CISM practice questions 281–290

1. Question 281 · 1243 in bank

   An information security manager wants to document requirements detailing the minimum security controls required for user workstations. Which of the following resources would be MOST appropriate for this purpose?

   • APolicies
   • BStandards
   • CProcedures
   • DGuidelines

   Show answer

   Answer: B

   Explanation

   Answer is B. --- 1) A policy is a high-level statement of management intent that formally establishes requirements to guide decisions and achieve rational outcomes. A policy is intended to come from the CEO or board of directors that has strategic implications. ---- 2) A Standard is a formally-established requirement in regard to a process, action or configuration that is meant to be an objective, quantifiable expectation to be met (e.g., 8 character password, change passwords every 90 days, etc.) --- Source: https://www.complianceforge.com/faq/word-crimes/policy-vs-standard-vs-control-vs-procedure

   Source: Adapted from community discussion — EZPASS

   Next question

2. Question 282 · 1243 in bank

   An information security manager has been asked to determine whether an information security initiative has reduced risk to an acceptable level. Which of the following activities would provide the BEST information for the information security manager to draw a conclusion?

   • AInitiating a cost-benefit analysis of the implemented controls
   • BPerforming a risk assessment
   • CReviewing the risk register
   • DConducting a business impact analysis (BIA)

   Show answer

   Answer: B

   Explanation

   Let me begin by saying that like most, after seeing ‘acceptable risk levels’ in the question, I jumped head-on to choose, B, Risk Assessment. But working this backward, I approached this as a PROJECT, and CBA made perfect sense. The security initiative is usually the result of a risk assessment process, undertaken to mitigate the risks that are above acceptable levels. A (re-)assessment of the same risk, post-initiative, would be a lengthy, more tedious effort. On the other hand, risk assessment informs the cost-benefit analysis for the initiative’s business case. The CBA can be used post-implementation to evaluate the realization of proposed benefits. Refer to ISACA REVIEW MANUAL, page 144, 1st para, which states that benefits in the context of information security initiatives is the reduction of risk (to acceptable levels at acceptable cost).

   Source: Adapted from community discussion — CISSPST

   Next question

3. Question 283 · 1243 in bank

   Which of the following information BEST supports risk management decision making?

   • AResults of a vulnerability assessment
   • BEstimated savings resulting from reduced risk exposure
   • CAverage cost of risk events
   • DQuantification of threats through threat modeling

   Show answer

   Answer: D

   Explanation

   The correct answer is (D.) Quantification of threats through threat modeling is the correct answer as threat modeling identifies the threat and quantification lets you know the likelihood and impact which is needed for the decision-making process. Rationale: A. Results of a vulnerability assessment says what is vulnerable, but don't provide the context as to which to resolve. B. Estimated savings resulting from reduced risk exposure money is important, but this is too early in the stage for this. C. Average cost of risk events is incorrect cause money is important, but this is too early in the stage for this.

   Source: Adapted from community discussion — dark_3k03r

   Next question

4. Question 284 · 1243 in bank

   Which of the following is MOST important to do after a security incident has been verified?

   • ANotify the appropriate law enforcement authorities of the incident.
   • BFollow the escalation process to inform key stakeholders.
   • CPrevent the incident from creating further damage to the organization.
   • DContact forensic investigators to determine the root cause.

   Show answer

   Answer: C

   Explanation

   Although you do have to wear you "manager hat" for this exam, I'm gonna go with C here, as it seems to me that the question is basically asking about the steps/phases of incident response. The question explicitly says that you have identified and confirmed the incident taking place giving you the initial phase of IR and asking "what now?". Well, the next step is to contain it and stop it from doing further damage and only then you inform the appropriate people. Note that question is quite vague when defining the incident - we don't know what type of incident it is (is it a ransomware, is someone breaking AUP by taking photos inside the secure environment, etc). So that's why it is very tempting to select B. Again, going with C, but not 100% sure.

