISM questions with instant feedback and detailed explanations.

View CISM Practice Questions →

← Back to CISM ISACA Certified Information Security Manager Study Guide