CISM practice questions 21–30

1. Question 21 · 1243 in bank

   Which of the following is the BEST way to improve an organization's ability to detect and respond to incidents?

   • AConduct a business impact analysis (BIA).
   • BConduct periodic awareness training.
   • CPerform a security gap analysis.
   • DPerform network penetration testing.

   Show answer

   Answer: B

   Next question

2. Question 22 · 1243 in bank

   Of the following, who would provide the MOST relevant input when aligning the information security strategy with organizational goals?

   • AData privacy officer (DPO)
   • BChief information security officer (CISO)
   • CInformation security steering committee
   • DEnterprise risk committee

   Show answer

   Answer: C

   Next question

3. Question 23 · 1243 in bank

   Which of the following is the PRIMARY role of the information security manager in application development?

   • ATo ensure control procedures address business risk
   • BTo ensure enterprise security controls are implemented
   • CTo ensure compliance with industry best practice
   • DTo ensure security is integrated into the system development life cycle (SDLC)

   Show answer

   Answer: D

   Next question

4. Question 24 · 1243 in bank

   Which of the following actions by senior management would BEST enable a successful implementation of an information security governance framework?

   • ADemonstrating support for the business and information security governance functions
   • BDelegating the implementation of the framework to information security management
   • CPromoting the use of an internationally recognized governance framework
   • DEngaging a consulting firm specializing in information security governance and standards

   Show answer

   Answer: A

   Next question

5. Question 25 · 1243 in bank

   Which of the following is the BEST strategy to implement an effective operational security posture?

   • AIncreased security awareness
   • BDefense in depth
   • CThreat management
   • DVulnerability management

   Show answer

   Answer: B

   Explanation

   The keyword is a strategy and the only one that does that is (B) Defense in depth as a defense in depth is a strategy of how things should be done and why. As mentioned by MSKid, this means that Defense in Depth includes the rest. Even if the other were strategies... the fact that defense in depth has multiple layers means that it should be able to succeed even if one fails and this is incredibly useful for operations. Rationale: (A) Increased security awareness is a goal/objective (C) Threat management is a process (D) Vulnerability management is a process

   Source: Adapted from community discussion — dark_3k03r

   Next question

6. Question 26 · 1243 in bank

   Which of the following is the BEST way to reduce the risk of security incidents from targeted email attacks?

   • AConduct awareness training across the organization.
   • BRequire acknowledgment of the acceptable use policy.
   • CDisable all incoming cloud mail services.
   • DImplement a data loss prevention (DLP) system.

   Show answer

   Answer: A

   Next question

7. Question 27 · 1243 in bank

   Which of the following is the PRIMARY benefit of an information security awareness training program?

   • AEvaluating organizational security culture
   • BEnforcing security policy
   • CInfluencing human behavior
   • DDefining risk accountability

   Show answer

   Answer: C

   Next question

8. Question 28 · 1243 in bank

   Which of the following MOST effectively supports an organization's security culture?

   • ABusiness unit security metrics
   • BAn information governance framework
   • CStakeholder involvement
   • DA security mission statement

   Show answer

   Answer: C

   Next question

9. Question 29 · 1243 in bank

   A new type of ransomware has infected an organization's network. Which of the following would have BEST enabled the organization to detect this situation?

   • APeriodic information security training for end users
   • BUse of integrated patch deployment tools
   • CRegular review of the threat landscape
   • DMonitoring of anomalies in system behavior

   Show answer

   Answer: D

   Next question

10. Question 30 · 1243 in bank

    Which of the following should an information security manager do FIRST upon notification of a potential security risk associated with a third-party service provider?

    • ADetermine risk treatment options.
    • BConduct a vulnerability analysis.
    • CEscalate to the third-party provider.
    • DConduct a risk analysis.

    Show answer

    Answer: D

    Explanation

    Then again, if you are notified about the risk associated with third-party provider (i.e. discovered the risk of relying on their services), then risk analysis is indeed the first thing you should do (B). Honestly, I'm not 100% sure what the question is asking... :/

    Source: Adapted from community discussion — AlexJacobson

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 21. 1243 questions available.