[2026年02月]更新のCISM日本語試験問題集合格させるのは2026年最新のCertified Information Security Manager (CISM日本語版)
無料で使えるCISM日本語試験問題集で合格させるお手軽に試験合格
質問 # 495
上級管理職が組織への影響を理解しやすくするために、情報セキュリティ リスク レポートに含めるべき最も重要な情報はどれですか。
- A. 特定された主要なセキュリティリスクのステータス
- B. 最近の侵入テストの結果
- C. 新しいセキュリティ技術に内在するリスク
- D. セキュリティリスクプロファイルの詳細な評価
正解：A
質問 # 496
重要なセキュリティ システムの残留リスクを受け入れるかどうかを判断する際に最も役立つのは次のうちどれですか。
- A. 緩和策の費用便益分析
- B. 利用可能な年間予算
- C. 復旧時間目標 (RTO)
- D. 最大許容停止時間 (MTO)
正解：A
解説：
Cost-benefit analysis of mitigating controls is the BEST way to assist in determining whether to accept residual risk of a critical security system, because it helps to compare the costs of implementing and maintaining the controls with the benefits of reducing the risk and the potential losses. Cost-benefit analysis can help to justify the investment in security controls and to optimize the level of residual risk that is acceptable for the organization.
References =
CISM Review Manual, 16th Edition, ISACA, 2020, p. 50: "Cost-benefit analysis is the process of comparing the costs of risk treatment options with the benefits of risk reduction and the potential losses from risk events." CISM Review Manual, 16th Edition, ISACA, 2020, p. 51: "Cost-benefit analysis can help to justify the investment in information security controls and to optimize the level of residual risk that is acceptable for the enterprise." CISM Domain 2: Information Risk Management (IRM) [2022 update]: "Cost-benefit analysis: This is a comparison of the costs of implementing and maintaining security controls with the benefits of reducing risk and potential losses. It helps to justify the investment in security controls and optimize the level of residual risk."
質問 # 497
情報セキュリティ マネージャーが変更管理プロセスに関与する最も重要な理由は、次の点を確認することです。
- A. リスクが評価されました。
- B. 潜在的な脆弱性が特定されます。
- C. セキュリティ制御は定期的に更新されます。
- D. セキュリティ制御はテクノロジーの変化を推進します。
正解：A
質問 # 498
インシデント対応計画を作成する際に、セキュリティ インシデントを明確に定義することの主な利点は、次の点です。
- A. インシデント対応プロセスを関係者に伝える
- B. インシデント対応チームに適切な人員を配置し、訓練する
- C. 効果的なエスカレーションおよび対応手順を開発する
- D. テーブルトップテストをより効果的にする
正解：C
質問 # 499
情報セキュリティ戦略とビジネス目標の整合性を示す最も効果的な方法は次のうちどれですか?
- A. バランス スコアカード
- B. ベンチマーク
- C. リスクマトリックス
- D. ヒートマップ
正解：A
解説：
Explanation
The balanced scorecard is a management tool that can be used to demonstrate the alignment of information security strategy with business objectives. The balanced scorecard provides a comprehensive view of an organization's performance by considering multiple dimensions, including financial performance, customer satisfaction, internal processes, and learning and growth.
By integrating information security objectives and metrics into the balanced scorecard, organizations can demonstrate how their information security investments support and align with their overall business objectives. This can help to gain the support and commitment of senior management and other stakeholders, as well as ensure that information security investments are effectively managed and optimized to deliver maximum value to the organization.
While other tools, such as risk matrices, benchmarking, and heat maps, can also provide valuable information, the balanced scorecard provides a more holistic and integrated view of organizational performance and the alignment of information security with business objectives.
質問 # 500
ビジネスの連携とセキュリティの所有権に加えて、情報セキュリティガバナンスにとって最も重要なものは次のうちどれですか？
- A. システムの監査可能性
- B. エグゼクティブスポンサーシップ
- C. セキュリティメトリックのレポート
- D. ポリシーへの準拠
正解：A
質問 # 501
インシデント対応チームは、インターネット上の既知の悪意のあるホストと通信しているシステムを隔離する必要があると判断しました。
次の関係者のうち、最初に連絡する必要があるのはどれですか？
- A. 事業主
- B. 経営陣
- C. システム管理者
- D. 主要顧客
正解：C
質問 # 502
次のどれに、機器およびソフトウェア ベンダーの担当者の連絡先情報を含める必要がありますか?
