CISM practice questions 1,031–1,040

1. Question 1031 · 1243 in bank

   To confirm that a third-party provider complies with an organization's information security requirements, it is MOST important to ensure:

   • Acontract clauses comply with the organization's information security policy.
   • Bsecurity metrics are included in the service level agreement (SLA).
   • Cthe information security policy of the third-party service provider is reviewed.
   • Dright to audit is included in the service level agreement (SLA).

   Show answer

   Answer: D

   Explanation

   D can be also an option. Right to audit as a part of the SLA Security Clause. Justification: Reviewing the information security policy is the lowest level of assurance and is realized by performing self-assessments of provided documentation. The second level of assurance is realized by third-party statements. For Business Critical Security Controls the third level of assurance is realized by continuous auditing executed based on the SLA Security Clause.

   Source: Adapted from community discussion — Wladysk

   Next question

2. Question 1032 · 1243 in bank

   Which of the following BEST enables an organization to transform its culture to support information security?

   • AStrong management support
   • BRobust technical security controls
   • CPeriodic compliance audits
   • DIncentives for security incident reporting

   Show answer

   Answer: A

   Next question

3. Question 1033 · 1243 in bank

   Which of the following is the MOST effective way for an organization to ensure its third-party service providers are aware of information security requirements and expectations?

   • AIncluding information security clauses within contracts
   • BAuditing the service delivery of third-party providers
   • CProviding information security training to third-party personnel
   • DRequiring third parties to sign confidentiality agreements

   Show answer

   Answer: A

   Explanation

   Answer is A Including information security clauses within contracts is the most effective way for an organization to ensure its third-party service providers are aware of information security requirements and expectations. By explicitly outlining information security requirements and expectations within contracts, organizations establish clear guidelines and obligations for third-party providers to adhere to. These clauses may cover aspects such as data protection, confidentiality, access controls, incident response procedures, and compliance with relevant regulations. While auditing the service delivery of third-party providers (Option B), providing information security training to third-party personnel (Option C), and requiring third parties to sign confidentiality agreements (Option D) are all important measures, including information security clauses within contracts establishes a formal agreement and legal framework that explicitly addresses information security concerns and responsibilities.

   Source: Adapted from community discussion — kipling

   Next question

4. Question 1034 · 1243 in bank

   An organization is close to going live with the implementation of a cloud-based application. Independent penetration test results have been received that show a high-rated vulnerability. Which of the following would be the BEST way to proceed?

   • APostpone the implementation until the vulnerability has been fixed.
   • BCommission further penetration tests to validate initial test results.
   • CAssess whether the vulnerability is within the organization's risk tolerance levels.
   • DImplement the application and request the cloud service provider to fix the vulnerability.

   Show answer

   Answer: C

   Explanation

   The best way to proceed would be to assess whether the vulnerability is within the organization's risk tolerance levels. If the vulnerability is within the organization's risk tolerance levels, then the organization can proceed with the implementation of the cloud-based application. If the vulnerability is not within the organization's risk tolerance levels, then the organization can either postpone the implementation until the vulnerability has been fixed or commission further penetration tests to validate the initial test results.

   Source: Adapted from community discussion — koala_lay

   Next question

5. Question 1035 · 1243 in bank

   Which of the following is the BEST way to achieve compliance with new global regulations related to the protection of personal information?

   • AReview contracts and statements of work (SOWs) with vendors.
   • BDetermine current and desired state of controls.
   • CExecute a risk treatment plan.
   • DImplement data regionalization controls.

   Show answer

   Answer: B

   Explanation

   I would like to think B is the answer. Sometimes I don't understand the thought process behind the answers here, how do you achieve compliance of a global regulation but regionalization?

   Source: Adapted from community discussion — Dravidian

   Next question

6. Question 1036 · 1243 in bank

   Which of the following should be given the HIGHEST priority during an information security post-incident review?

   • AEvaluating incident response effectiveness
   • BDocumenting actions taken in sufficient detail
   • CEvaluating the performance of incident response team members
   • DUpdating key risk indicators (KRIs)

   Show answer

   Answer: A

   Next question

7. Question 1037 · 1243 in bank

   Which of the following is the BEST course of action when an online company discovers a network attack in progress?

   • AShut off all network access points.
   • BIsolate the affected network segment.
   • CDump all event logs to removable media.
   • DEnable trace logging on all events.

   Show answer

   Answer: B

   Next question

8. Question 1038 · 1243 in bank

   Which of the following is the BEST reason for an organization to use Disaster Recovery as a Service (DRaaS)?

   • AIt transfers the risk associated with recovery to a third party.
   • BIt eliminates the need for the business to perform testing.
   • CIt eliminates the need to maintain offsite facilities.
   • DIt lowers the annual cost to the business.

   Show answer

   Answer: A

   Explanation

   I like C. How can you transfer Risk (Answer A) to 3rd party, this is organization business not 3rd party's ones. You can transfer in case of insurance at a possible high cost even if low probability

   Source: Adapted from community discussion — omaigret

   Next question

9. Question 1039 · 1243 in bank

   When properly implemented, secure transmission protocols protect transactions:

   • Afrom eavesdropping.
   • Bin the server's database.
   • Cfrom denial of service (DoS) attacks.
   • Don the client desktop.

   Show answer

   Answer: A

   Next question

10. Question 1040 · 1243 in bank

    An organization is in the process of acquiring a new company. Which of the following would be the BEST approach to determine how to protect newly acquired data assets prior to integration?

    • AReview data architecture.
    • BInclude security requirements in the contract.
    • CPerform a risk assessment.
    • DAssess security controls.

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 1031. 1243 questions available.