CISM practice questions 341–350

1. Question 341 · 1243 in bank

   An employee is found to be using an external cloud storage service to share corporate information with a third-party consultant, which is against company policy. Which of the following should be the information security manager's FIRST course of action?

   • ABlock access to the cloud storage service
   • BDetermine the classification level of the information
   • CSeek business justification from the employee
   • DInform higher management of a security breach

   Show answer

   Answer: B

   Explanation

   The information security manager's first course of action should be B. Determine the classification level of the information. This is important as it will help understand the nature of the data that has been shared, and the level of risk associated with it. This information will be used to determine the extent of the damage and the appropriate course of action. Additionally, it will allow the security manager to identify any other data that may have been shared and take the necessary steps to prevent further data leakage. Once the security manager has determined the classification level of the information, they can then take appropriate action such as seeking business justification, blocking access to the cloud service, and informing higher management of a security breach if necessary.

   Source: Adapted from community discussion — Broesweelies

   Next question

2. Question 342 · 1243 in bank

   Which of the following is the MOST effective method of determining security priorities?

   • AVulnerability assessment
   • BGap analysis
   • CThreat assessment
   • DImpact analysis

   Show answer

   Answer: D

   Explanation

   The correct answer is D. Impact analysis. Explanation: Impact analysis is the most effective method of determining security priorities because it focuses on assessing the potential consequences of security incidents or breaches. When determining security priorities, it's important to understand the potential impact that various security threats or vulnerabilities could have on the organization. By analyzing the potential impact, you can prioritize security measures based on the severity of the consequences.

   Source: Adapted from community discussion — Hugo1717

   Next question

3. Question 343 · 1243 in bank

   A measure of the effectiveness of the incident response capabilities of an organization is the:

   • Anumber of incidents detected.
   • Bnumber of employees receiving incident response training.
   • Creduction of the annual loss expectancy (ALE).
   • Dtime to closure of incidents.

   Show answer

   Answer: D

   Explanation

   D. time to closure of incidents is a measure of the effectiveness of the incident response capabilities of an organization. The time to closure of incidents is the amount of time it takes for an organization to detect, respond to, and resolve an incident. A shorter time to closure indicates that the organization has a more efficient incident response process in place. It means that the incident was identified quickly, the appropriate actions were taken promptly and effectively, and the incident was resolved as soon as possible, minimizing the impact on the organization. Therefore, measuring the time to closure of incidents allows an organization to evaluate its incident response process, identify areas for improvement and ensure that it is prepared to handle future incidents effectively.

   Source: Adapted from community discussion — Broesweelies

   Next question

4. Question 344 · 1243 in bank

   An organization is in the process of adopting a hybrid data infrastructure, transferring all non-core applications to cloud service providers, and maintaining all core business functions in-house. The information security manager has determined a defense in depth strategy should be used. Which of the following BEST describes this strategy?

   • ASeparate security controls for applications, platforms, programs, and endpoints
   • BMulti-factor login requirements for cloud service applications, timeouts, and complex passwords
   • CDeployment of nested firewalls within the infrastructure
   • DStrict enforcement of role-based access control (RBAC)

   Show answer

   Answer: A

   Explanation

   A. Separate security controls for applications, platforms, programs, and endpoints best describes the defense in depth strategy. Defense in depth strategy is a security approach that uses multiple layers of security controls to protect an organization's infrastructure. It is used to protect against various types of threats and vulnerabilities by creating multiple barriers that an attacker must bypass before reaching the target. In this context, implementing separate security controls for applications, platforms, programs, and endpoints allows the organization to protect different aspects of its hybrid data infrastructure, which is composed of cloud and on-premises components. This approach can include different security solutions to provide different layers of protection, such as firewalls, intrusion detection systems, intrusion prevention systems, security information and event management (SIEM) systems, encryption, and access controls, among others. It can be used to protect the infrastructure, data, and applications, and help the organization to achieve a high level of security and compliance.

   Source: Adapted from community discussion — Broesweelies

   Next question

5. Question 345 · 1243 in bank

   Which of the following is an information security manager's BEST approach when selecting cost-effective controls needed to meet business objectives?

   • AConduct a gap analysis.
   • BFocus on preventive controls.
   • CAlign with industry best practice.
   • DAlign with the risk appetite.

   Show answer

   Answer: D

   Explanation

   D. Align with the risk appetite is the information security manager's best approach when selecting cost-effective controls needed to meet business objectives. The risk appetite is the level of risk that an organization is willing to accept in order to achieve its objectives. It is a key consideration when selecting controls, as it determines how much the organization is willing to invest in security. A security manager should align the controls with the risk appetite by considering the potential impact of a security incident on the organization and the likelihood of it occurring. This approach allows the security manager to select cost-effective controls that are appropriate for the organization's specific needs and budget, while also ensuring that the organization's assets and operations are protected. This approach also allows the organization to prioritize the most critical risks and allocate resources accordingly, ensuring that the most important risks are addressed first.

