CISM practice questions 1,211–1,220

1. Question 1211 · 1243 in bank

   Which of the following is the PRIMARY purpose of establishing an information security governance framework?

   • ATo proactively address security objectives
   • BTo reduce security audit issues
   • CTo enhance business continuity planning
   • DTo minimize security risks

   Show answer

   Answer: A

   Explanation

   A. To proactively address security objectives The PRIMARY purpose of establishing an information security governance framework is to proactively address security objectives. This involves establishing and maintaining a framework and supporting processes to ensure that information security strategies align with business objectives and that risks are managed effectively. By doing so, it provides a structured approach to safeguarding digital assets, processes, and systems from cyber threats, while ensuring compliance with applicable laws and regulations. Information security governance frameworks are designed to define the organization's security objectives, identify and assess risks, and develop policies and procedures. This proactive approach to addressing security objectives helps organizations not only meet their regulatory and compliance requirements but also manage and mitigate potential security risks before they can impact the business.

   Source: Adapted from community discussion — helg420

   Next question

2. Question 1212 · 1243 in bank

   Which of the following practices is MOST effective for determining the adequacy of incident management operations?

   • AConducting unannounced external vulnerability testing
   • BTesting current incident response plans with relevant stakeholders
   • CAssessing incident response team members’ incident response skills
   • DReviewing incident response procedures against best practices

   Show answer

   Answer: B

   Explanation

   B. Testing current incident response plans with relevant stakeholders Testing current incident response plans with relevant stakeholders is the most effective practice for determining the adequacy of incident management operations. This process, often referred to as tabletop exercises or simulations, involves simulating various incident scenarios and evaluating how well the incident response plans and team members perform in real-time. It allows organizations to identify weaknesses, gaps, and areas for improvement in their incident management operations.

   Source: Adapted from community discussion — oluchecpoint

   Next question

3. Question 1213 · 1243 in bank

   Which of the following MUST happen immediately following the identification of a malware incident?

   • AEradication
   • BContainment
   • CPreparation
   • DRecovery

   Show answer

   Answer: B

   Next question

4. Question 1214 · 1243 in bank

   Which of the following is MOST effective in monitoring an organization's existing risk?

   • AVulnerability assessment results
   • BSecurity information and event management (SIEM) systems
   • CPeriodic updates to risk register
   • DRisk management dashboards

   Show answer

   Answer: D

   Explanation

   Out of the options provided, the most effective method for monitoring an organization's existing risk would likely be D. Risk management dashboards. Risk management dashboards are specifically designed to provide a comprehensive overview of an organization's risk landscape. They consolidate and display relevant risk information in a visually accessible format, allowing stakeholders to quickly identify and assess potential risks. These dashboards typically include key risk indicators, metrics, and trends, enabling organizations to track risk levels, monitor mitigation efforts, and make informed decisions based on real-time data. security information and event management (SIEM) systems (option B) are valuable tools for identifying and addressing specific security vulnerabilities and incidents, they may not provide the broader context needed for comprehensive risk monitoring.

   Source: Adapted from community discussion — koala_lay

   Next question

5. Question 1215 · 1243 in bank

   Which of the following BEST indicates that information security governance and corporate governance are integrated?

   • AThe information security team is aware of business goals.
   • BA cost-benefit analysis is conducted on all information security initiatives.
   • CThe board is regularly informed of information security key performance indicators (KPIs).
   • DThe information security steering committee is composed of business leaders.

   Show answer

   Answer: D

   Explanation

   D. The information security steering committee is composed of business leaders. This is because the information security steering committee is responsible for overseeing the organization's information security program and by having business leaders on the steering committee, it ensures that information security is aligned with the organization's business goals.

   Source: Adapted from community discussion — afc1019

   Next question

6. Question 1216 · 1243 in bank

   Which of the following should be the PRIMARY basis for determining the value of assets?

   • ACost of replacing the assets
   • BTotal cost of ownership (TCO)
   • CBusiness cost when assets are not available
   • DOriginal cost of the assets minus depreciation

   Show answer

   Answer: C

   Explanation

   The primary basis for determining the value of assets should be option C, which is the business cost when assets are not available. This approach takes into consideration the potential impact on the business if the assets were to become unavailable or compromised. It factors in the cost of disruption, loss of productivity, and potential damage to the business's reputation. While options A, B, and D may provide some insight into the value of assets, they do not fully capture the potential business impact in the same way as option C.

   Source: Adapted from community discussion — koala_lay

   Next question

7. Question 1217 · 1243 in bank

   Which of the following is MOST helpful to identify whether information security policies have been followed?

   • ACorrective controls
   • BDirective controls
   • CDetective controls
   • DPreventive controls

   Show answer

   Answer: C

   Next question

8. Question 1218 · 1243 in bank

   Which of the following is the MOST important reason to classify an incident after detection?

   • ATo assign appropriate prioritization levels
   • BTo obtain funds for external forensic support
   • CTo approve data breach notifications
   • DTo ensure management is accurately informed

   Show answer

   Answer: A

   Next question

9. Question 1219 · 1243 in bank

   Which of the following principles BEST addresses the protection of data from unauthorized modification?

   • ANonrepudiation
   • BIntegrity
   • CAvailability
   • DAuthenticity

   Show answer

   Answer: B

   Next question

10. Question 1220 · 1243 in bank

    The MAIN reason for continuous monitoring of the security program is to:

    • Avalidate reduction of incidents.
    • Bconfirm benefits are being realized.
    • Censure alignment with industry standards.
    • Doptimize resource allocation.

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 1211. 1243 questions available.