Question 1101 · 1243 in bank
Which of the following should be established FIRST when implementing an Information security governance framework?
Show answer
Answer: B
Certified Information Security Manager1,243 questions across 125 pages are complete and free, with no account or card.
1243 questions in this bank
Free access · progress saved on this device
Which of the following should be established FIRST when implementing an Information security governance framework?
Answer: B
An information security team is planning a security assessment of an existing vendor. Which of the following approaches is MOST helpful for properly scoping the assessment?
Answer: B
Since it's existing vendor, reviewing the list of controls in the contract will provide the most appropriate scope. Others may be more relevant for new vendor.
Source: Adapted from community discussion — BennyMao
A third-party audit of an organization's network security has identified several critical risks. Which of the following should the information security manager do NEXT?
Answer: D
Although, the hint here is "network security", meaning technical stuff. So no business processes are in direct danger. So maybe it is D after all...dunno really :)
Source: Adapted from community discussion — AlexJacobson
Which of the following provides the BEST evidence that a recently established information security program is effective?
Answer: A
An investigation of a recent security incident determined that the root cause was negligent handling of incident alerts by system administrators. What is the BEST way for the information security manager to address this issue?
Answer: B
An organization is the victim or a targeted attack and is unaware of the compromise until a security analyst notices an additional user account on the firewall. The implementation of which of the following would have detected the incident?
Answer: B
Of the following, who is accountable for data loss in the event of an information security incident at a third-party provider?
Answer: D
No, it does not. You cannot transfer or delegate accountability. Third-party provider is responsible, while business owner (who hired the third-party) is accountable.
Source: Adapted from community discussion — AlexJacobson
Which of the following BEST minimizes information security risk in deploying applications to the production environment?
Answer: B
Well, I'm not so sure it's D. The question is about the deployment to production (from development, I assume). Option D considers SDLC, so it would reduce the risk of introducing vulnerabilities in the application itself. And while one can argue that by increasing the security of the application that you're deploying in production effectively lowers the risk in general, the question is still about the PROCESS of moving something from one environment to another (i.e. the managing the changes in the environment), not the SDLC. So I'm going with B on this one.
Source: Adapted from community discussion — AlexJacobson
Which of the following would BEST guide the development and maintenance of an information security program?
Answer: B
To guide the development and maintenance of an information security program, it is important to have a comprehensive understanding of the organization’s risk appetite 1. This will help in identifying the level of risk that the organization is willing to accept and the level of security that is required to protect the organization’s assets.
Source: Adapted from community discussion — killainc
Which of the following is the MOST essential element of an information security program?
Answer: C
Involving functional managers in program development ensures that the information security program aligns with the organization's overall business objectives and takes into account the specific needs and requirements of different business functions. This collaboration helps in obtaining buy-in from key stakeholders, understanding the business context, and tailoring security measures to fit the organization's unique operational landscape. While prioritizing program deliverables based on available resources (Option A) and benchmarking against global standards (Option B) are important considerations, involving functional managers ensures that the program is closely aligned with the organization's specific operational context. Applying project management practices used by the business (Option D) is beneficial, but it is not as fundamental as involving functional managers in the development of the program.
Source: Adapted from community discussion — Viperhunter
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISM practice, question 1101. 1243 questions available.
Version 1.0.0. How we source questions