CISM practice questions 1,021–1,030

1. Question 1021 · 1243 in bank

   Which of the following is MOST likely to be included in an enterprise security policy?

   • ADefinitions of responsibilities
   • BRetention schedules
   • CSystem access specifications
   • DOrganizational risk

   Show answer

   Answer: A

   Explanation

   Google Bard responded with: -Scope -Policy statements -Responsibilities -Procedures -Controls -Compliance -Training -Monitoring While Chat GPT responded with: -Purpose and scope -Roles and responsibilities -Access controls -Risk management -Security awareness and training -Incident management -Compliance and auditing Looking at what is common in Bard and ChatGPT, while looking at the answers that are displayed... the only one that stands out is the Definition of Responsibilities.

   Source: Adapted from community discussion — dark_3k03r

   Next question

2. Question 1022 · 1243 in bank

   Which of the following BEST validates that security controls are implemented in a new business process?

   • AVerify the use of a recognized control framework
   • BReview the process for conformance with information security best practices
   • CBenchmark the process against industry practices
   • DAssess the process according to information security policy

   Show answer

   Answer: D

   Explanation

   D. Assess the process according to information security policy would BEST validate that security controls are implemented in a new business process. By assessing the process against the organization's own information security policy, it ensures that the controls implemented align with the organization's overall security stance and meet their specific requirements.

   Source: Adapted from community discussion — Broesweelies

   Next question

3. Question 1023 · 1243 in bank

   Which of the following BEST indicates that information assets are classified accurately?

   • AAn accurate and complete information asset catalog
   • BAppropriate assignment of information asset owners
   • CAppropriate prioritization of information risk treatment
   • DIncreased compliance with information security policy

   Show answer

   Answer: A

   Explanation

   A. An accurate and complete information asset catalog BEST indicates that information assets are classified accurately. This is because having a comprehensive and accurate catalog of information assets helps in identifying the criticality and value of each asset, which is necessary for determining the level of protection they require. Proper classification and cataloging also helps ensure that appropriate controls are in place to protect sensitive information and meet regulatory requirements.

   Source: Adapted from community discussion — Broesweelies

   Next question

4. Question 1024 · 1243 in bank

   Reevaluation of risk is MOST critical when there is:

   • Aa management request for updated security reports.
   • Bresistance to the implementation of mitigating controls.
   • Ca change in the threat landscape.
   • Da change in security policy.

   Show answer

   Answer: C

   Next question

5. Question 1025 · 1243 in bank

   Which of the following BEST supports investments in an information security program?

   • ABusiness impact analysis (BIA)
   • BRisk assessment results
   • CGap analysis results
   • DBusiness cases

   Show answer

   Answer: D

   Explanation

   The correct answer is (D) Business cases because this is the only one that lists the problem, solution and how much is required to get it done. Thus why it's the only one that supports investment. (A) Business impact analysis (BIA) is incorrect cause it is a decomposition of business processes with the output being RTO, RPO and other such related items. (B) Risk assessment results is incorrect cause this is insufficient cause it doesn't contain the things that would convenience management that a business case has: - goals - list of benefits - costs - risk with the initiatives - implementation plan - evaluation plan The risk assessment only explains risk without the business context. (C) Gap analysis results is incorrect cause this is the difference between the present and future state... but it doesn't say why the business should care which is what you are going to need to get that investment.

   Source: Adapted from community discussion — dark_3k03r

   Next question

6. Question 1026 · 1243 in bank

   Which of the following is MOST important to ensure when developing escalation procedures for an incident response plan?

   • AMinimum regulatory requirements are maintained.
   • BThe contact list regularly updated.
   • CEach process is assigned to a responsible party.
   • DSenior management approval has been documented.

   Show answer

   Answer: C

   Explanation

   Ensuring that each process in the escalation procedures for an incident response plan is assigned to a responsible party is crucial for ensuring the effectiveness of the incident response. This helps to ensure that there is clear accountability for each step in the process, and that actions are taken in a timely and effective manner. It also helps to prevent confusion, delays, and miscommunication during the incident response, as each party knows their role and responsibilities. This is why it is the most important factor to consider when developing escalation procedures for an incident response plan.

   Source: Adapted from community discussion — Broesweelies

   Next question

7. Question 1027 · 1243 in bank

   Which of the following is the PRIMARY benefit of implementing a vulnerability assessment process?

   • ACompliance status is improved.
   • BThreat management is enhanced.
   • CSecurity metrics are enhanced.
   • DProactive risk management is facilitated.

   Show answer

   Answer: D

   Next question

8. Question 1028 · 1243 in bank

   An organization is implementing an information security governance framework. To communicate the program's effectiveness to stakeholders, it is MOST important to establish:

   • Aa control self-assessment (CSA) process.
   • Bmetrics for each milestone.
   • Cautomated reporting to stakeholders.
   • Da monitoring process for the security policy.

   Show answer

   Answer: B

   Explanation

   B. metrics for each milestone. Establishing metrics for each milestone allows organizations to measure and communicate the effectiveness of their information security governance framework to stakeholders. Metrics provide objective and quantifiable measurements that demonstrate progress, performance, and the impact of the framework on the organization's security posture.

   Source: Adapted from community discussion — sundersam23

   Next question

9. Question 1029 · 1243 in bank

   Which of the following would be the MOST effective way to present quarterly reports to the board on the status of the information security program?

   • ADetailed analysis of security program KPIs
   • BAn information security risk register
   • CAn information security dashboard
   • DA capability and maturity assessment

   Show answer

   Answer: C

   Explanation

   C. An information security dashboard An information security dashboard provides a concise and visual representation of key information security metrics and KPIs in a format that is easy to understand at a glance. It allows board members to quickly assess the overall health and performance of the information security program, identify trends, and track progress towards security goals. Dashboards often include charts, graphs, and other visual elements that make it easier to communicate complex information in a way that is both informative and accessible to a non-technical audience like a board of directors.

   Source: Adapted from community discussion — oluchecpoint

   Next question

10. Question 1030 · 1243 in bank

    Which of the following is the BEST way to obtain support for a new organization-wide information security program?

    • ADeliver an information security awareness campaign.
    • BPublish an information security RACI chart.
    • CBenchmark against similar industry organizations.
    • DEstablish an information security strategy committee.

    Show answer

    Answer: D

    Explanation

    Establishing an information security strategy committee is the best way to obtain support for a new organization-wide information security program because it brings together key stakeholders from different parts of the organization to help define and implement the program. This helps to ensure that the program aligns with the overall business goals and objectives and that it has the support and commitment of key stakeholders. The committee can also help to communicate the benefits and importance of the program to the wider organization, and ensure that everyone understands their role in supporting and implementing the program.

    Source: Adapted from community discussion — Broesweelies

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 1021. 1243 questions available.