CISM practice questions 371–380

1. Question 371 · 1243 in bank

   Over the last year, an information security manager has performed risk assessments on multiple third-party vendors. Which of the following criteria would be MOST helpful in determining the associated level of risk applied to each vendor?

   • ACompliance requirements associated with the regulation
   • BCriticality of the service to the organization
   • CCorresponding breaches associated with each vendor
   • DCompensating controls in place to protect information security

   Show answer

   Answer: B

   Explanation

   The criticality of the service to the organization is a key factor in assessing the level of risk associated with a third-party vendor. If a vendor provides a service that is critical to the organization's operations, a security incident or disruption from that vendor could have a significant impact on the organization. Therefore, assessing the criticality of the service helps prioritize and determine the level of risk associated with each vendor. While other factors such as compliance requirements (option A), corresponding breaches associated with each vendor (option C), and compensating controls in place (option D) are important considerations in risk assessments, the criticality of the service directly relates to the potential impact on the organization if a security incident were to occur.

   Source: Adapted from community discussion — Viperhunter

   Next question

2. Question 372 · 1243 in bank

   An information security manager is assisting in the development of the request for proposal (RFP) for a new outsourced service. This will require the third party to have access to critical business information. The security manager should focus PRIMARILY on defining:

   • Asecurity requirements for the process being outsourced
   • Brisk-reporting methodologies
   • Cservice level agreements (SLAs)
   • Dsecurity metrics

   Show answer

   Answer: A

   Next question

3. Question 373 · 1243 in bank

   Following a risk assessment, new countermeasures have been approved by management. Which of the following should be performed NEXT?

   • ASchedule the target end date for implementation activities.
   • BDevelop an implementation strategy.
   • CBudget the total cost of implementation activities.
   • DCalculate the cost for each countermeasure.

   Show answer

   Answer: B

   Explanation

   According to ISACA, following a risk assessment, the next step after new countermeasures have been approved by management should be to develop an implementation strategy. This includes planning and coordinating the implementation of the countermeasures, and identifying any potential roadblocks or issues that may arise during the implementation process. This step is crucial to ensure that the implementation is successful and that the countermeasures are put in place in an efficient and effective manner. Once the implementation strategy is developed, schedule the target end date for implementation activities, budget the total cost of implementation activities, and calculate the cost for each countermeasure can be done.

   Source: Adapted from community discussion — Broesweelies

   Next question

4. Question 374 · 1243 in bank

   Which of the following is the MOST effective defense against malicious insiders compromising confidential information?

   • ARegular audits of access controls
   • BStrong background checks when hiring staff
   • CPrompt termination procedures
   • DRole-based access control

   Show answer

   Answer: D

   Explanation

   most effective defense against malicious insiders compromising confidential information is role-based access control. This approach limits access to sensitive information and systems based on an individual's job function or role within the organization. This ensures that only authorized personnel have access to the information they need to perform their job, and reduces the risk of accidental or malicious data breaches. By implementing role-based access control, an organization can reduce the risk of malicious insiders compromising confidential information, by ensuring that the employees have access only to the information they need to do their job.

   Source: Adapted from community discussion — Broesweelies

   Next question

5. Question 375 · 1243 in bank

   An information security manager is asked to provide a short presentation on the organization's current IT risk posture to the board of directors. Which of the following would be MOST effective to include in this presentation?

   • AGap analysis results
   • BRisk register
   • CThreat assessment results
   • DRisk heat map

   Show answer

   Answer: D

   Explanation

   An effective way to include in a short presentation on the organization's current IT risk posture to the board of directors would be a risk heat map. A risk heat map is a visual representation of the organization's current risk posture, which allows the board of directors to quickly and easily understand the overall level of risk, as well as the areas of greatest concern. It can be used to highlight the most critical risks the organization is facing, including the likelihood and potential impact of each risk. The heat map can be used to communicate the current risk posture of the organization and the effectiveness of implemented controls. The board of directors can then make informed decisions on where to allocate resources to mitigate the most critical risks. While gap analysis results, risk register, threat assessment results can also be useful, a heat map is a more visually appealing and effective way to present the information to the board of directors.

