CISM practice questions 301–310

1. Question 301 · 1243 in bank

   Which of the following is MOST important to include in a contract with a critical service provider to help ensure alignment with the organization's information security program?

   • AEscalation paths
   • BTermination language
   • CKey performance indicators (KPIs)
   • DRight-to-audit clause

   Show answer

   Answer: D

   Explanation

   A right-to-audit clause in a contract with a critical service provider is important to include in order to ensure alignment with the organization's information security program. This clause gives the organization the ability to conduct audits on the service provider's security practices and ensure that they are meeting the standards and requirements set forth in the contract. This can help to identify any potential security risks or vulnerabilities and take steps to address them before they can cause harm to the organization. The other options are also important to include, but are not as critical to ensure alignment with the organization's information security program.

   Source: Adapted from community discussion — Broesweelies

   Next question

2. Question 302 · 1243 in bank

   Which of the following is the BEST way to determine if a recent investment in access control software was successful?

   • ASenior management acceptance of the access control software
   • BA comparison of security incidents before and after software installation
   • CA business impact analysis (BIA) of the systems protected by the software
   • DA review of the number of key risk indicators (KRIs) implemented for the software

   Show answer

   Answer: B

   Explanation

   Implementing an access control software will not necessarily change the criticality of the asset to the organization's strategic objectives. I would choose B

   Source: Adapted from community discussion — Matini

   Next question

3. Question 303 · 1243 in bank

   Which of the following is the MOST effective way to mitigate the risk of confidential data leakage to unauthorized stakeholders?

   • ACreate a data classification policy.
   • BImplement role-based access controls.
   • CRequire the use of login credentials and passwords.
   • DConduct information security awareness training.

   Show answer

   Answer: B

   Explanation

   The correct answer is (B.) Implement role-based access controls. This is because (B) is the only one that takes confidentially, authorization, mitigation, and stakeholders into account. Without these components, access control wouldn't work. Rationale: (A.) Create a data classification policy is not correct cause it doesn't provide for any enforcement. (C.) Require the use of login credentials and passwords is not correct cause it is only providing for authentication and not authorization. (D.) Conduct information security awareness training is great for education, but it does not provide for any way to enforce the authorization of the correct stakeholders

   Source: Adapted from community discussion — dark_3k03r

   Next question

4. Question 304 · 1243 in bank

   Which of the following is the BEST way to ensure that organizational security policies comply with data security regulatory requirements?

   • AObtain annual sign-off from executive management.
   • BAlign the policies to the most stringent global regulations.
   • CSend the policies to stakeholders for review.
   • DOutsource compliance activities.

   Show answer

   Answer: B

   Explanation

   Aligning security policies with the most stringent global regulations helps ensure that the organization meets high standards for data security and compliance. This approach not only ensures adherence to local regulations but also provides a robust framework that can address various regulatory requirements across different jurisdictions. While obtaining annual sign-off from executive management (option A) and sending policies to stakeholders for review (option C) are valuable practices, aligning with the most stringent global regulations provides a comprehensive and proactive strategy for regulatory compliance. Outsourcing compliance activities (option D) can be a consideration, but it does not replace the need for a well-defined and internally aligned security policy framework.

   Source: Adapted from community discussion — Viperhunter

   Next question

5. Question 305 · 1243 in bank

   Which of the following is the MOST important consideration when reporting the effectiveness of an information security program to key business stakeholders?

   • ALinking security metrics to the business impact analysis (BIA)
   • BDemonstrating a decrease in information security incidents
   • CDemonstrating cost savings of each control
   • DLinking security metrics to business objectives

   Show answer

   Answer: D

   Explanation

   D. Linking security metrics to business objectives When reporting the effectiveness of an information security program to key business stakeholders, the most important consideration is linking security metrics to the business objectives. This helps to demonstrate the value of the information security program by showing how it supports the overall goals and objectives of the organization. By linking security metrics to business objectives, it becomes clear how the program is helping to protect the organization's assets and reduce risk, which is the ultimate goal of an information security program. Linking security metrics to the business impact analysis (BIA) and demonstrating a decrease in information security incidents and cost savings are also important considerations, but they are not as important as linking security metrics to business objectives as they don't provide a clear indication of how the program is aligning with the organization's goals and objectives.

