CISM practice questions 151–160

1. Question 151 · 1243 in bank

   Which of the following is the MOST effective data loss control when connecting a personally owned mobile device to the corporate email system?

   • AEmail must be stored in an encrypted format on the mobile device.
   • BUsers must agree to the use of biometric multi-factor authentication (MFA).
   • CA senior manager must approve each new connection.
   • DEmail synchronization must be prevented when connected to a public Wi-Fi hotspot.

   Show answer

   Answer: A

   Next question

2. Question 152 · 1243 in bank

   Which of the following should be the FIRST step when performing triage of a malware incident?

   • APreserving the forensic image
   • BContaining the affected system
   • CComparing backup against production
   • DRemoving the malware

   Show answer

   Answer: B

   Next question

3. Question 153 · 1243 in bank

   Which of the following BEST helps to enable the desired information security culture within an organization?

   • AInformation security awareness training and campaigns
   • BIncentives for appropriate information security-related behavior
   • CEffective information security policies and procedures
   • DDelegation of information security roles and responsibilities

   Show answer

   Answer: A

   Next question

4. Question 154 · 1243 in bank

   Which of the following should be the GREATEST concern for an information security manager when an annual audit reveals the organization's business continuity plan (BCP) has not been reviewed or updated in more than a year?

   • AThe organization may suffer reputational damage for not following industry best practices.
   • BThe audit finding may impact the overall risk rating of the organization.
   • CAn outdated BCP may result in less efficient recovery if an actual incident occurs.
   • DThe lack of updates to the BCP may result in noncompliance with internal policies.

   Show answer

   Answer: C

   Next question

5. Question 155 · 1243 in bank

   Which of the following is the MOST important goal of an information security program?

   • AOptimizing resources
   • BReducing risk factors
   • CManaging controls
   • DEnhancing business decision making

   Show answer

   Answer: B

   Next question

6. Question 156 · 1243 in bank

   Which of the following functions is MOST critical when initiating the removal of system access for terminated employees?

   • AHelp desk
   • BLegal
   • CInformation security
   • DHuman resources (HR)

   Show answer

   Answer: D

   Explanation

   why not Information Security? Human resources (HR) is an important function when initiating the removal of system access for terminated employees, as they are responsible for managing employee information and communication, including the termination process. However, the MOST critical function is still information security. Information security is responsible for ensuring the confidentiality, integrity, and availability of sensitive information, and the removal of system access for terminated employees is a critical step in maintaining the security of this information. Information security must ensure that all necessary steps are taken to remove the terminated employee's access to sensitive information, including revoking all user accounts, disabling access to systems and applications, and removing any network access privileges. Help desk and legal functions may also be involved in the process, but their role is secondary to that of information security in ensuring the security of sensitive information.

   Source: Adapted from community discussion — ccKane

   Next question

7. Question 157 · 1243 in bank

   Which of the following BEST helps to ensure the effective execution of an organization's disaster recovery plan (DRP)?

   • AThe plan is based on industry best practices.
   • BThe plan is reviewed by senior and IT operational management.
   • CProcedures are available at the primary and failover location.
   • DProcess steps are documented by the disaster recovery team.

   Show answer

   Answer: D

   Explanation

   The question asks for effective execution, so if the DR team created the process steps, they will be best in position to execute it. Please correct me if I am wrong. I was tossing between B and D.

   Source: Adapted from community discussion — yottabyte

   Next question

8. Question 158 · 1243 in bank

   Which of the following would be MOST effective in reducing the impact of a distributed denial of service (DDoS) attack?

   • AImpose state limits on servers.
   • BSpread a site across multiple ISPs.
   • CHarden network security.
   • DBlock the attack at the source.

   Show answer

   Answer: B

   Explanation

   B - Distributing the site across different Internet Service Providers (ISPs) helps distribute the incoming traffic. If one ISP is targeted, other paths remain available, reducing the impact.

   Source: Adapted from community discussion — Booict

   Next question

9. Question 159 · 1243 in bank

   The PRIMARY reason for senior management to monitor information security metrics is to ensure:

   • Aalignment of the information security budget to corporate funding.
   • Balignment of information security with corporate governance.
   • Calignment of security and IT objectives.
   • Dalignment with risk mitigation efforts.

   Show answer

   Answer: B

   Next question

10. Question 160 · 1243 in bank

    Which of the following is the MOST important reason to perform a privacy impact assessment?

    • ATo provide assurance to senior management
    • BTo ensure business data processing has been assessed for risk
    • CTo ensure compensating controls are in place for key information assets
    • DTo reduce threats associated with business data processing

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 151. 1243 questions available.