Question 1091 · 1243 in bank
Which of the following is the BEST method for managing information security compliance of third-party suppliers?
Show answer
Answer: D
Certified Information Security Manager1,243 questions across 125 pages are complete and free, with no account or card.
1243 questions in this bank
Free access · progress saved on this device
Which of the following is the BEST method for managing information security compliance of third-party suppliers?
Answer: D
An organization is in the process of creating an agreement with a cloud provider. Who should determine the third party's destruction schedule for the organization's information?
Answer: C
Which of the following is the BEST course of action when an organization's incident response team does not have expertise in forensic analysis?
Answer: A
What should be the FIRST step when investigating an employee suspected of inappropriately downloading proprietary information?
Answer: B
A. Check for a signed nondisclosure agreement (NDA). - Pretty sure you already know there has been a breach of terms or you wouldn't be concerned. So for me no need to check this. C. Conduct a forensic examination of the device. - Not necessary at this stage D. Discuss the concern with the employee. - No because you could alarm them to the fact that you're onto them. Answer: B. Review system access logs. - This is the best at this stage as it won't raise the alarm and may gather evidence or otherwise exonerate them.
Source: Adapted from community discussion — AaronS1990
Which of the following is MOST critical to ensure that information security incidents are managed properly?
Answer: B
Another shit question: A. Conducting an incident capability maturity assessment - Not as beneficial as any of the others C. Establishing an incident management performance matrix - Helpful. But doesn't do much without a team D. Assembling the incident response team - Helpful. But who will be in the team, how will they react in an incident. I just wonder if a semi-trained team is better than no team at all... Answer: B. Testing the incident response plan - If by implication a team and/or matrix is in place then I assume testing it is the best.
Source: Adapted from community discussion — AaronS1990
The GREATEST challenge when attempting data recovery of a specific file during forensic analysis is when:
Answer: D
The greatest challenge when attempting data recovery of a specific file is when the file has been overwritten. Option D is the correct answer. When a file is overwritten, the original data is replaced with new data, making it extremely difficult, if not impossible, to recover the original file. In such cases, it becomes challenging to retrieve the original content of the file during forensic analysis.
Source: Adapted from community discussion — koala_lay
Which of the following is MOST helpful in determining the criticality of an organization's business functions?
Answer: D
The contribution of recovery point objective (RPO) to disaster recovery is to:
Answer: C
Which of the following BEST provides an information security manager with sufficient assurance that a service provider complies with the organization's information security requirements?
Answer: B
I still like B. It’s a close one but ISACA love right to audit clauses and D checks against industry standards and not your organisation’s standards. B
Source: Adapted from community discussion — AaronS1990
An information security manager is MOST likely to obtain approval for a new security project when the business case provides evidence of:
Answer: B
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISM practice, question 1091. 1243 questions available.
Version 1.0.0. How we source questions