CISM practice questions 991–1,000

1. Question 991 · 1243 in bank

   Which of the following would BEST ensure that security is integrated during application development?

   • APerforming application security testing during acceptance testing
   • BIntroducing security requirements during the initiation phase
   • CEmploying global security standards during development processes
   • DProviding training on secure development practices to programmers

   Show answer

   Answer: B

   Explanation

   B. Introducing security requirements during the initiation phase. Introducing security requirements during the initiation phase of application development (B) is a best practice for ensuring that security is integrated throughout the development process. This ensures that security is considered and integrated early on in the development cycle, reducing the risk of security vulnerabilities being introduced or missed.

   Source: Adapted from community discussion — Broesweelies

   Next question

2. Question 992 · 1243 in bank

   Which of the following is MOST important in increasing the effectiveness of incident responders?

   • AIntegrating staff with the IT department
   • BTesting response scenarios
   • CCommunicating with the management team
   • DReviewing the incident response plan annually

   Show answer

   Answer: B

   Explanation

   B. Testing response scenarios. Testing response scenarios (B) is the most important factor in increasing the effectiveness of incident responders. This helps to identify any weaknesses in the incident response plan and procedures, as well as to train and familiarize incident responders with their roles and responsibilities in different scenarios. This can help to ensure that incident responders are prepared and capable of responding quickly and effectively in the event of a security incident. Integrating staff with the IT department (A) may help to ensure that incident responders have the necessary technical skills, but it is not the most important factor in increasing their effectiveness. Communicating with the management team (C) is important for keeping the management informed about incidents and their impact, but it is not the primary factor in increasing the effectiveness of incident responders. Reviewing the incident response plan annually (D) is important for maintaining the plan and ensuring that it is up to date, but it does not directly increase the effectiveness of incident responders.

   Source: Adapted from community discussion — Broesweelies

   Next question

3. Question 993 · 1243 in bank

   Which of the following should be the PRIMARY objective of the information security incident response process?

   • AClassifying incidents
   • BConducting incident triage
   • CCommunicating with internal and external parties
   • DMinimizing negative impact to critical operations

   Show answer

   Answer: D

   Next question

4. Question 994 · 1243 in bank

   An incident response team has been assembled from a group of experienced individuals. Which type of exercise would be MOST beneficial for the team at the first drill?

   • ATabletop exercise
   • BRed team exercise
   • CDisaster recovery exercise
   • DBlack box penetration test

   Show answer

   Answer: A

   Explanation

   A-Table top exercise. This is the start-up point for the new team starting their first drill since they will build experience from this exercise in order to strengthen their response capabilities. After this, they can carry out the other tests.

   Source: Adapted from community discussion — Nillanash

   Next question

5. Question 995 · 1243 in bank

   In violation of a policy prohibiting the use of cameras at the office, employees have been issued smartphones and tablet computers with enabled web cameras. Which of the following should be the information security manager's FIRST course of action?

   • ARevise the policy.
   • BConduct a risk assessment.
   • CCommunicate the acceptable use policy.
   • DPerform a root cause analysis.

   Show answer

   Answer: C

   Explanation

   The answer should be C. Communicate the acceptable use policy as that is the only one that addresses the issue now. Rationale: A. Revise the policy - This will take time and not do anything for the status quo. B. Conduct a risk assessment - This should be done after the policy has been communicated cause the risk has already occurred. They have phones. The question now is how bad is it going to be. If it's going to be bad as a stop-gap people need to be reminded of the acceptable use policy. D. Perform a root cause analysis - For what? We already know the cost.

   Source: Adapted from community discussion — dark_3k03r

   Next question

6. Question 996 · 1243 in bank

   When performing a business impact analysis (BIA), who should calculate the recovery time and cost estimates?

   • ABusiness process owner
   • BBusiness continuity coordinator
   • CInformation security manager
   • DSenior management

   Show answer

   Answer: A

   Explanation

   A business process owner (A) is the best option to calculate the recovery time and cost estimates because they have a deep understanding of the specific business processes and the systems and resources required to support those processes. They are in the best position to assess the impact of a disruption to the operations and determine the time and resources required to recover. The business continuity coordinator (B) may provide oversight and guidance during the BIA process, but they may not have the same level of detail and understanding of the specific business processes as the business process owner. The information security manager (C) may be involved in the BIA, but their focus is typically on the security of the systems and data, not the recovery time and cost estimates. Senior management (D) may have an overall understanding of the organization's operations, but they typically do not have the technical knowledge and understanding of the specific business processes to perform the calculations for the recovery time and cost estimates.

   Source: Adapted from community discussion — Broesweelies

   Next question

7. Question 997 · 1243 in bank

   A PRIMARY purpose of creating security policies is to:

   • Aimplement management's security governance strategy.
   • Bestablish the way security tasks should be executed.
   • Ccommunicate management's security expectations.
   • Ddefine allowable security boundaries.

   Show answer

   Answer: C

   Next question

8. Question 998 · 1243 in bank

   The MAIN benefit of implementing a data loss prevention (DLP) solution is to:

   • Aenhance the organization's antivirus controls.
   • Breduce the need for a security awareness program.
   • Ccomplement the organization's detective controls.
   • Deliminate the risk of data loss.

   Show answer

   Answer: C

   Explanation

   C. Complement the organization's detective controls. The main benefit of implementing a data loss prevention (DLP) solution is to complement the organization's detective controls. DLP solutions help prevent unauthorized disclosure of sensitive data by monitoring, detecting, and preventing the unauthorized transfer or access of sensitive information. While they can enhance security measures, they do not solely eliminate the risk of data loss.

   Source: Adapted from community discussion — REHAMAZZAM

   Next question

9. Question 999 · 1243 in bank

   Which of the following BEST describes a buffer overflow?

   • AA type of covert channel that captures data
   • BA function is carried out with more data than the function can handle
   • CMalicious code designed to interfere with normal operations
   • DA program contains a hidden and unintended function that presents a security risk

   Show answer

   Answer: B

   Explanation

   A buffer overflow occurs when a program writes more data to a block of memory, or buffer, than it was allocated to hold. This can lead to overwriting adjacent memory areas, potentially causing unpredictable behavior, crashes, or security vulnerabilities. In the context of security, attackers may exploit buffer overflows to execute arbitrary code, inject malicious payloads, or compromise the integrity of the affected system.

   Source: Adapted from community discussion — Viperhunter

   Next question

10. Question 1000 · 1243 in bank

    Which of the following is the MOST important detail to capture in an organization's risk register?

    • ARisk acceptance criteria
    • BRisk severity level
    • CRisk ownership
    • DRisk appetite

    Show answer

    Answer: C

    Explanation

    While risk acceptance criteria, risk severity level, and risk appetite are also important components of a risk management framework, without clear risk ownership, it can be challenging to effectively manage and address risks within an organization. Therefore, capturing risk ownership is often considered a fundamental aspect of a robust risk register.

    Source: Adapted from community discussion — oluchecpoint

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 991. 1243 questions available.