CISM practice questions 1,231–1,240

1. Question 1231 · 1243 in bank

   Which of the following MUST be established to maintain an effective information security governance framework?

   • ASecurity controls automation
   • BChange management processes
   • CSecurity policy provisions
   • DDefined security metrics

   Show answer

   Answer: C

   Explanation

   Security policy provisions outline the rules and guidelines for ensuring the confidentiality, integrity, and availability of information within an organization. These provisions help establish the overall direction and goals of the information security program. They provide a framework for implementing security controls, defining security metrics, and managing changes in a consistent and controlled manner.

   Source: Adapted from community discussion — koala_lay

   Next question

2. Question 1232 · 1243 in bank

   Which of the following is the BEST defense-in-depth implementation for protecting high value assets or for handling environments that have trust concerns?

   • AContinuous monitoring
   • BCompartmentalization
   • CMulti-factor authentication
   • DOverlapping redundancy

   Show answer

   Answer: B

   Explanation

   As a pentester, I can confidently say that you are wrong on this one. Lateral movement is absolutely possible even if you layer the security. If you separate (compartmentalize), then jumping around the network becomes much more complicated if not impossible.

   Source: Adapted from community discussion — AlexJacobson

   Next question

3. Question 1233 · 1243 in bank

   When scoping a risk assessment, assets need to be classified by:

   • Asensitivity and criticality.
   • Blikelihood and impact.
   • Cthreats and opportunities.
   • Dredundancy and recoverability.

   Show answer

   Answer: A

   Explanation

   A is correct. You measure a risk by Likelihood x impact but the asset classification is based on sensitivity and criticality

   Source: Adapted from community discussion — k4d4v4r

   Next question

4. Question 1234 · 1243 in bank

   When responding to a security incident, information security management and the affected business unit management cannot agree whether to escalate the incident to senior management. Which of the following would MOST effectively prevent this situation from recurring?

   • ADevelop additional communication channels.
   • BObtain senior management buy-in for incident response processes.
   • CPeriodically test the incident response plan.
   • DCreate a clear definition of incident classifications.

   Show answer

   Answer: D

   Next question

5. Question 1235 · 1243 in bank

   Which of the following should be done FIRST to ensure information security is integrated in system development projects?

   • AAssign resources based on the business impact.
   • BDefine security requirements.
   • CReview the security policy.
   • DEmbed a security representative in each project team.

   Show answer

   Answer: B

   Explanation

   The first step to ensure information security is integrated into system development projects is to define security requirements. By clearly defining the security requirements early on in the project, the development team can ensure that security measures are implemented from the very beginning. This helps to prevent any potential vulnerabilities or risks from being overlooked or addressed as an afterthought. Once the security requirements are defined, the other options mentioned can also be implemented accordingly.

   Source: Adapted from community discussion — koala_lay

   Next question

6. Question 1236 · 1243 in bank

   For which of the following is it MOST important that system administrators be restricted to read-only access?

   • AUser access log files
   • BAdministrator user profiles
   • CSystem logging options
   • DAdministrator log files

   Show answer

   Answer: D

   Explanation

   Option Explanation A. User access log files While it's important to maintain the integrity of user access logs, system administrators typically have legitimate reasons to access and modify these logs for administrative purposes. B. Administrator user profiles Restricting system administrators to read-only access for their own user profiles can enhance security, but it's not as critical as restricting access to administrator log files. C. System logging options System administrators typically need full access to configure and manage system logging options. Restricting them to read-only access would hinder their ability to perform their duties effectively.

   Source: Adapted from community discussion — Cyberbug2021

   Next question

7. Question 1237 · 1243 in bank

   Which of the following business units should own the data that populates an identity management system?

   • ALegal
   • BHuman resources (HR)
   • CInformation security
   • DInformation technology

   Show answer

   Answer: B

   Next question

8. Question 1238 · 1243 in bank

   Which of the following BEST indicates senior management support for an information security program?

   • ATop-down communication
   • BRegular security awareness training
   • CParticipation in a certification program
   • DSteering committee involvement

   Show answer

   Answer: D

   Explanation

   Top-down communication sets a mandate and provides security objectives, which is not the same as support. However, steerco's (consisting of senior management) regular involvement is the best indication of support.

   Source: Adapted from community discussion — CISSPST

   Next question

9. Question 1239 · 1243 in bank

   When selecting metrics to monitor the effectiveness of an information security program, it is MOST important for an information security manager to:

   • Aidentify the program's risk and compensating controls.
   • Bconsider the organization's business strategy.
   • Cconsider the strategic objectives of the program.
   • Dleverage industry benchmarks.

   Show answer

   Answer: C

   Explanation

   While the organization's business strategy should influence the overall security posture, it doesn't directly determine the specific metrics that measure the program's effectiveness.

   Source: Adapted from community discussion — Cyberbug2021

   Next question

10. Question 1240 · 1243 in bank

    A business continuity plan (BCP) should contain:

    • Acriteria for activation.
    • Bhardware and software inventories.
    • Cdata restoration procedures.
    • Dinformation about eradication activities.

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 1231. 1243 questions available.