   Source: Adapted from community discussion — Broesweelies

   Next question

6. Question 346 · 1243 in bank

   A risk was identified during a risk assessment. The business process owner has chosen to accept the risk because the cost of remediation is greater than the projected cost of a worst-case scenario. What should be the information security manager's NEXT course of action?

   • ADocument and schedule a date to revisit the issue.
   • BDocument and escalate to senior management.
   • CShut down the business application.
   • DDetermine a lower-cost approach to remediation.

   Show answer

   Answer: A

   Explanation

   A. Document and schedule a date to revisit the issue. When a risk has been identified and the business process owner has chosen to accept it, the information security manager's next course of action should be to document the decision and schedule a date to revisit the issue in the future. This allows the organization to periodically review the risk and determine if the cost of remediation has decreased, the risk has changed, or the impact of the risk has increased. This also allows the organization to track the risk over time and make informed decisions about whether to accept or mitigate the risk in the future.

   Source: Adapted from community discussion — Broesweelies

   Next question

7. Question 347 · 1243 in bank

   An organization wants to integrate information security into its human resource management processes. Which of the following should be the FIRST step?

   • AIdentify information security risk associated with the processes
   • BAssess the business objectives of the processes
   • CEvaluate the cost of information security integration
   • DBenchmark the processes with best practice to identify gaps

   Show answer

   Answer: B

   Explanation

   TLDR: The order of operations is why it's (B) B. Assess the business objectives of the processes A. Identify information security risk associated with the processes D. Benchmark the processes with best practice to identify gaps C. Evaluate the cost of information security integration Long Version: The correct answer is (B) B. Assess the business objectives of the processes. And the way to think about this is in terms of the order in which these steps occur. Rationale: As mentioned by Wladysk, you first have to know what's important to the business and how the business works to get the context necessary for alignment. Thus (B) is the first step. Next, the organization needs to find the security risk for those processes based on what order of importance for enterprise as was determined in (B) and thus why (A) is the second answer. With the process and risk now evaluated, countermeasures need to be determined and this is what (D) is for. Finally, this has to be created into a business case for the business. So this is what C is for.

   Source: Adapted from community discussion — dark_3k03r

   Next question

8. Question 348 · 1243 in bank

   When evaluating vendors for sensitive data processing, which of the following should be the FIRST step to ensure the correct level of information security is provided?

   • ADevelop metrics for vendor performance.
   • BInclude information security criteria as part of vendor selection.
   • CReview third-party reports of potential vendors.
   • DInclude information security clauses in the vendor contract.

   Show answer

   Answer: B

   Explanation

   Including information security criteria as part of the vendor selection process ensures that security considerations are integrated into the initial evaluation. This step involves assessing the security posture of potential vendors against predefined criteria before proceeding with further evaluation or contractual agreements. It helps filter out vendors that do not meet the required information security standards from the outset. While the other options (developing metrics for vendor performance, reviewing third-party reports, and including information security clauses in the vendor contract) are important steps in the overall vendor management process, incorporating information security criteria early in the vendor selection process is critical for establishing a foundation of security in the relationship from the beginning.

   Source: Adapted from community discussion — Viperhunter

   Next question

9. Question 349 · 1243 in bank

   The MOST effective way to continuously monitor an organization's cybersecurity posture is to evaluate its:

   • Acompliance with industry regulations.
   • Bkey performance indicators (KPIs).
   • Clevel of support from senior management.
   • Dtimeliness in responding to attacks.

   Show answer

   Answer: B

   Explanation

   B. key performance indicators (KPIs). Continuously monitoring an organization's cybersecurity posture effectively is best done by evaluating its key performance indicators (KPIs). KPIs are a set of quantifiable measurements that organizations use to track and evaluate their performance against specific goals or objectives. They can be used to measure various aspects of an organization's cybersecurity posture, such as its ability to detect and respond to threats, the effectiveness of its security controls, and its overall security risk profile. By regularly monitoring and evaluating these KPIs, organizations can identify areas where they need to improve and make adjustments to their cybersecurity strategies accordingly. While compliance with industry regulations, level of support from senior management and timeliness in responding to attacks are important aspects of cybersecurity, Key performance indicators (KPIs) give a more holistic view of the organization cybersecurity posture and help the organization to track progress over time.

   Source: Adapted from community discussion — Broesweelies

   Next question

10. Question 350 · 1243 in bank

    Which of the following would provide the HIGHEST level of confidence in the integrity of data when sent from one party to another?

    • AHarden the communication infrastructure.
    • BRequire files to be digitally signed before they are transmitted.
    • CEnforce multi-factor authentication on both ends of the communication.
    • DRequire data to be transmitted over a secure connection.

    Show answer

    Answer: B

    Explanation

    The correct answer is B. Require files to be digitally signed before they are transmitted. Explanation: Digital signatures provide a high level of confidence in the integrity and authenticity of data when it is sent from one party to another. When files are digitally signed, they are encrypted using the sender's private key, and the recipient can use the sender's public key to decrypt and verify the signature. This process ensures that the data has not been tampered with during transit and that it indeed originated from the expected sender.

    Source: Adapted from community discussion — Hugo1717

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 341. 1243 questions available.