Question 1071 · 1243 in bank
A CISO learns that a third-party service provider did not notify the organization of a data breach that affected the service provider's data center. Which of the following should the CISO do FIRST?
Show answer
Answer: A
Certified Information Security Manager1,243 questions across 125 pages are complete and free, with no account or card.
1243 questions in this bank
Free access · progress saved on this device
A CISO learns that a third-party service provider did not notify the organization of a data breach that affected the service provider's data center. Which of the following should the CISO do FIRST?
Answer: A
Which of the following is MOST important to include in an incident response plan to ensure incidents are responded to by the appropriate individuals?
Answer: B
Which of the following is the PRIMARY role of an information security manager in a software development project?
Answer: C
C. To assess and approve the security application architecture The PRIMARY role of an information security manager in a software development project is typically to assess and approve the security application architecture. This involves ensuring that the design and architecture of the software include appropriate security measures and that it complies with security best practices and organizational security policies. While the other options (A, B, and D) are important responsibilities of an information security manager in the context of software development, assessing and approving the security architecture is a fundamental step to establish a strong foundation for secure software development.
Source: Adapted from community discussion — oluchecpoint
Which of the following MOST effectively identifies issues related to noncompliance with legal, regulatory, and contractual requirements?
Answer: D
D. Independent compliance audit An independent compliance audit is the most effective method for identifying issues related to noncompliance with legal, regulatory, and contractual requirements. An independent audit is typically conducted by a third-party or internal audit team that has no vested interest in the outcome, ensuring impartiality and accuracy in the assessment. This approach provides a comprehensive and objective evaluation of an organization's compliance with various requirements and can uncover issues that may not be apparent through other methods.
Source: Adapted from community discussion — oluchecpoint
Which of the following is MOST helpful for fostering an effective information security culture?
Answer: A
A. Obtaining support from key organizational influencers Fostering an effective information security culture involves not only technical measures but also the active engagement and commitment of the people within the organization. Obtaining support from key organizational influencers, such as senior executives and leaders, is crucial because they can set the tone for the organization and influence others to prioritize information security. When influential figures endorse and champion information security initiatives, it sends a strong message throughout the organization, making it more likely that employees will take security seriously and follow best practices.
Source: Adapted from community discussion — oluchecpoint
Which of the following is MOST relevant for an information security manager to communicate to the board of directors?
Answer: A
I believe the answer is A. The board of directors usually are only concerned with how much exposure they (the organization) have to whatever the security risk/threat.
Source: Adapted from community discussion — EZPASS
Which of the following is MOST important to convey to employees in building a security risk-aware culture?
Answer: C
Which of the following is the PRIMARY objective of integrating information security governance into corporate governance?
Answer: C
The PRIMARY objective of integrating information security governance into corporate governance is to adequately safeguard the business in achieving its mission. Therefore, option C?
Source: Adapted from community discussion — Pabl0T0rrez
Which of the following is an information security manager's MOST important action to mitigate the risk associated with malicious software?
Answer: B
Among the options provided, the MOST important action for an information security manager to mitigate the risk associated with malicious software is B. Implementing a multi-layered security program. A multi-layered security program combines various security measures and controls to create a comprehensive defense against malicious software. It involves implementing multiple layers of protection at different points in the IT infrastructure and user environment, significantly reducing the risk of successful malware attacks.
Source: Adapted from community discussion — sundersam23
Which of the following is the PRIMARY reason for granting a security exception?
Answer: C
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISM practice, question 1071. 1243 questions available.
Version 1.0.0. How we source questions