A person working at a bank receives a call on a voice-over Internet protocol line from a person claiming to be an employee of the bank at another branch office. He is requesting customer information. The FIRST action to take when receiving this type of call is to:

ISACA CISM Exam syllabus in brief:

Information Security Governance    
A. Enterprise Governance
B. Information Security Strategy

Information Security Risk Management    
A. Information Security Risk Assessment
B. Information Security Risk Response

Information Security Program    
A. Information Security Program Development
B. Information Security Program Management

Incident Management    
A. Incident Management Readiness
B. Incident Management Operations