CISM practice questions 121–130

1. Question 121 · 1243 in bank

   Which of the following eradication methods is MOST appropriate when responding to an incident resulting in malware on an application server?

   • ADisconnect the system from the network.
   • BChange passwords on the compromised system.
   • CRestore the system from a known good backup.
   • DPerform operation system hardening.

   Show answer

   Answer: C

   Next question

2. Question 122 · 1243 in bank

   Which of the following is MOST important for guiding the development and management of a comprehensive information security program?

   • AAdopting information security program management best practices
   • BAligning the organization's business objectives with IT objectives
   • CEstablishing and maintaining an information security governance framework
   • DImplementing policies and procedures to address the information security strategy

   Show answer

   Answer: C

   Next question

3. Question 123 · 1243 in bank

   Which of the following is the BEST course of action if the business activity residual risk is lower than the acceptable risk level?

   • AUpdate the risk assessment framework.
   • BMonitor the effectiveness of controls.
   • CReview the risk probability and impact.
   • DReview the inherent risk level.

   Show answer

   Answer: B

   Explanation

   Monitoring the effectiveness of controls ensures that the implemented controls are working as intended and that the residual risk is still within the acceptable level. This process helps to identify if the controls need to be adjusted, replaced or removed. It is important to have a regular monitoring process in place to detect any changes in the threat environment or business operations that could impact the effectiveness of the controls.

   Source: Adapted from community discussion — Broesweelies

   Next question

4. Question 124 · 1243 in bank

   Which of the following is the BEST way to ensure data is not co-mingled or exposed when using a cloud service provider?

   • ARequire the provider to follow stringent data classification procedures.
   • BObtain an independent audit report.
   • CReview the provider's information security policies.
   • DInclude high penalties for security breaches in the contract.

   Show answer

   Answer: B

   Next question

5. Question 125 · 1243 in bank

   Before approving the implementation of a new security solution, senior management requires a business case. Which of the following would BEST support the justification for investment?

   • AThe solution contributes to business strategy.
   • BThe solution improves business risk tolerance levels.
   • CThe solution reduces the cost of noncompliance with regulations.
   • DThe solution improves business resiliency.

   Show answer

   Answer: A

   Next question

6. Question 126 · 1243 in bank

   When an organization implements an information security governance framework, it is MOST important for executive leadership to have a direct role in:

   • Areviewing the information security policy directing the organization.
   • Bdeveloping technical key risk indicators (KRIs) for information security.
   • Cimplementing information security metrics for the organization.
   • Dapproving information security standards and procedures for the organization.

   Show answer

   Answer: A

   Explanation

   D - approving information security standards and procedures for the organization”. While direct review by executives may not occur, their approval ensures alignment with organizational goals, risk management, and compliance. This is according to according to CISM principles. Not sure why the answer is A.

   Source: Adapted from community discussion — Booict

   Next question

7. Question 127 · 1243 in bank

   Which of the following should have the MOST influence on an organization's response to a new industry regulation?

   • AThe organization's risk control baselines
   • BThe organization's control objectives
   • CThe organization's risk management framework
   • DThe organization's risk appetite

   Show answer

   Answer: D

   Explanation

   C , Risk appetite is part of the broader framework , The risk management framework provides the most comprehensive foundation for responding to a new industry regulation.

   Source: Adapted from community discussion — Evedzy

   Next question

8. Question 128 · 1243 in bank

   Biometrics are BEST used for:

   • Aauthorization.
   • Bauthentication.
   • Cauditing.
   • Daccounting.

   Show answer

   Answer: B

   Next question

9. Question 129 · 1243 in bank

   Predetermined containment methods to be used in a cybersecurity incident response should be based PRIMARILY on the:

   • Acapability of incident handlers.
   • Btype of confirmed incident.
   • Cpredicted incident duration.
   • Dnumber of impacted users.

   Show answer

   Answer: B

   Next question

10. Question 130 · 1243 in bank

    Communicating which of the following would be MOST helpful to gain senior management support for risk treatment options?

    • AThreat analysis
    • BRoot cause analysis
    • CQuantitative loss
    • DIndustry benchmarks

    Show answer

    Answer: C

    Explanation

    C - Quantitative Loss: Provides a clear financial perspective on potential losses due to risks. Enables decision-makers to prioritize and allocate resources effectively. Aligns with business objectives and speaks their language.

    Source: Adapted from community discussion — Booict

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 121. 1243 questions available.