Question 11 · 1243 in bank
Which of the following will BEST facilitate timely and effective incident response?
Show answer
Answer: D
Certified Information Security Manager1,243 questions across 125 pages are complete and free, with no account or card.
1243 questions in this bank
Free access · progress saved on this device
Which of the following will BEST facilitate timely and effective incident response?
Answer: D
Which of the following MOST effectively communicates the current risk profile to senior management after controls are applied?
Answer: A
Which of the following processes should be done NEXT after completing a business impact analysis (BIA)?
Answer: C
Which of the following has the GREATEST impact on efforts to improve an organization's security posture?
Answer: B
Which of the following is MOST important to include in an information security policy?
Answer: D
D - Management objectives provide the strategic direction and goals for the information security program. They ensure that the policy aligns with the organization’s overall business objectives and priorities.
Source: Adapted from community discussion — Booict
Which of the following should an information security manager do FIRST when creating an organization's disaster recovery plan (DRP)?
Answer: D
Which of the following would be the MOST effective use of findings from a post-incident review?
Answer: A
During a post-incident review, it was determined that a known vulnerability was exploited in order to gain access to a system. The vulnerability was patched as part of the remediation on the offending system. Which of the following should be done NEXT?
Answer: A
I'm going with A. I get it is a known vulnerability. But option C states " Install patches an all existing systems." The ALL EXISTING SYSTEMS seems excessive because we don't know what all the systems are. Assuming everything is the same is illogical as almost all businesses make use of several different OS, versions, etc... so installing a patch on "ALL EXISITNG SYSTMES" with out scanning to see which ones actually need the patch first seems like a mistake and like it could interrupt the work environment. This is why I pick option A.
Source: Adapted from community discussion — blehbleh
Which of the following is MOST helpful in determining the realization of benefits from an information security program?
Answer: D
During an internal compliance review, the review team discovers that a critical legacy application is unable to meet the organization's mandatory security requirements. Which of the following should be done FIRST?
Answer: A
A. Update the risk register. Updating the risk register is the initial action to document and track the identified risk associated with the critical legacy application. This involves recording the non-compliance with mandatory security requirements and assessing the potential impact and likelihood of the risk. Once the risk is documented, the organization can then proceed to determine the most appropriate risk treatment strategy. While options like recommending taking the application out of service (Option B), implementing compensating controls (Option C), and monitoring the application until it can be replaced (Option D) are potential risk treatment strategies, updating the risk register is the foundational step in the risk management process. It ensures that the organization has a clear record of the identified risk and can make informed decisions on how to address it.
Source: Adapted from community discussion — TamerBeSafe
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISM practice, question 11. 1243 questions available.
Version 1.0.0. How we source questions