   Source: Adapted from community discussion — AlexJacobson

   Next question

5. Question 285 · 1243 in bank

   Which of the following should be the PRIMARY driver for selecting and implementing appropriate controls to address the risk associated with weak user passwords?

   • AThe organization's risk tolerance
   • BThe organization's culture
   • CThe cost of risk mitigation controls
   • DDirection from senior management

   Show answer

   Answer: A

   Explanation

   The PRIMARY driver for selecting and implementing appropriate controls to address the risk associated with weak user passwords is: A. The organization's risk tolerance. The organization's risk tolerance defines how much risk is acceptable and helps to determine the level of protection needed. If weak passwords present a high risk, the organization must implement controls that are proportional to the level of risk it is willing to accept.

   Source: Adapted from community discussion — Vishalgupta26

   Next question

6. Question 286 · 1243 in bank

   Which of the following is MOST important to consider when determining the effectiveness of the information security governance program?

   • AKey performance indicators (KPIs)
   • BMaturity models
   • CRisk tolerance levels
   • DKey risk indicators (KRIs)

   Show answer

   Answer: A

   Explanation

   The MOST important factor to consider when determining the effectiveness of the information security governance program is key performance indicators (KPIs). KPIs are used to measure the performance of the governance program, identify areas that require improvement, and provide a basis for decision-making. KPIs should be aligned with the organization's goals, objectives, and strategy, and should be regularly reviewed and updated to ensure they remain relevant and useful. While maturity models, risk tolerance levels, and key risk indicators (KRIs) are important factors to consider in information security governance, they are not as central to evaluating program effectiveness as KPIs.

   Source: Adapted from community discussion — Abhey

   Next question

7. Question 287 · 1243 in bank

   The business advantage of implementing authentication tokens is that they:

   • Aprovide nonrepudiation.
   • Breduce overall cost.
   • Creduce administrative workload.
   • Dimprove access security.

   Show answer

   Answer: D

   Explanation

   Improving access security (D) directly reduces the risk of unauthorized access, which can prevent data breaches, protect intellectual property, and maintain customer trust. These factors contribute to long-term business continuity and can potentially save the organization from significant financial and reputational damage. Reducing administrative workload (C) can indeed be a business advantage by freeing up IT resources and cutting down on administrative overhead. However, the primary justification for implementing security tokens often revolves around enhancing security first, with administrative benefits being a secondary advantage. In the context of CISM, the emphasis is often on the primary purpose of security controls, which is why D. improve access security is considered the best answer.

   Source: Adapted from community discussion — HN2025

   Next question

8. Question 288 · 1243 in bank

   In an organization that has several independent security tools including intrusion detection systems (IDSs) and firewalls, which of the following is the BEST way to ensure timely detection of incidents?

   • AImplement a log aggregation and correlation solution.
   • BEnsure that the incident response plan is endorsed by senior management.
   • CEnsure staff are cross trained to manage all security tools.
   • DOutsource the management of security tools to a service provider.

   Show answer

   Answer: A

   Next question

9. Question 289 · 1243 in bank

   Which of the following is the MAIN objective of a risk management program?

   • AReduce corporate liability for information security incidents.
   • BReduce risk to the level of the organization's risk appetite
   • CReduce risk to the maximum extent possible
   • DReduce costs associated with incident response.

   Show answer

   Answer: B

   Next question

10. Question 290 · 1243 in bank

    An information security manager was informed that a planned penetration test could potentially disrupt some services. Which of the following should be the FIRST course of action?

    • AEstimate the impact and inform the business owner.
    • BAccept the risk and document it in the risk register.
    • CEnsure the service owner is available during the penetration test.
    • DReschedule the activity during an approved maintenance window.

    Show answer

    Answer: A

    Explanation

    You should let the owner know about the impact and have them decide to accept or reschedule. Open to discussion to see what others think.

    Source: Adapted from community discussion — D2D2

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 281. 1243 questions available.