Question 1061 · 1243 in bank
Who is accountable for ensuring risk mitigation is effective?
Show answer
Answer: C
Certified Information Security Manager1,243 questions across 125 pages are complete and free, with no account or card.
1243 questions in this bank
Free access · progress saved on this device
Who is accountable for ensuring risk mitigation is effective?
Answer: C
Which of the following BEST enables an information security manager to obtain organizational support for the implementation of security controls?
Answer: D
To support effective risk decision making, which of the following is MOST important to have in place?
Answer: B
Risk reporting procedures play a crucial role in facilitating effective risk decision making. They provide a structured and systematic approach for collecting, analyzing, and presenting risk-related information to decision-makers within the organization.
Source: Adapted from community discussion — wello
Which of the following parties should be responsible for determining access levels to an application that processes client information?
Answer: D
business unit management (option D) should be responsible for determining access levels to an application that processes client information. Their understanding of the business context, ownership of outcomes, and contextual knowledge of the data make them best suited to make informed decisions about access rights within their respective business units.
Source: Adapted from community discussion — wello
An information security manager has been informed of a new vulnerability in an online banking application, and a patch to resolve this issue is expected to be released in the next 72 hours. Which of the following should the information security manager do FIRST?
Answer: C
Performing a risk assessment is crucial to understand the potential impact and likelihood of the vulnerability being exploited during the 72-hour window before the patch is available. This assessment will help the manager make informed decisions about whether to implement mitigating controls (A), notify senior management (D), and prioritize actions based on the level of risk associated with the vulnerability. A risk assessment will consider factors such as the criticality of the system, the sensitivity of the data, the existing security controls, and the potential consequences of the vulnerability being exploited. It will help determine if immediate mitigating controls are necessary or if other actions should be taken to reduce the risk while waiting for the patch.
Source: Adapted from community discussion — oluchecpoint
What should be an information security manager's MOST important consideration when developing a multi-year plan?
Answer: B
When performing a business impact analysis (BIA), who should be responsible for determining the initial recovery time objective (RTO)?
Answer: D
Which of the following will ensure confidentiality of content when accessing an email system over the Internet?
Answer: A
Who is BEST suited to determine how the information in a database should be classified?
Answer: D
Which of the following is an incident containment method?
Answer: B
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISM practice, question 1061. 1243 questions available.
Version 1.0.0. How we source questions