Question 291 · 1243 in bank
The PRIMARY advantage of single sign-on (SSO) is that it will:
Show answer
Answer: C
Certified Information Security Manager1,243 questions across 125 pages are complete and free, with no account or card.
1243 questions in this bank
Free access · progress saved on this device
The PRIMARY advantage of single sign-on (SSO) is that it will:
Answer: C
Which of the following is BEST determined by using technical metrics?
Answer: A
"Technical metrics are often used to measure the operational effectiveness of specific controls. These can include things like the number of intrusions detected versus those that were not, the number of viruses caught at the gateway versus those caught on the desktop, etc."
Source: Adapted from community discussion — [Removed]
An organization that uses external cloud services extensively is concerned with risk monitoring and timely response. The BEST way to address this concern is to ensure:
Answer: B
Answer C. Right to audit will give the organization opportunity to request evidences from the vendor if SLA is being met and also gain access to the current risk register. Therefore many organizations conduct vendor assessment on regular basis depending on criticality of the assets.
Source: Adapted from community discussion — Iwantnzb
The use of a business case to obtain funding for an information security investment is MOST effective when the business case:
Answer: A
A. relates the investment to the organization's strategic plan. The most effective business cases for obtaining funding for an information security investment are those that clearly demonstrate how the investment aligns with and supports the organization's strategic plan. When information security initiatives are directly tied to the organization's strategic goals and objectives, it becomes easier to make a compelling case for the investment. This approach helps senior management and stakeholders understand the strategic importance of information security and how it contributes to the overall success of the organization.
Source: Adapted from community discussion — oluchecpoint
The MOST important objective of security awareness training for business staff is to:
Answer: D
D. modify behavior. The most important objective of security awareness training for business staff is to modify their behavior regarding security practices. While understanding intrusion methods (A), reducing negative audit findings (B), and increasing compliance (C) are valuable outcomes of security awareness training, the ultimate goal is to change employees' behavior to make them more security-conscious and proactive in safeguarding sensitive information and systems.
Source: Adapted from community discussion — oluchecpoint
Which of the following is the PRIMARY responsibility of an information security steering committee?
Answer: C
C. Prioritizing security initiatives The PRIMARY responsibility of an information security steering committee is to prioritize security initiatives. An information security steering committee typically consists of senior executives and key stakeholders from various departments within an organization. Its primary role is to provide strategic oversight and guidance for the organization's information security efforts.
Source: Adapted from community discussion — oluchecpoint
During a post-incident review, the sequence and correlation of actions must be analyzed PRIMARILY based on:
Answer: A
A. a consolidated event timeline. A consolidated event timeline is primarily used during a post-incident review to analyze the sequence and correlation of actions. This timeline combines data from various sources to provide a comprehensive overview of the incident from start to finish. It helps to understand the chronological order of events, how the incident unfolded, and how responses were made at each stage. By laying out the sequence of events in a linear timeline, it's easier to identify any delays, overlaps, or gaps in the response, which are crucial for improving future incident response strategies. While logs from systems involved (option B), interviews with personnel (option C), and documents created during the incident (option D) are valuable sources of information, they contribute to the creation of the consolidated event timeline rather than serve as primary analytical tools by themselves. These elements feed into the timeline, providing details and context that help to form a complete picture of the incident and the effectiveness of the response.
Source: Adapted from community discussion — helg420
Which of the following is the MOST important element in the evaluation of inherent security risks?
Answer: A
Recovery time objectives (RTOs) are an output of which of the following?
Answer: B
Recovery time objectives (RTOs) are an output of a Business Impact Analysis (BIA) process. The BIA is used to identify the criticality of business functions and systems, and the RTOs are used to determine the maximum amount of time that a specific business function or system can be down before it starts to have a significant impact on the organization. This information is then used to develop the disaster recovery plan (DRP) and service level agreements (SLAs).
Source: Adapted from community discussion — Broesweelies
Which of the following is the MOST relevant information to include in an information security risk report to facilitate senior management's understanding of impact to the organization?
Answer: D
D. Status of identified key security risks To facilitate senior management's understanding of the impact on the organization, the most relevant information to include in an information security risk report is the status of identified key security risks. Senior management needs concise and significant information that directly relates to the organization's strategic objectives and operational integrity. Providing them with the current status of key security risks (including their severity, potential impact on business operations, and the measures taken or proposed for mitigation) directly supports strategic decision-making. This information allows senior management to gauge how these risks might affect the organization's goals and what actions are needed to address them. Unlike the detailed technical specifics which might be less accessible to individuals without a technical background (options A, B, and C), focusing on the status of key risks provides a clear and immediate connection to business outcomes and priorities.
Source: Adapted from community discussion — helg420
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISM practice, question 291. 1243 questions available.
Version 1.0.0. How we source questions