- A. ビジネス影響分析 (BIA)
- B. 事業継続計画 (BCP)
- C. 情報セキュリティプログラム憲章
- D. サービスレベル契約 (SLA)
正解：B
解説：
The document that should include contact information for representatives of equipment and software vendors is the business continuity plan (BCP) because it provides the guidance and procedures for restoring the organization's critical business functions and operations in the event of a disruption or disaster, and may require contacting external parties such as vendors for assistance or support. Information security program charter is not a good document for this purpose because it does not provide any guidance or procedures for business continuity or disaster recovery. Business impact analysis (BIA) is not a good document for this purpose because it does not provide any guidance or procedures for business continuity or disaster recovery.
Service level agreements (SLAs) are not good documents for this purpose because they do not provide any guidance or procedures for business continuity or disaster recovery. References: https://www.isaca.org
/resources/isaca-journal/issues/2017/volume-2/business-continuity-management-lifecycle https://www.isaca.
org/resources/isaca-journal/issues/2016/volume-4/business-impact-analysis
質問 # 503
ある組織の人事部門では、政府の規制に従うために、退職後 3 日以内にすべての企業 IT システムから従業員のアカウント権限を削除することを義務付けています。ただし、システムごとにユーザー ディレクトリが異なり、権限を削除するのに現在最大 4 週間かかります。次のうち、規制への準拠を最も効果的に実現できるのはどれですか。
- A. 特権アクセス管理 (PAM) システム
- B. ガバナンス、リスク、コンプライアンス (GRC) システム
- C. アイデンティティおよびアクセス管理 (IAM) システム
- D. 多要素認証（MFA）システム
正解：C
解説：
= An identity and access management (IAM) system is a set of processes, policies, and technologies that enable an organization to manage the identities and access rights of its users across different systems and applications1. An IAM system can help an organization to comply with the government regulation by automating the provisioning and deprovisioning of user accounts, enforcing consistent access policies, and integrating different user directories2. An IAM system can also provide audit trails and reports to demonstrate compliance with the regulation3. A multi-factor authentication (MFA) system is a method of verifying the identity of a user by requiring two or more factors, such as something the user knows, has, or is4. An MFA system can enhance the security of user authentication, but it does not address the issue of removing user privileges from different systems within three days of termination. A privileged access management (PAM) system is a solution that manages and monitors the access of privileged users, such as administrators, to critical systems and resources. A PAM system can reduce the risk of unauthorized or malicious use of privileged accounts, but it does not solve the problem of managing the access of regular users across different systems. A governance, risk, and compliance (GRC) system is a software platform that integrates the functions of governance, risk management, and compliance management. A GRC system can help an organization to align its objectives, policies, and processes with the relevant regulations, standards, and best practices, but it does not directly enable the removal of user privileges from different systems within three days of termination. References = 1: CISM Review Manual (Digital Version), page 24 2: 1 3: 2 4: CISM Review Manual (Digital Version), page 25 : CISM Review Manual (Digital Version), page 26 : CISM Review Manual (Digital Version), page 27
質問 # 504
情報セキュリティ ガバナンス プログラムを効果的に実施するために最も重要なのは次のうちどれですか?
- A. 従業員はカスタマイズされた情報セキュリティ トレーニングを受けます
- B. プログラムの目標は組織に伝達され、理解されています。
- C. 情報セキュリティの役割と責任が文書化されています。
- D. プログラム予算は上級管理者によって承認され、監視されています。
正解：B
解説：
Explanation
The program goals are communicated and understood by the organization is the most important factor for the effective implementation of an information security governance program because it ensures that the program is aligned with the business objectives and supported by the stakeholders. Employees receive customized information security training is not the most important factor, but rather a means to achieve the program goals and raise awareness among the staff. The program budget is approved and monitored by senior management is not the most important factor, but rather a resource to enable the program activities and measure its performance. Information security roles and responsibilities are documented is not the most important factor, but rather a way to define and assign the program tasks and accountabilities. References:
https://www.isaca.org/resources/isaca-journal/issues/2015/volume-1/how-to-measure-the-effectiveness-of-inform
https://www.isaca.org/resources/isaca-journal/issues/2016/volume-2/how-to-align-security-initiatives-with-busin
質問 # 505
組織全体の新しい情報セキュリティ プログラムのサポートを得るための最良の方法はどれですか?