   Source: Adapted from community discussion — Broesweelies

   Next question

6. Question 376 · 1243 in bank

   Which of the following provides the BEST assurance that a contracted third-party provider meets an organization's security requirements?

   • AContinuous monitoring
   • BDue diligence questionnaires
   • CRight-to-audit clause in the contract
   • DPerformance metrics

   Show answer

   Answer: C

   Explanation

   Continuous monitoring helps in ongoing oversight, but it may not cover all aspects of security requirements. Due diligence questionnaires provide initial information, but they may not be sufficient to validate the provider's security practices comprehensively. Performance metrics can indicate the provider's performance but may not directly address security requirements.

   Source: Adapted from community discussion — mad68

   Next question

7. Question 377 · 1243 in bank

   An organization's senior management is encouraging employees to use social media for promotional purposes. Which of the following should be the information security manager s FIRST step to support this strategy?

   • AIncorporate social media into the security awareness program.
   • BDevelop a guideline on the acceptable use of social media.
   • CEmploy the use of a web content filtering solution.
   • DDevelop a business case for a data loss prevention (DLP) solution.

   Show answer

   Answer: B

   Explanation

   B. Develop a guideline on the acceptable use of social media. This helps ensure that employees understand how to use these platforms in a manner that supports the organization's promotional goals while also protecting sensitive information and adhering to company policies and standards. Creating clear, comprehensive guidelines will clarify what is considered appropriate and inappropriate behavior on social media for all employees. It addresses potential security risks and ensures consistent messaging and branding across employee social media interactions. These guidelines will serve as the foundation for further security measures, informing the contents of a security awareness program, the parameters of content filtering solutions if needed, and the rationale for investing in DLP tools. Once the guidelines have been established, reinforcing them through a security awareness program!

   Source: Adapted from community discussion — helg420

   Next question

8. Question 378 · 1243 in bank

   In addition to executive sponsorship and business alignment, which of the following is MOST critical for information security governance?

   • AOwnership of security
   • BAuditability of systems
   • CAllocation of training resources
   • DCompliance with policies

   Show answer

   Answer: A

   Explanation

   A. Ownership of security. In the context of information security governance, ownership of security refers to having a clear and accountable individual or group responsible for the overall security of the organization. This includes the development, implementation, and maintenance of security policies, procedures, controls, and risk management practices. Having ownership of security is considered the most critical element of information security governance because it ensures that someone within the organization has the authority, responsibility, and resources to drive and oversee the security program. This individual or group acts as a focal point for making security-related decisions, coordinating security initiatives, and enforcing security measures throughout the organization.

   Source: Adapted from community discussion — mad68

   Next question

9. Question 379 · 1243 in bank

   Which of the following is a PRIMARY responsibility of the information security governance function?

   • AAdministering information security awareness training
   • BAdvising senior management on optimal levels of risk appetite and tolerance
   • CDefining security strategies to support organizational programs
   • DEnsuring adequate support for solutions using emerging technologies

   Show answer

   Answer: C

   Explanation

   The purpose of information security in an organization is to assist the organization in achieving its objectives, and it is the primary goal of an information security strategy. The PRIMARY goal of developing an information security strategy is to: establish security metrics and performance monitoring.

   Source: Adapted from community discussion — oluchecpoint

   Next question

10. Question 380 · 1243 in bank

    To address the issue that performance pressures on IT may conflict with information security controls, it is MOST important that:

    • Athe steering committee provides guidance and dispute resolution.
    • Bthe security policy is changed to accommodate IT performance pressure.
    • CIT policies and procedures are better aligned to security policies.
    • Dnoncompliance issues are reported to senior management.

    Show answer

    Answer: C

    Explanation

    Option C- Option A, which suggests that the steering committee provides guidance and dispute resolution, can also be important in addressing conflicts between performance pressures on IT and information security controls. However, it is not the MOST important action in this context. While the steering committee can play a role in providing guidance and resolving disputes, it is ultimately more effective to establish a foundation where IT policies and procedures are better aligned to security policies.

    Source: Adapted from community discussion — Saisharan

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 371. 1243 questions available.