   Source: Adapted from community discussion — Broesweelies

   Next question

6. Question 306 · 1243 in bank

   The PRIMARY purpose of establishing an information security governance framework should be to:

   • Aestablish the business case for strategic integration of information security in organizational efforts.
   • Bdocument and communicate how the information security program functions within the organization.
   • Calign information security strategy and investments to support organizational activities.
   • Dalign corporate governance, activities, and investments to information security goals.

   Show answer

   Answer: C

   Explanation

   C. The PRIMARY purpose of establishing an information security governance framework is to align information security strategy and investments with organizational activities. This framework ensures that the organization's information security efforts are strategically aligned with its business goals and activities. It provides a structured approach to managing and governing information security by ensuring that security measures are integrated into the organization's overall strategy and operations. While the other options (A, B, and D) are important aspects of information security governance, they are often secondary objectives that are achieved through the primary goal of aligning information security with the broader organizational context.

   Source: Adapted from community discussion — oluchecpoint

   Next question

7. Question 307 · 1243 in bank

   Senior management is concerned that the incident response team took unapproved actions during incident response that put business objectives at risk. Which of the following is the BEST way for the information security manager to respond to this situation?

   • AUpdate roles and responsibilities of the incident response team.
   • BTrain the incident response team on escalation procedures.
   • CImplement a monitoring solution for incident response activities.
   • DValidate that the information security strategy maps to corporate objectives.

   Show answer

   Answer: B

   Explanation

   Key word here in the question is unapproved. The incident team went outside the scope of their roles and responsibilities so training needs to be done. I would agree the answer would be A if the question did not involve "unapproved".

   Source: Adapted from community discussion — POWNED

   Next question

8. Question 308 · 1243 in bank

   An incident response team has determined there is a need to isolate a system that is communicating with a known malicious host on the Internet. Which of the following stakeholders should be contacted FIRST?

   • AThe business owner
   • BKey customers
   • CExecutive management
   • DSystem administrator

   Show answer

   Answer: A

   Explanation

   CISM Review Manual 16th edition. pg. 269. 3. Containment. "After an incident has been identified and confirmed, the IMT is activated and information from the incident handler is shared. The team will conduct a detailed assessment and contact the system owner or business manager of the affected information systems/assets to coordinate further action." Although I personally think D-system administrator should be the 1st to contact but that is CISM. All about manager should do.

   Source: Adapted from community discussion — afoo1314

   Next question

9. Question 309 · 1243 in bank

   Which of the following external entities would provide the BEST guidance to an organization facing advanced attacks?

   • AIncident response experts from highly regarded peer organizations
   • BOpen-source reconnaissance
   • CRecognized threat intelligence communities
   • DDisaster recovery consultants widely endorsed in industry forums

   Show answer

   Answer: C

   Explanation

   The correct answer is C - Recognized threat intelligence Communities as they have the required expertise to understand advance attacks. A. Peers may be competitors, so this could result in corporate espionage B. Giving this to the public is not advisable as malicious actors and amateurs may be in the midst. D. This is not a disaster recovery issue, but a security issue.

   Source: Adapted from community discussion — dark_3k03r

   Next question

10. Question 310 · 1243 in bank

    Which of the following should be an information security manager's MOST important criterion for determining when to review the incident response plan?

    • AWhen recovery time objectives (RTOs) are not met
    • BWhen missing information impacts recovery from an incident
    • CBefore an internal audit of the incident response process
    • DAt intervals indicated by industry best practice

    Show answer

    Answer: D

    Explanation

    The correct answer is D. At intervals indicated by industry best practice. An incident response plan should be reviewed regularly to ensure that it is up-to-date and effective. While recovery time objectives (RTOs) and missing information can be important considerations for reviewing the plan, they are not the most important criteria for determining when to review it. Instead, industry best practices recommend that incident response plans should be reviewed and updated on a regular basis, such as annually or bi-annually, to ensure that they remain relevant and effective in response to the evolving threat landscape. Therefore, option D is the most appropriate choice.

    Source: Adapted from community discussion — bambs

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 301. 1243 questions available.