- A. 情報セキュリティ啓発キャンペーンを実施します。
- B. 情報セキュリティ戦略委員会を設立する。
- C. 同様の業界組織と比較する
- D. 情報セキュリティ RACI チャートを公開します。
正解：B
解説：
= Establishing an information security strategy committee is the best way to obtain support for a new organization-wide information security program because it involves the participation and collaboration of key stakeholders from different business functions and levels who can provide input, guidance, and endorsement for the security program. An information security strategy committee is a governance body that oversees the development, implementation, and maintenance of the security program and aligns it with the organization's strategic objectives, risk appetite, and culture. An information security strategy committee can help to obtain support for the security program by:
Communicating the vision, mission, and goals of the security program to the organization and demonstrating its value and benefits.
Establishing roles and responsibilities for the security program and ensuring accountability and ownership.
Securing adequate resources and budget for the security program and allocating them appropriately.
Resolving conflicts and issues that may arise during the security program execution and ensuring alignment with other business processes and initiatives.
Monitoring and evaluating the performance and effectiveness of the security program and ensuring continuous improvement and adaptation.
Benchmarking against similar industry organizations is a useful technique to compare and improve the security program, but it is not the best way to obtain support for a new organization-wide information security program. Benchmarking involves measuring and analyzing the security program's processes, practices, and outcomes against those of other organizations that have similar characteristics, objectives, or challenges. Benchmarking can help to identify gaps, strengths, weaknesses, opportunities, and threats in the security program and to adopt best practices and standards that can enhance the security program's performance and maturity. However, benchmarking alone does not guarantee the support or acceptance of the security program by the organization, as it may not reflect the organization's specific needs, risks, or culture.
Delivering an information security awareness campaign is a vital component of the security program, but it is not the best way to obtain support for a new organization-wide information security program. An information security awareness campaign is a set of activities and initiatives that aim to educate and inform the organization's workforce and other relevant parties about the security program's policies, standards, procedures, and guidelines, as well as the security risks, threats, and incidents that may affect the organization. An information security awareness campaign can help to increase the security knowledge, skills, and behaviors of the organization's members and to foster a security risk-aware culture. However, an information security awareness campaign is not sufficient to obtain support for the security program, as it may not address the strategic, operational, or financial aspects of the security program or the expectations and interests of the different stakeholders.
Publishing an information security RACI chart is a helpful tool to define and communicate the security program's roles and responsibilities, but it is not the best way to obtain support for a new organization-wide information security program. A RACI chart is a matrix that assigns the level of involvement and accountability for each task or activity in the security program to each role or stakeholder. RACI stands for Responsible, Accountable, Consulted, and Informed, which are the four possible levels of participation. A RACI chart can help to clarify the expectations, obligations, and authority of each role or stakeholder in the security program and to avoid duplication, confusion, or conflict. However, a RACI chart does not ensure the support or commitment of the roles or stakeholders for the security program, as it may not address the benefits, challenges, or resources of the security program or the feedback and input of the roles or stakeholders. Reference = CISM Review Manual 15th Edition, pages 97-98, 103-104, 107-108, 111-112 Information Security Governance: Guidance for Boards of Directors and Executive Management, 2nd Edition - ISACA1 Information Security Strategy: The Key to Success - ISACA2 Deliver an information security awareness campaign is the BEST approach to obtain support for a new organization-wide information security program. An information security awareness campaign is a great way to raise awareness of the importance of information security and the impact it can have on an organization. It helps to ensure that all stakeholders understand the importance of information security and are aware of the risks associated with it. Additionally, an effective awareness campaign can help to ensure that everyone in the organization is aware of the cybersecurity policies, procedures, and best practices that must be followed.
