CISM practice questions 1,001–1,010

1. Question 1001 · 1243 in bank

   Which of the following is the GREATEST benefit of information asset classification?

   • ASupporting segregation of duties
   • BDefining resource ownership
   • CProviding a basis for implementing a need-to-know policy
   • DHelping to determine the recovery point objective (RPO)

   Show answer

   Answer: C

   Explanation

   A need-to-know policy is a security principle that restricts access to information and resources based on the principle that individuals should only have access to the minimum amount of information necessary to perform their job duties. This principle helps to ensure the confidentiality, integrity, and availability of sensitive information by limiting access to those who have a legitimate need for it. The policy is typically implemented through the use of user authentication, access controls, and information classification, and is intended to minimize the risk of unauthorized access, use, or disclosure of sensitive information.

   Source: Adapted from community discussion — Broesweelies

   Next question

2. Question 1002 · 1243 in bank

   While classifying information assets, an information security manager notices that several production databases do not have owners assigned to them. What the information security manager address this situation?

   • AAssign the highest classification level to those databases.
   • BAssign responsibility to the database administrator (DBA).
   • CPrepare a report of the databases for senior management.
   • DReview the databases for sensitive content.

   Show answer

   Answer: C

   Explanation

   DBA is data custodian, not data owner. Senior management needs to assign the ownership to a new data owner from the business side.

   Source: Adapted from community discussion — Bruh_Moment

   Next question

3. Question 1003 · 1243 in bank

   An organization’s research department plans to apply machine learning algorithms on a large data set containing customer names and purchase history. The risk leakage is considered high impact. Which of the following is the BEST risk treatment option in this situation?

   • AAccept the risk, as the benefits exceed the potential consequences.
   • BMitigate the risk by applying anonymization on the data set.
   • CTransfer the risk by purchasing insurance.
   • DMitigate the risk by encrypting the customer names in the data set.

   Show answer

   Answer: B

   Explanation

   As Goseu said, very weird question. Encryption wouldn't fly because ML couldn't do it's thing, while anonymizing the data would irreversibly obfuscate it. Yet, seems the most correct answer here.

   Source: Adapted from community discussion — AlexJacobson

   Next question

4. Question 1004 · 1243 in bank

   IT projects have gone over budget with too many security controls being added post-production. Which of the following would MOST help to ensure that relevant to a project?

   • AInvolving information security at each stage of project management
   • BCreating a data classification framework and providing it to stakeholders
   • CIdentifying responsibilities during the project business case analysis
   • DProviding stakeholders with minimum information security requirements

   Show answer

   Answer: A

   Next question

5. Question 1005 · 1243 in bank

   Which of the following is the BEST approach to reduce unnecessary duplication of compliance activities?

   • AIntegration of assurance efforts
   • BAutomation of controls
   • CDocumentation of control procedures
   • DStandardization of compliance requirements

   Show answer

   Answer: A

   Explanation

   I am also struggling with this one. The question asks how to BEST prevent duplication. For me, integration does not prevent duplication. However, standardization may?

   Source: Adapted from community discussion — Gr3yGh0sT

   Next question

6. Question 1006 · 1243 in bank

   Which of the following BEST helps to ensure a risk response plan will be developed and executed in a timely manner?

   • AEstablishing risk metrics
   • BTraining on risk management procedures
   • CReporting on documented deficiencies
   • DAssigning a risk owner

   Show answer

   Answer: D

   Explanation

   D. Assigning a risk owner. Assigning a risk owner is crucial for effective risk management and ensuring timely action. A risk owner takes responsibility for identifying, assessing, and managing the risks associated with a particular area or process within the organization. By assigning a risk owner, there is clear accountability and ownership of the risk response plan, ensuring that actions are taken in a timely manner.

   Source: Adapted from community discussion — mad68

   Next question

7. Question 1007 · 1243 in bank

   An information security manager learns that IT personnel are not adhering to the information security policy because it creates process inefficiencies. What should the information security manager do FIRST?

   • APropose that IT update information security policies and procedures.
   • BRequest that internal audit conduct a review of the policy development process.
   • CConduct user awareness training within the IT function.
   • DDetermine the risk related to noncompliance with the policy.

   Show answer

   Answer: D

   Explanation

   D. Determine the risk related to noncompliance with the policy. Before making any changes to policies or conducting training, it's essential to understand the potential impact of noncompliance. Once the risks are assessed, the information security manager can make informed decisions about how to address the issue effectively. This step is crucial for ensuring that any actions taken align with the organization's security goals and priorities.

   Source: Adapted from community discussion — oluchecpoint

   Next question

8. Question 1008 · 1243 in bank

   Which of the following is MOST important to include in a report to key stakeholders regarding the effectiveness of an information security program?

   • ASecurity incident details
   • BSecurity metrics
   • CSecurity risk exposure
   • DSecurity baselines

   Show answer

   Answer: B

   Explanation

   My mind is blown at how people go through 700+ questions and still answering questions incorrectly. Security metrics/heat maps are always the best answer when the question includes stakeholders and reporting

   Source: Adapted from community discussion — POWNED

   Next question

9. Question 1009 · 1243 in bank

   An organization is increasingly using Software as a Service (SaaS) to replace in-house hosting and support of IT applications. Which of the following would be the MOST effective way to help ensure procurement decisions consider information security concerns?

   • AIntegrate information security risk assessments into the procurement process.
   • BInvite IT members into regular procurement team meetings to influence best practice.
   • CEnforce the right to audit in procurement contracts with SaaS vendors.
   • DProvide regular information security training to the procurement team.

   Show answer

   Answer: A

   Explanation

   A. Integrating information security risk assessments into the procurement process would be the MOST effective way to help ensure procurement decisions consider information security concerns. This approach would ensure that security risks are evaluated and considered during procurement, leading to more secure procurement decisions.

   Source: Adapted from community discussion — Broesweelies

   Next question

10. Question 1010 · 1243 in bank

    Which of the following is the MOST important consideration when selecting members for an information security steering committee?

    • AInformation security expertise
    • BTenure in the organization
    • CBusiness expertise
    • DCross-functional composition

    Show answer

    Answer: D

    Explanation

    The Correct Answer is D because an information Security Steering Committee is composed of the following members: The chief information security officer (CISO) The chief information officer (CIO) The chief operating officer (COO) The chief financial officer (CFO) The general counsel Representatives from key business units Representatives from key functional areas (i.e. human resources, IT, and legal) and the only answer that hs this is D. Rationale: A. Is limited to only one group B. Doesn't have enough diversity C. Tenure doesn't say anything about diversity D. This is the correct answer since cross-functional composition is the practice of assembling a team with members from different functional areas or departments within an organization.

    Source: Adapted from community discussion — dark_3k03r

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 1001. 1243 questions available.