CISM practice questions 111–120

1. Question 111 · 1243 in bank

   Which of the following is MOST important for effective cybersecurity incident management?

   • AEarly detection and response
   • BRegular tabletop exercises
   • CRoot cause analysis
   • DInvestigation and forensics

   Show answer

   Answer: A

   Explanation

   If refer to effective incident management, then it is identify and response. The faster it detect and better procedure or incident classification , the better to minimise risk.

   Source: Adapted from community discussion — afoo1314

   Next question

2. Question 112 · 1243 in bank

   Which of the following is the BEST method to protect consumer private information for an online public website?

   • AApply strong authentication to online accounts
   • BEncrypt consumer data in transit and at rest
   • CUse secure encrypted transport layer
   • DApply a masking policy to the consumer data

   Show answer

   Answer: B

   Explanation

   Encrypting consumer data in transit (as it travels over the internet) and at rest (when stored on servers or databases) is a fundamental and effective security measure. This helps safeguard the confidentiality of the information even if unauthorized access occurs. Encryption ensures that even if data is intercepted or accessed by unauthorized parties, it remains unreadable and secure. While options such as applying strong authentication to online accounts (option A), using secure encrypted transport layer (option C), and applying a masking policy to consumer data (option D) are important security practices, encrypting consumer data addresses the core concern of protecting the data itself from unauthorized access or disclosure.

   Source: Adapted from community discussion — Viperhunter

   Next question

3. Question 113 · 1243 in bank

   Which of the following metrics is the BEST measure of the effectiveness of an information security program?

   • AReduction in the amount of risk exposure in an organization
   • BReduction in the number of threats to an organization
   • CReduction in the cost of risk remediation for an organization
   • DReduction in the number of vulnerabilities in an organization

   Show answer

   Answer: A

   Explanation

   Both ChatGPT and Bard have stated that Risk Exposure is the correct answer since that is the ultimate goal of the organization. The following answers are incorrect for the following reasons: (B) Threat may increase or decrease due to environmental factors outside of the program's control. (C) The Cost of remediation is inherently hard to predict as every incident will be different. (D) Vulnerabilities are subject to changes in the environment and the numbers will fluctuate regardless of the security program in place and thus is not a good place to get numbers from.

   Source: Adapted from community discussion — dark_3k03r

   Next question

4. Question 114 · 1243 in bank

   An organization uses a security standard that has undergone a major revision by the certifying authority. The old version of the standard will no longer be used for organizations wishing to maintain their certifications. Which of the following should be the FIRST course of action?

   • AModify policies to ensure new requirements are covered.
   • BReview the new standard for applicability to the business.
   • CEvaluate the cost of maintaining the certification.
   • DCommunicate the new standard to senior leadership.

   Show answer

   Answer: B

   Next question

5. Question 115 · 1243 in bank

   Which of the following is the MOST appropriate metric to demonstrate the effectiveness of information security controls to senior management?

   • ANumber of security vulnerabilities uncovered with network scans
   • BPercentage of servers patched
   • CDowntime due to malware infections
   • DAnnualized loss resulting from security incidents

   Show answer

   Answer: D

   Explanation

   D - The metric provides a comprehensive view of the financial impact of security incidents, helping senior management understand the real-world consequences of inadequate controls

   Source: Adapted from community discussion — Booict

   Next question

6. Question 116 · 1243 in bank

   Which of the following is the BEST indication that an organization has integrated information security governance with corporate governance?

   • AImpact is measured according to business loss when assessing IT risk.
   • BService levels for security vendors are defined according to business needs.
   • CSecurity policies are reviewed whenever business objectives are changed.
   • DSecurity performance metrics are measured against business objectives.

   Show answer

   Answer: D

   Next question

7. Question 117 · 1243 in bank

   The MOST effective way to present information security risk to senior management is to highlight:

   • Abusiness impact.
   • Bcountermeasures.
   • Cthreat intelligence.
   • Drisk mitigation over time.

   Show answer

   Answer: A

   Next question

8. Question 118 · 1243 in bank

   Which of the following should be the PRIMARY objective for creating a culture of security within an organization?

   • ATo obtain resources for information security initiatives
   • BTo reduce risk to acceptable levels
   • CTo prioritize security within the organization
   • DTo demonstrate control effectiveness to senior management

   Show answer

   Answer: B

   Next question

9. Question 119 · 1243 in bank

   Which of the following should be updated FIRST when aligning the incident response plan with the corporate strategy?

   • ASecurity procedures
   • BDisaster recovery plan (DRP)
   • CIncident notification plan
   • DRisk response scenarios

   Show answer

   Answer: D

   Explanation

   D - The FIRST area to update is the “Risk response scenarios”. These scenarios ensure that the response plan aligns with the organization’s overall risk management approach.

   Source: Adapted from community discussion — Booict

   Next question

10. Question 120 · 1243 in bank

    Which of the following is the MOST effective way to ensure the security of services and solutions delivered by third-party vendors?

    • AReview third-party contracts as part of the vendor management process.
    • BPerform an audit on vendors' security controls and practices.
    • CIntegrate risk management into the vendor management process.
    • DConduct security reviews on the services and solutions delivered.

    Show answer

    Answer: C

    Explanation

    leaning towards C. by integrating risk management into the vendor management process, you proactively define and shape security requirements for vendors upfront. That's a more effective way than doing security reviews and following up with deviations from time to time.

    Source: Adapted from community discussion — Josef4CISM

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 111. 1243 questions available.