CISM practice questions 391–400

1. Question 391 · 1243 in bank

   Which of the following is MOST appropriate to communicate to senior management regarding information risk?

   • ARisk profile changes
   • BVulnerability scanning progress
   • CDefined risk appetite
   • DEmerging security technologies

   Show answer

   Answer: A

   Explanation

   Senior management would define risk appetite. According to the CISM Manual, Risk appetite is the level of risk that an organization is willing to accept while in the pursuit of its mission, strategy, and objectives. Risk treatment and risk acceptance decisions should be assigned to and made by associated business owners and executives who are accountable for those decisions. The board is responsible for establishing the tone for risk appetite and risk management in the organization. To the extent that the board of directors establishes business and IT security, so, too, should the board consider risk and security in that strategy.

   Source: Adapted from community discussion — Ej24356

   Next question

2. Question 392 · 1243 in bank

   Executive leadership has decided to engage a consulting firm to develop and implement a comprehensive security framework for the organization to allow senior management to remain focused on business priorities. Which of the following poses the GREATEST challenge to the successful implementation of the new security governance framework?

   • AExecutive leadership becomes involved in decisions about information security governance.
   • BExecutive leadership views information security governance primarily as a concern of the information security management team
   • CInformation security staff has little or no experience with the practice of information security governance.
   • DInformation security management does not fully accept the responsibility for information security governance.

   Show answer

   Answer: B

   Next question

3. Question 393 · 1243 in bank

   A new information security manager finds that the organization tends to use short-term solutions to address problems. Resource allocation and spending are not effectively tracked, and there is no assurance that compliance requirements are being met. What should be done FIRST to reverse this bottom-up approach to security?

   • AImplement an information security awareness training program.
   • BConduct a threat analysis.
   • CEstablish an audit committee.
   • DCreate an information security steering committee.

   Show answer

   Answer: D

   Explanation

   D. Create an information security steering committee. Creating an information security steering committee is crucial because it will establish a structured and top-down approach to information security within the organization. This committee typically includes key stakeholders from various departments and levels of the organization, including senior management. Their primary responsibility is to provide governance, oversight, and strategic direction for information security.

   Source: Adapted from community discussion — oluchecpoint

   Next question

4. Question 394 · 1243 in bank

   An information security manager has been tasked with developing materials to update the board, regulatory agencies, and the media about a security incident. Which of the following should the information security manager do FIRST?

   • AInvoke the organization's incident response plan.
   • BSet up communication channels for the target audience.
   • CCreate a comprehensive singular communication.
   • DDetermine the needs and requirements of each audience.

   Show answer

   Answer: D

   Explanation

   The Correct answer is (D) since you have to have your message targeted to the specific audience and there needs cause each audience will want to hear something different. Whether it's how it impacts the business, what lawyers need to hear or finally how to stop consumers from freaking out. This points to a need of a targeted response. Rationale: (A) is not the answer since we don't know at what phase of the lifecycle this request was made in. Was it in the planning phase to be prepared? Or was it after the incident occurred? Or was it in the midst of an incident? In two of the three scenarios, it wouldn't make sense to invoke the plan cause its too early or too late and since we don't know what phase it's hard to say to do A. (B) This comes after D has been determined (C) This can't be true because each audience member will have their own needs.

   Source: Adapted from community discussion — dark_3k03r

   Next question

5. Question 395 · 1243 in bank

   Which of the following is MOST appropriate to add to a dashboard for the purpose of illustrating an organization's risk level to senior management?

   • AResults of risk and control testing
   • BNumber of reported incidents
   • CBudget variance for information security
   • DRisk heat map

   Show answer

   Answer: D

   Next question

6. Question 396 · 1243 in bank

   When establishing escalation processes for an organization's computer security incident response team, the organization's procedures should:

   • Arequire events to be escalated whenever possible to ensure that management is kept informed.
   • Bprovide unrestricted communication channels to executive leadership to ensure direct access.
   • Cspecify step-by-step escalation paths to ensure an appropriate chain of command.
   • Drecommend the same communication path for events to ensure consistency of communication.

   Show answer

   Answer: C

   Next question

7. Question 397 · 1243 in bank

   Which of the following is the MOST beneficial outcome of testing an incident response plan?

   • AThe response includes escalation to senior management.
   • BTest plan results are documented.
   • CIncident response time is improved.
   • DThe plan is enhanced to reflect the findings of the test.

   Show answer

   Answer: D

   Explanation

   D. The plan is enhanced to reflect the findings of the test. The most beneficial outcome of testing an incident response plan is that the plan is enhanced and improved based on the findings of the test. Testing an incident response plan helps identify weaknesses, gaps, and areas for improvement in the plan and the organization's response procedures. This process allows the organization to make necessary adjustments and updates to the plan, ensuring that it is more effective and better prepared to handle real incidents in the future.

   Source: Adapted from community discussion — oluchecpoint

   Next question

8. Question 398 · 1243 in bank

   The PRIMARY goal of a post-incident review should be to:

   • Aidentify policy changes to prevent a recurrence.
   • Bestablish the cost of the incident to the business.
   • Cdetermine why the incident occurred.
   • Ddetermine how to improve the incident handling process.

   Show answer

   Answer: D

   Next question

9. Question 399 · 1243 in bank

   Which of the following will MOST effectively minimize the chance of inadvertent disclosure of confidential information?

   • AApplying data classification rules
   • BFollowing the principle of least privilege
   • CRestricting the use of removable media
   • DEnforcing penalties for security policy violations

   Show answer

   Answer: B

   Explanation

   The most effective way to minimize the chance of an inadvertent disclosure of confidential information is by following the principle of least privilege. The principle of least privilege (POLP) is a security principle that limits the access to sensitive data and systems to only those who need it to perform their job. By implementing least privilege, an organization can reduce the risk of accidental data breaches caused by employees who have access to sensitive information they do not need.

   Source: Adapted from community discussion — Broesweelies

   Next question

10. Question 400 · 1243 in bank

    Which type of control is an incident response team?

    • ADetective
    • BDirective
    • CCorrective
    • DPreventive

    Show answer

    Answer: C

    Explanation

    There is a difference between incident management and incident response. Incident management is actions taken prior to, during and after the incident. This includes pro-active and reactive detection of incidents. Incident response is actions taken when an incident has been declared, i.e. after detection and reporting. Among verification, assigning ownership, and triage this also includes corrective actions like containment, eradication and recovery. Therefore, the most likely answer is C, corrective.

    Source: Adapted from community discussion — CISSPST

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 391. 1243 questions available.