Question 1141 · 1243 in bank
An organization's quality process can BEST support security management by providing:
Show answer
Answer: B
Certified Information Security Manager1,243 questions across 125 pages are complete and free, with no account or card.
1243 questions in this bank
Free access · progress saved on this device
An organization's quality process can BEST support security management by providing:
Answer: B
Which of the following is the MOST important consideration when defining an information security framework?
Answer: C
Many aspects of organization culture are already taken into account while defining the business strategy, in addition to other critical business considerations. Therefore, the answer has to be C, Business strategy.
Source: Adapted from community discussion — CISSPST
Which of the following is the MOST important consideration for reporting risk assessment results to senior management?
Answer: B
Which of the following BEST enables the deployment of consistent security throughout international branches within a multinational organization?
Answer: C
Best Answer is C, Establishing a security governance is more far reaching. CISM AIO 2nd - "Intro to information Security Governance"
Source: Adapted from community discussion — MSKid
Which of the following is the BEST way to determine the effectiveness of an incident response plan?
Answer: D
A tabletop exercise is a simulation of a security incident that allows the organization to test its incident response plan and evaluate its effectiveness. During the exercise, the incident response team and other relevant stakeholders can work through a hypothetical scenario to identify any weaknesses or gaps in the plan and make improvements as needed. This can help to ensure that the organization is prepared to respond effectively to a real security incident.
Source: Adapted from community discussion — paul1394
Which of the following should be an information security manager's MOST important consideration when determining the priority for implementing security controls?
Answer: C
Which of the following is the PRIMARY reason for an information security manager to periodically review existing controls?
Answer: C
Which of the following should be done FIRST when implementing a security program?
Answer: C
It is not possible to analyze the risk to an asset without first identifying it. Risk Management Process: 1. Establishing risk context 2. Risk identification (i) Asset identification (ii) Asset valuation and classification (iii) Threat identification and evaluation (iv) Vulnerability assessment 3. Risk Analysis: likelihood x impact 4. Risk Evaluation: evaluate determined risk against risk acceptance criteria 5. Risk Response: Accept, Transfer, Avoid, Mitigate. As part of mitigation, we select the control. The order would be: C, D, B, A
Source: Adapted from community discussion — CISSPST
Of the following, who is MOST appropriate to own the risk associated with the failure of a privileged access control?
Answer: C
These questions are always hard for me when accountable is not a word in the question. Hate to have to do this, but ISACA heavily states that the Business owner is always accountable for any risks . Since this question involves failure I am going to correlate own=accountable making the best answer C. I could be wrong, but here is my explanation of why I am going with C.
Source: Adapted from community discussion — POWNED
Which of the following is an example of a deterrent control?
Answer: B
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISM practice, question 1141. 1243 questions available.
Version 1.0.0. How we source questions