CISM practice questions 331–340

1. Question 331 · 1243 in bank

   Which of the following components of an information security risk assessment is MOST valuable to senior management?

   • AResidual risk
   • BReturn on investment (ROI)
   • CMitigation actions
   • DThreat profile

   Show answer

   Answer: A

   Explanation

   A. Residual risk is considered the most valuable component of an information security risk assessment to senior management according to ISACA. It allows them to understand the remaining level of risk after mitigation actions have been implemented, and make informed decisions about how to allocate resources to further reduce risk.

   Source: Adapted from community discussion — Broesweelies

   Next question

2. Question 332 · 1243 in bank

   Which of the following is the PRIMARY benefit of implementing a maturity model for information security management?

   • AGaps between current and desirable levels will be addressed.
   • BInformation security management costs will be optimized.
   • CInformation security strategy will be in line with industry best practice.
   • DStaff awareness of information security compliance will be promoted.

   Show answer

   Answer: A

   Next question

3. Question 333 · 1243 in bank

   An information security manager notes that security incidents are not being appropriately escalated by the help desk after tickets are logged. Which of the following is the BEST automated control to resolve this issue?

   • AIntegrating automated service level agreement (SLA) reporting into the help desk ticketing system
   • BChanging the default setting for all security incidents to the highest priority
   • CIntegrating incident response workflow into the help desk ticketing system
   • DImplementing automated vulnerability scanning in the help desk workflow

   Show answer

   Answer: C

   Next question

4. Question 334 · 1243 in bank

   An information security manager's PRIMARY objective for presenting key risks to the board of directors is to:

   • Aensure appropriate information security governance.
   • Bquantify reputational risks.
   • Cmeet information security compliance requirements.
   • Dre-evaluate the risk appetite.

   Show answer

   Answer: A

   Explanation

   The correct answer is A. ensure appropriate information security governance. The primary objective for presenting key risks to the board of directors is to ensure appropriate information security governance. Information security governance refers to the framework and processes put in place to oversee and manage information security within an organization. It involves defining roles, responsibilities, and decision-making processes related to information security. By presenting key risks to the board of directors, the information security manager aims to provide them with a clear understanding of the organization's information security posture and the risks it faces. This enables the board to make informed decisions regarding the allocation of resources, prioritization of initiatives, and setting strategic objectives related to information security.

   Source: Adapted from community discussion — mrc2d

   Next question

5. Question 335 · 1243 in bank

   Which of the following should be the PRIMARY consideration when implementing a data loss prevention (DLP) solution?

   • AData ownership
   • BData storage capabilities
   • CData classification
   • DSelection of tools

   Show answer

   Answer: C

   Explanation

   Just want to reassure everyone here that it is indeed C. You cannot properly use a Data Loss Prevention tool without classifying the data. This is coming from a guy that has ever comptia cert except server+ and linux+.

   Source: Adapted from community discussion — POWNED

   Next question

6. Question 336 · 1243 in bank

   Which of the following is the MOST important function of an information security steering committee?

   • AEvaluating the effectiveness of information security controls on a periodic basis
   • BDefining the objectives of the information security framework
   • CConducting regular independent reviews of the state of security in the business
   • DApproving security awareness content prior to publication

   Show answer

   Answer: B

   Explanation

   A. Evaluating the effectiveness of information security controls on a periodic basis The most important function of an information security steering committee is to ensure that the organization's information security controls are effective in protecting its assets and data. This involves regularly evaluating and assessing the state of security in the business to identify weaknesses, vulnerabilities, and areas for improvement. Without effective controls, the organization's information and assets are at risk, making it crucial for the committee to focus on this function. While the other options are also important aspects of information security management, evaluating control effectiveness is fundamental to maintaining a strong security posture.

   Source: Adapted from community discussion — oluchecpoint

   Next question

7. Question 337 · 1243 in bank

   Which of the following should be an information security managers PRIMARY focus during the development of a critical system storing highly confidential data?

   • AEnsuring the amount of residual risk is acceptable
   • BReducing the number of vulnerabilities detected
   • CAvoiding identified system threats
   • DComplying with regulatory requirements

   Show answer

   Answer: A

   Explanation

   Answer should be A. Alot of people are saying D but Clcomplying with regulatory requirements is also important, but it should not be the primary focus. Regulatory requirements provide a minimum level of security that must be met, but they do not necessarily ensure that the system is adequately protected. The focus should be on managing risk, rather than simply complying with regulations. The primary focus of an information security manager during the development of a critical system storing highly confidential data should be to ensure that the amount of residual risk is acceptable. Residual risk is the level of risk that remains after security controls have been implemented. It is important to ensure that this residual risk is at an acceptable level, given the sensitivity of the data being stored.

   Source: Adapted from community discussion — Seasondream

   Next question

8. Question 338 · 1243 in bank

   When determining an acceptable risk level, which of the following is the MOST important consideration?

   • AVulnerability scores
   • BSystem criticalities
   • CRisk matrices
   • DThreat profiles

   Show answer

   Answer: B

   Next question

9. Question 339 · 1243 in bank

   Which of the following is MOST important to include when reporting information security risk to executive leadership?

   • AKey performance objectives and budget trends
   • BSecurity awareness training participation and residual risk exposures
   • CRisk analysis results and key risk indicators (KRIs)
   • DInformation security risk management plans and control compliance

   Show answer

   Answer: C

   Explanation

   Risk analysis results and KRIs provide the most concise and impactful information for executive leadership: Risk analysis results: Explain the identified risks, their likelihood, and potential impact on the organization's business objectives (e.g., financial losses, reputational damage). Key risk indicators (KRIs): Provide measurable data points that monitor the current state of risks and potential changes in their severity.

   Source: Adapted from community discussion — DrTee

   Next question

10. Question 340 · 1243 in bank

    During which of the following development phases is it MOST challenging to implement security controls?

    • AImplementation phase
    • BPost-implementation phase
    • CDesign phase
    • DDevelopment phase

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 331. 1243 questions available.