CISM practice questions 381–390

1. Question 381 · 1243 in bank

   Which of the following is the MOST important security consideration when developing an incident response strategy with a cloud provider?

   • ASecurity audit reports
   • BRecovery time objective (RTO)
   • CTechnological capabilities
   • DEscalation processes

   Show answer

   Answer: D

   Explanation

   From the CISM Review Manual, 15th Edition, by ISACA: "Incident response strategies need to have clear and well-defined escalation processes. This is especially true when dealing with cloud providers where the client company may have little or no control over the actual infrastructure where their data is stored and processed. If an incident occurs, it is vital that the cloud provider can be quickly and effectively alerted, and that there is a clearly defined process for how the cloud provider will respond to and communicate during such incidents. The escalation process needs to clearly outline who should be contacted, how they should be contacted, what information should be provided, and what the next steps are in the incident response process."

   Source: Adapted from community discussion — [Removed]

   Next question

2. Question 382 · 1243 in bank

   Information security awareness programs are MOST effective when they are:

   • Asponsored by senior management.
   • Breinforced by computer-based training.
   • Ccustomized for each target audience.
   • Dconducted at employee orientation.

   Show answer

   Answer: C

   Explanation

   The ISACA's CISM Review Manual 15th Edition emphasizes the importance of customizing security awareness programs for different target audiences: "The success of the security awareness program depends on how well it is tailored to its audience. One-size-fits-all approaches are usually less effective. Different groups within the organization have different roles and responsibilities and, therefore, need to be made aware of different aspects of security."

   Source: Adapted from community discussion — [Removed]

   Next question

3. Question 383 · 1243 in bank

   Which of the following would BEST help an organization's ability to manage advanced persistent threats (APT)?

   • AHaving a skilled information security team
   • BIncreasing the information security budget
   • CUsing multiple security vendors
   • DHaving network detection tools in place

   Show answer

   Answer: A

   Explanation

   Having a skilled information security team would be the best way to help an organization's ability to manage advanced persistent threats (APTs). Advanced persistent threats are a type of cyber attack that is typically carried out by highly skilled and well-funded attackers. In order to effectively defend against APTs, an organization needs a team of skilled security professionals who are able to identify, analyze and respond to these threats. This team should be well-versed in the latest threat intelligence, and have the technical expertise to design, implement and maintain advanced security controls. While Increasing the information security budget and using multiple security vendors can also be beneficial, they are not as crucial as having a skilled information security team. Having network detection tools in place is also an important aspect of APT management, but it alone is not sufficient to manage APTs as it is only a part of the larger security strategy.

   Source: Adapted from community discussion — Broesweelies

   Next question

4. Question 384 · 1243 in bank

   An employee has just reported the loss of a personal mobile device containing corporate information. Which of the following should the information security manager do FIRST?

   • AInitiate incident response.
   • BInitiate a device reset.
   • CConduct a risk assessment.
   • DDisable remote access.

   Show answer

   Answer: A

   Explanation

   A. Initiate incident response. The first action that an information security manager should take upon being notified of the loss of a personal mobile device containing corporate information is to initiate the incident response process. This process is designed to handle such events with a structured approach, which typically includes steps such as assessing the situation, containing the impact, eradicating the threat if any, and recovering from the incident.

   Source: Adapted from community discussion — helg420

   Next question

5. Question 385 · 1243 in bank

   An organization has fallen victim to a spear-phishing attack that compromised the multi-factor authentication code. What is the information security manager's MOST important follow-up action?

   • ACommunicate the threat to users.
   • BInstall client anti-malware solutions.
   • CImplement firewall blocking of known attack signatures.
   • DImplement an advanced email filtering system.

   Show answer

   Answer: A

   Explanation

   This question is actually trickier than it looks like on the first glance. Someone important fell for a spear-phishing attack which led to his MFA code (I guess OTP) being compromised. So the goal is to select the answer that will address this issue in the future - phishing emails reaching mailboxes of users. Based purely on that, the answer should be option D. However, if "compromised MFA code" means that the entire MFA system was compromised (code that is generating OTPs), then option A would be the most adequate. Maybe I'm overthinking here, but that's just my train of thought...

   Source: Adapted from community discussion — AlexJacobson

   Next question

6. Question 386 · 1243 in bank

   Which of the following is MOST important for an information security manager to communicate to stakeholders when approving exceptions to the information security policy?

   • AImpact on the risk profile
   • BNeed for compensating controls
   • CTime period for review
   • DRequirements for senior management reporting

   Show answer

   Answer: A

   Explanation

   The most important for an information security manager to communicate to stakeholders when approving exceptions to the information security policy is the impact on the risk profile. This includes the potential risks that may arise from granting the exception, and any potential impact on the confidentiality, integrity, and availability of the organization's data and systems. This information should be communicated in a clear and concise manner, so that stakeholders can understand the implications of the exception and make an informed decision.

   Source: Adapted from community discussion — Broesweelies

   Next question

7. Question 387 · 1243 in bank

   To implement effective continuous monitoring of IT controls, an information security manager needs to FIRST ensure:

   • Asecurity alerts are centralized.
   • Bperiodic scanning of IT systems is in place.
   • Cmetrics are communicated to senior management.
   • Dinformation assets have been classified.

   Show answer

   Answer: D

   Explanation

   To implement effective continuous monitoring of IT controls, an information security manager needs to first ensure that information assets have been classified. This includes identifying and prioritizing the organization's critical assets, such as sensitive data, systems, and infrastructure, and assessing the risks associated with them. Once the assets have been classified, the information security manager can then develop a monitoring plan that focuses on the most critical assets and risks.

   Source: Adapted from community discussion — Broesweelies

   Next question

8. Question 388 · 1243 in bank

   Which of the following would provide the BEST evidence to senior management that security control performance has improved?

   • ADemonstrated return on security investment
   • BReview of security metrics trends
   • CResults of an emerging threat analysis
   • DReduction in inherent risk

   Show answer

   Answer: B

   Next question

9. Question 389 · 1243 in bank

   An information security manager has identified the organization is not in compliance with new legislation that will soon be in effect. Which of the following is MOST important to consider when determining additional controls to be implemented?

   • AThe information security strategy
   • BThe organization's risk appetite
   • CThe cost of noncompliance
   • DThe information security policy

   Show answer

   Answer: C

   Explanation

   C. Why? Because the risk appetite (B) tells you how much food you can stuff in your mouth at any given time...yet the COST of NC (C) tells you how big the meal is. If you don't know how big the meal is, you won't be able to know if you can tolerate it.

   Source: Adapted from community discussion — sham222

   Next question

10. Question 390 · 1243 in bank

    The PRIMARY benefit of a centralized time server is that it:

    • Adecreases the likelihood of an unrecoverable systems failure.
    • Breduces individual time-of-day requests by client applications.
    • Callows decentralized logs to be kept in synchronization.
    • Dis required by password synchronization programs.

    Show answer

    Answer: C

    Explanation

    According to ISACA, the primary benefit of a centralized time server is that it allows decentralized logs to be kept in synchronization. A centralized time server is a device that provides accurate time information to other systems and devices in a network. By synchronizing the time on all systems and devices, it ensures that logs and other records are accurate and that events can be traced across the network. This is particularly important for security-related events, as it allows organizations to quickly and easily identify and respond to potential security incidents.

    Source: Adapted from community discussion — Broesweelies

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 381. 1243 questions available.