質問 # 506
インシデント対応計画を作成するとき、セキュリティ インシデントの明確な定義を確立することの主な利点は、次のことに役立つことです。
- A. 関係者へのインシデント対応プロセス
- B. 効果的なエスカレーションおよび対応手順を作成します。
- C. 適切な人員を配置し、インシデント対応チームをトレーニングします。
- D. 卓上テストをより効果的にします。
正解：B
解説：
Explanation
The primary benefit of establishing a clear definition of a security incident is that it helps to develop effective escalation and response procedures. A security incident is an event or an attempt that disrupts or threatens the normal operations, security, or privacy of an organization's information or systems1. A clear definition of a security in-cident helps to:
*Distinguish between normal and abnormal events, and between security-relevant and non-security-relevant events
*Determine the severity and impact of an incident, and the appropriate level of response
*Assign roles and responsibilities for incident detection, reporting, analysis, containment, eradication, recovery, and post-incident activities
*Establish criteria and thresholds for escalating incidents to higher authorities or external parties
*Define the communication channels and protocols for incident notification and coordina-tion
*Document the incident response process and procedures in a formal plan According to NIST, a clear definition of a security incident is one of the key compo-nents of an effective incident response capability2. The other options are not the prima-ry benefits of establishing a clear definition of a security incident. Communicating the incident response process to stakeholders is important, but it is not the main purpose of defining a security incident. Adequately staffing and training incident response teams is essential, but it depends on other factors besides defining a security inci-dent. Making tabletop testing more effective is a possible outcome, but not a direct benefit of defining a security incident. References: 2: NIST SP
800-61 Rev. 2 Computer Security Incident Handling Guide 1: NIST Glossary - Security Incident : What is a securi-ty incident? - TechTarget : 10 types of security incidents and how to handle them - TechTarget : 45 CFR § 164.304 - Definitions - Electronic Code of Federal Regulations
質問 # 507
資産の分類と管理において、どのプログラム要素を最初に実装する必要がありますか？
- A. リスク軽減
- B. 評価
- C. リスク評価
- D. 分類
正解：B
解説：
説明
保護が必要な資産を特定して理解するために、評価が最初に実行されます。リスク評価は、最初のステップである評価によって選択された情報資産に対する脅威を特定し、定量化するために実行されます。
分類とリスク軽減は、評価に続くステップです。
質問 # 508
情報セキュリティ運営委員会の有効性にとって最も重要なのは次のどれですか?
- A. 委員会は規制に関する深い知識を持っています。
- B. 委員会には組織横断的な代表者がいます。
- C. 委員会はリスク管理フレームワークを使用します。
- D. 委員会は上級管理職の代表者で構成されています。
正解：B
質問 # 509
リスクの是正を優先する際に最も重要な考慮事項は次のうちどれですか？
- A. 曝露時間
- B. リスク食欲との比較
- C. リスクの評価
- D. コンプライアンスの影響
正解：D
質問 # 510
上級管理職は、組織の侵入防止システムがビジネスの運用を繰り返し混乱させる可能性があるという懸念を表明しています。情報セキュリティ管理者がこの懸念に対処するためにシステムを調整したことを示しているのは、次のうちどれですか？
- A. 偽陰性の減少
- B. 誤検知の増加
- C. 誤検知の減少
- D. 偽陰性の増加
正解：C
質問 # 511
IT環境の変更によってもたらされるセキュリティの危険性を最小限に抑えるために、変更管理の一部として実装することが最も重要なのは次のうちどれですか？
- A. 実装前にビジネス影響分析（B1A）を実行する
- B. 上級管理職による承認が必要
- C. 運用開始前にセキュリティリスク評価を実施する
- D. 変更チケットを閉じる前に変更後のレビューを実行する
正解：C
質問 # 512
リスクを適切に軽減するための予防制御が実行可能でない場合、情報セキュリティマネージャーが実行する最も重要なアクションは次のうちどれですか？
- A. 許容できないリスクレベルを特定します。
- B. 潜在的な脅威を評価します。
- C. 脆弱性を評価します。
- D. 影響を管理します。
正解：A
質問 # 513
残留リスクがリスクの許容レベルを超えている場合、情報セキュリティ管理者にとって最善の対策は次のうちどれですか？
- A. 追加のコントロールを推奨
- B. ビジネス管理に従う
- C. 費用便益分析の実行
- D. リスク評価を実行します
正解：A
質問 # 514
企業は以前、ゼロデイ脆弱性に関連するリスクを受け入れていました。同じ脆弱性は、最近、同じ業界の別の組織に対する注目を集める攻撃で悪用されました。情報セキュリティ管理者の最初の行動方針は次のうちどれですか？
- A. 最良および最悪のシナリオを開発します。
- B. 脆弱性を修正するコストを評価します。
- C. 他の組織の違反を上級管理職に報告します。
- D. 可能性と影響の観点からリスクを再評価します。
正解：D
質問 # 515
インシデント後のレビューを実施する際の主な目標は、次の点を特定することです。
- A. サイバーセキュリティ予算の追加ニーズ
- B. インシデント対応計画の弱点
- C. 追加のトレーニングが必要な個人
- D. 上級管理職と共有する情報
正解：B
解説：
The core objective of a post-incident review (PIR) is to identify gaps and weaknesses in the response process. This includes missteps, delays, communication failures, or policy limitations - all of which provide insight to improve future incident handling.
