CISM practice questions 1,081–1,090

1. Question 1081 · 1243 in bank

   Which of the following is MOST effective in preventing the introduction of vulnerabilities that may disrupt the availability of a critical business application?

   • AA patch management process
   • BChange management controls
   • CVersion control
   • DLogical access controls

   Show answer

   Answer: B

   Explanation

   Among the options provided, B. Change management controls are MOST effective in preventing the introduction of vulnerabilities that may disrupt the availability of a critical business application. While options A (patch management process), C (version control), and D (logical access controls) are important security measures, they are not specifically focused on preventing the introduction of vulnerabilities that disrupt the availability of critical business applications. Patch management and version control primarily address software updates and versioning, while logical access controls focus on controlling user access to systems and data.

   Source: Adapted from community discussion — sundersam23

   Next question

2. Question 1082 · 1243 in bank

   An organization is planning to outsource the execution of its disaster recovery activities. Which of the following would be MOST important to include in the outsourcing agreement?

   • ARequirements for regularly testing backups
   • BThe disaster recovery communication plan
   • CRecovery time objectives (RTOs)
   • DDefinition of when a disaster should be declared

   Show answer

   Answer: C

   Explanation

   DRaaS vendor never triggers when DR starts. Vendor usually at a remote location and wouldn’t know if primary site was impacted. Business always declares the disaster for whatever reason.

   Source: Adapted from community discussion — enk

   Next question

3. Question 1083 · 1243 in bank

   Which of the following is the GREATEST benefit of incorporating information security governance into the corporate governance framework?

   • AManagement accountability for information security
   • BImproved process resiliency in the event of attacks
   • CPromotion of security-by-design principles to the business
   • DHeightened awareness of information security strategies

   Show answer

   Answer: A

   Next question

4. Question 1084 · 1243 in bank

   Which type of plan is PRIMARILY intended to reduce the potential impact of security events that may occur?

   • AIncident response plan
   • BBusiness continuity plan (BCP)
   • CSecurity awareness plan
   • DDisaster recovery plan (DRP)

   Show answer

   Answer: A

   Explanation

   A- As per previous questions that cover the fact that incident response teams (and so incidents themselves) are there to mitigate impact

   Source: Adapted from community discussion — AaronS1990

   Next question

5. Question 1085 · 1243 in bank

   Which of the following is the MOST important outcome of strategic alignment of corporate and information security governance?

   • AImplementation of information security controls
   • BDevelopment of a common and comprehensive set of IT security policies
   • CHigher acceptance of information security projects
   • DReduction of adverse impacts on the organization to an acceptable level

   Show answer

   Answer: D

   Next question

6. Question 1086 · 1243 in bank

   Which of the following is MOST important to have in place as a basis for developing an effective information security program that supports the organization's business goals?

   • AAn information security strategy
   • BA defined security organizational structure
   • CInformation security policies
   • DMetrics to drive the information security program

   Show answer

   Answer: A

   Explanation

   Chat God say The most important factor to have in place as a basis for developing an effective information security program is an information security strategy. This strategy should define the organization's objectives and the measures that will be taken to achieve them. Additionally, the strategy should set the framework for the other components of the program, such as information security policies, metrics, and organizational structure.

   Source: Adapted from community discussion — koala_lay

   Next question

7. Question 1087 · 1243 in bank

   Which of the following BEST enables the integration of information security governance into corporate governance?

   • ASenior management approval of the information security strategy
   • BClear lines of authority across the organization
   • CAn information security steering committee with business representation
   • DWell-documented information security policies and standards

   Show answer

   Answer: C

   Next question

8. Question 1088 · 1243 in bank

   Senior management has just accepted the risk of noncompliance with a new regulation. What should the information security manager do NEXT?

   • AReport the decision to the compliance officer.
   • BReassess the organization's risk tolerance.
   • CUpdate details within the risk register.
   • DAssess the impact of the regulation.

   Show answer

   Answer: C

   Explanation

   The correct answer is (C) cause that is the only thing that the security manager is responsible for and can act on. Rationale: (A) isn't right cause the compliance officer already knows. It's part of his job (B) This is outside the scope of the security manager's role and is the job of the board of directors. (D) This is the job of the compliance officer. More verbose details: Chief Compliance offer is responsible for: - Assessing the impact of the new regulation on the organization. - Developing and implementing a plan to comply with the regulation. - Monitoring the organization's compliance with the regulation. - Reporting on the organization's compliance to senior management.

   Source: Adapted from community discussion — dark_3k03r

   Next question

9. Question 1089 · 1243 in bank

   Which of the following contributes MOST to the effectiveness of information security governance?

   • AProperly managed risk
   • BAlignment with technology strategy
   • CStakeholder commitment
   • DA defined security policy

   Show answer

   Answer: C

   Next question

10. Question 1090 · 1243 in bank

    Which of the following is the BEST approach for addressing noncompliance with security standards?

    • AMaintain a security exceptions process.
    • BApply additional logging and monitoring to affected assets.
    • CDiscontinue affected activities until security requirements can be met.
    • DDevelop new security standards.

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 1081. 1243 questions available.