Certified Information Security Manager1,243 questions across 125 pages are complete and free, with no account or card.
1243 questions in this bank
Free access · progress saved on this device
During which stage of the software development life cycle (SDLC) should application security controls FIRST be addressed?
Answer: C
The correct answer is (C) Requirements Gathering as this is literally the first phase of the SDLC. The SDLC phases are in the following order: - Planning and Analysis - Requirements Gathering - Design - Development - Testing - Deployment - Maintenance
Source: Adapted from community discussion — dark_3k03r
Which of the following should be of MOST concern to an information security manager reviewing an organization's data classification program?
Answer: B
B. Consistency in labeling is critical for ensuring that sensitive data is protected according to its classification across the organization. If labeling is inconsistent, it can lead to improper handling of classified information, which poses a significant risk to data security.
Source: Adapted from community discussion — ntgc
Which of the following is PRIMARILY influenced by a business impact analysis (BIA)?
Answer: A
A Business Impact Analysis (BIA) is used to identify and evaluate the potential effects of disruptions to critical business processes. It helps organizations understand the potential financial, legal, and reputational impacts of a disruption, as well as the resources (people, systems, facilities, etc.) required to support critical business functions. Based on this analysis, an organization can develop a recovery strategy that prioritizes the restoration of critical business processes and minimizes the impact of disruptions. This is why A. Recovery strategy is primarily influenced by a Business Impact Analysis (BIA).
Source: Adapted from community discussion — Broesweelies
The MAIN purpose of influenced by a business impact guideline for use within a large, international organization is to:
Answer: B
The MAIN purpose of a guideline within a large, international organization is to ensure alignment across diverse business units while allowing flexibility. Guidelines help ensure that all business units share consistent strategic security goals without enforcing identical procedures, as different business environments may require tailored approaches.
Source: Adapted from community discussion — Vishalgupta26
The PRIMARY reason for defining the information security roles and responsibilities of staff throughout an organization is to:
Answer: C
Defining information security roles and responsibilities helps enforce individual accountability by clarifying who is responsible for specific security tasks, actions, or decisions within the organization. It establishes a framework for accountability and helps ensure that individuals understand their roles in protecting the organization's information assets. This clarity is crucial for creating a culture of security and promoting responsible behavior among employees. While compliance with security policy (option A), increasing corporate accountability (option B), and reinforcing the need for training (option D) are important considerations, the primary goal is often to ensure that individuals understand and fulfill their specific responsibilities in maintaining information security.
Source: Adapted from community discussion — Viperhunter
Which of the following is an information security manager's BEST course of action upon discovering an organization with budget constraints lacks several important security capabilities?
Answer: B
B. Establish a business case to demonstrate return on investment (ROI) of a security tool. Explanation: When an organization with budget constraints lacks several important security capabilities, the best course of action for an information security manager is to establish a business case to demonstrate the return on investment (ROI) of a security tool.
Source: Adapted from community discussion — Jae_kes
What is the FIRST line of defense against criminal insider activities?
Answer: C
We talk about "First line" of defense, and it is "Validating the integrity" of personel instead of monitoring their activities that come after.
Source: Adapted from community discussion — lebigninpo
The BEST way to report to the board on the effectiveness of the information security program is to present:
Answer: D
Just remember we have to make it easy for senior management to understand it. Don't over jargon with technical terms just give them the easiest way to understand.
Source: Adapted from community discussion — chanke
An organization's outsourced firewall was poorly configured and allowed unauthorized access that resulted in downtime of 48 hours. Which of the following should be the information security manager's NEXT course of action?
Answer: B
The correct answer is B: Obtain supporting evidence that the problem has been corrected. The reason this is true is because the problem has to be resolved. All the other questions leave the problem unaddressed. A: What are best practices anyway? Plus this was outsourced to the provider anyway B. This addresses the fact that the firewall was poorly configured. C. While seeking damages from the provider is important. The first thing that should be done is to address the problem. D. While seeking to revisit the contract and improve it for accountability is important... the problem needs to be addressed first.
Source: Adapted from community discussion — dark_3k03r
Which is the MOST important requirement when establishing a process for responding to zero-day vulnerabilities?
Answer: D
D should be correct. I missed this one, but after thinking about it, it make sense. a Zero-Day attack means that there are no anti-virus methods for it and there are no patches available to fix the problem. C is disrupting operations (which is never the answer) leaving us with D. Just the thought of selecting "work-around" as an answer makes me not feel good, but in this case, I understand.
Source: Adapted from community discussion — Prospect57
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISM practice, question 311. 1243 questions available.
Version 1.0.0. How we source questions