"Post-incident reviews focus on identifying root causes and areas for improvement to enhance the organization's preparedness for future incidents."
- CISM Review Manual 15th Edition, Chapter 4: Post-Incident Activities* Though training, reporting, and budgeting may follow, they are secondary outcomes of this process.
質問 # 516
情報セキュリティ ガバナンス プログラムの採用を成功させるために最も大きな影響を与えるのは、次のうちどれですか?
- A. 組織文化
- B. 防除効果
- C. セキュリティ管理プロセス
- D. セキュリティ ポリシー
正解：A
解説：
Explanation
Organizational culture is the set of shared values, beliefs, and norms that influence the way employees think, feel, and behave in the workplace. It affects how employees perceive the importance of information security, how they comply with security policies and procedures, and how they support security initiatives and goals. A strong security culture can foster a sense of ownership, responsibility, and accountability among employees, as well as a positive attitude toward security awareness and training. A weak security culture can lead to resistance, indifference, or hostility toward security efforts, as well as increased risks of human errors, negligence, or malicious actions. Therefore, organizational culture has the greatest influence on the successful adoption of an information security governance program, which requires the commitment and involvement of all levels of the organization. References = CISM Review Manual 15th Edition, page 30-31.
Learn more:
質問 # 517
脅威インテリジェンス レポートで業界を標的とした大量のランサムウェア攻撃が報告されている場合、情報セキュリティ マネージャーが取るべき最善の行動はどれですか。
- A. 緩和するセキュリティ制御を確認します。
- B. システム バックアップの頻度を増やします。
- C. 組織に対するリスクを評価します。
- D. 脅威についてスタッフに通知します。
正解：C
解説：
The best course of action for an information security manager when a threat intelligence report indicates a large number of ransomware attacks targeting the industry is to assess the risk to the organization. This means evaluating the likelihood and impact of a potential ransomware attack on the organization's assets, operations, and reputation, based on the current threat landscape, the organization's security posture, and the effectiveness of the existing security controls. A risk assessment can help the information security manager prioritize the most critical assets and processes, identify the gaps and weaknesses in the security architecture, and determine the appropriate risk response strategies, such as avoidance, mitigation, transfer, or acceptance.
A risk assessment can also provide a business case for requesting additional resources or support from senior management to improve the organization's security resilience and readiness. The other options are not the best course of action because they are either too reactive or too narrow in scope. Increasing the frequency of system backups (A) is a good practice to ensure data availability and recovery in case of a ransomware attack, but it does not address the prevention or detection of the attack, nor does it consider the potential data breach or extortion that may accompany the attack. Reviewing the mitigating security controls (B) is a part of the risk assessment process, but it is not sufficient by itself. The information security manager should also consider the threat sources, the vulnerabilities, the impact, and the risk appetite of the organization. Notifying staff members of the threat is a useful awareness and education measure, but it should be done after the risk assessment and in conjunction with other security policies and procedures. Staff members should be informed of the potential risks, the indicators of compromise, the reporting mechanisms, and the best practices to avoid or respond to a ransomware attack. References = CISM Review Manual 2022, pages 77-78, 81-82, 316; CISM Item Development Guide 2022, page 9; #StopRansomware Guide | CISA; [The Human Consequences of Ransomware Attacks - ISACA]; [Ransomware Response, Safeguards and Countermeasures - ISACA]
質問 # 518
情報セキュリティプログラムがコーポレートガバナンスと整合しているかどうかを判断する最良の方法は次のうちどれですか？
- A. セキュリティイニシアチブの資金を評価します。
- B. バランススコアカードを確認します。
- C. コーポレートガバナンスについてエンドユーザーを調査します。
- D. 情報セキュリティポリシーを確認します。
正解：D
解説：
説明
説明
戦略を実行するためのアクションプランの最も重要な側面の1つは、必要に応じてポリシーと標準を作成または変更することです。ポリシーはガバナンスの主要な要素の1つであり、各ポリシーには一般的なセキュリティ上の義務を1つだけ記載する必要があります。ロードマップには、手順と順序、依存関係、マイルストーンが表示されます。
質問 # 519
......
CISM日本語試験問題集、CISM日本語練習テスト問題：https://www.jpntest.com/shiken/CISM-JPN-mondaishu