Question 361 · 1243 in bank
When establishing classifications of security incidents for the development of an incident response plan, which of the following provides the MOST valuable input?
Show answer
Answer: A
Certified Information Security Manager1,243 questions across 125 pages are complete and free, with no account or card.
1243 questions in this bank
Free access · progress saved on this device
When establishing classifications of security incidents for the development of an incident response plan, which of the following provides the MOST valuable input?
Answer: A
What is the PRIMARY responsibility of the security steering committee?
Answer: C
C. Set direction and monitor performance. The security steering committee is typically responsible for setting the strategic direction and priorities for an organization's information security program. This includes defining security goals and objectives, establishing policies and standards (which could address information security controls mentioned in option A), and ensuring that the organization's security posture aligns with its overall business strategy. Additionally, the committee monitors the performance of the security program, tracks key security metrics, and makes decisions to improve and adapt the program as needed.
Source: Adapted from community discussion — oluchecpoint
The PRIMARY objective of a risk response strategy should be:
Answer: C
The primary objective of a risk response strategy should be the selection of appropriate controls to mitigate identified risks to an acceptable level. This involves making decisions about the best ways to treat risks, such as avoiding the risk, transferring the risk to another party, reducing the negative impact of the risk, or accepting the risk. The selection of appropriate controls is the foundation for effective risk management and helps ensure that resources are directed towards the most critical risks facing the organization. While other factors, such as regulatory compliance and senior management buy-in, may be important considerations in the risk response process, the primary objective should always be the selection of appropriate controls to effectively manage risks.
Source: Adapted from community discussion — Broesweelies
Which of the following should an information security manager do FIRST after a new cybersecurity regulation has been introduced?
Answer: D
According to ISACA, the FIRST thing an information security manager should do after a new cybersecurity regulation has been introduced is to perform a gap analysis. While consulting corporate legal counsel is an important step, it often comes after the initial gap analysis to gain legal insights and guidance on specific compliance requirements. Conducting a cost-benefit analysis and updating the information security policy are also important but typically occur as part of the broader compliance efforts once gaps have been identified. The gap analysis serves as the foundation for developing a compliance strategy and roadmap to meet the new regulatory requirements efficiently and effectively.
Source: Adapted from community discussion — ImTired
Which of the following is the MOST important security feature an information security manager would need for a mobile device management (MDM) program?
Answer: B
the most important security feature for a mobile device management (MDM) program is the ability to remotely wipe devices. This feature allows the information security manager to quickly and effectively remove sensitive data from a lost or stolen device, reducing the risk of data breaches and unauthorized access to sensitive information.
Source: Adapted from community discussion — Broesweelies
Which of the following is the MOST relevant factor when determining the appropriate escalation process in the incident response plan?
Answer: A
Management has expressed concerns to the information security manager that shadow IT may be a risk to the organization. What is the FIRST step the information security manager should take?
Answer: D
D. Determine the extent of shadow IT usage. Before taking any action, it's essential to understand the scope and scale of the problem. By determining the extent of shadow IT usage, the information security manager can gather valuable information about which departments or individuals are using unauthorized IT resources, what types of systems or services they are using, and the potential risks involved. This information will help in developing a well-informed strategy to address the issue effectively.
Source: Adapted from community discussion — oluchecpoint
The PRIMARY purpose for defining key risk indicators (KRIs) for a security program is to:
Answer: C
The primary purpose for defining key risk indicators (KRIs) for a security program is to provide information needed to take action. KRIs help organizations identify and track the most critical risks they face, and allow them to prioritize and allocate resources to effectively mitigate those risks. By monitoring KRIs, organizations can quickly detect and respond to emerging threats, ensuring they are able to take appropriate action to minimize potential harm.
Source: Adapted from community discussion — Broesweelies
Which of the following is the MOST effective way to protect the authenticity of data in transit?
Answer: A
The most effective way to protect the authenticity of data in transit is by using a digital signature. A digital signature is a mathematical scheme that uses a private key to ensure the authenticity of the data. It allows the recipient to verify that the data came from the sender and has not been tampered with during transmission. A digital signature provides a high level of security as it uses encryption and authentication techniques to protect the integrity and authenticity of data.
Source: Adapted from community discussion — Broesweelies
An organization shares customer information across its globally dispersed branches. Which of the following should be the GREATEST concern to information security management?
Answer: A
The greatest concern to information security management when an organization shares customer information across its globally dispersed branches should be conflicting data protection regulations. Different countries and regions have their own laws and regulations regarding data protection and privacy, and failure to comply with these regulations can result in significant fines and legal penalties. It's important for the organization to ensure that the data is protected and shared in compliance with all relevant laws and regulations, which can be a complex and challenging task. This includes ensuring that the data is only shared with authorized personnel, that it is securely transferred and stored, and that it is deleted when it is no longer needed.
Source: Adapted from community discussion — Broesweelies
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISM practice, question 361. 1243 questions available.
Version 1.0.0. How we source questions