Question 401 · 1243 in bank
It is MOST important for an information security manager to ensure that security risk assessments are performed:
Show answer
Answer: C
Certified Information Security Manager1,243 questions across 125 pages are complete and free, with no account or card.
1243 questions in this bank
Free access · progress saved on this device
It is MOST important for an information security manager to ensure that security risk assessments are performed:
Answer: C
Which of the following BEST indicates the effectiveness of the vendor risk management process?
Answer: B
The best indicator of the effectiveness of the vendor risk management process is an increase in the percentage of vendors that have completed a due diligence review. Due diligence review is an important aspect of vendor risk management. It involves evaluating a vendor's security practices, policies, and controls, as well as assessing their overall risk profile. By conducting thorough due diligence reviews, organizations can identify and mitigate potential risks associated with using a particular vendor.
Source: Adapted from community discussion — Broesweelies
Risk scenarios simplify the risk assessment process by:
Answer: D
whenever an answer choice is "All" such as "full" risk possibilities it is always wrong. There is no way to cover all risk because there are always new emerging risk. Please remember this when you take the exam. "all" =wrong
Source: Adapted from community discussion — dedfef
An organization has decided to store production data in a cloud environment. What should be the FIRST consideration?
Answer: B
Data needs to be classified to know what type of security it will have in the cloud. Data needs to be classified to know what backup tier it needs to be stored in. Data needs to be classified to know if it is going to be isolated. In short it's (B) data classification is the root of all these steps.
Source: Adapted from community discussion — dark_3k03r
Which of the following is the PRIMARY reason that an information security manager would contract with an external provider to perform penetration testing?
Answer: C
C. To get a view from an independent pen-tester Even though the organization may have the capability to perform penetration testing with internal resources, third-party penetration testing should be performed to gain an independent view of the security exposure. Mitigating technical risks is not a direct result of a penetration test. A penetration test would not provide certification of network security nor provide a complete list of vulnerabilities.
Source: Adapted from community discussion — baranikumar_v
An organization has decided to outsource its disaster recovery function. Which of the following is the MOST important consideration when drafting the service level agreement (SLA)?
Answer: C
when outsourcing the disaster recovery function, the MOST important consideration when drafting the service level agreement (SLA) is to establish appropriate Recovery Time Objectives (RTOs). This ensures that the outsourced provider is contractually obligated to recover and restore operations within the specified timeframes, aligning with the organization's business continuity requirements.
Source: Adapted from community discussion — wello
What is the PRIMARY objective of implementing standard security configurations?
Answer: D
D. Control vulnerabilities and reduce threats from changed configurations. Implementing standard security configurations involves defining and applying a set of predetermined, secure configuration settings for systems, applications, and network devices. By doing so, the organization aims to establish a baseline security posture that aligns with industry best practices and security standards. The primary goal is to control vulnerabilities and reduce threats that may arise from deviations or unauthorized changes in system configurations. Standard security configurations help ensure consistency and enforce security controls across the organization's IT infrastructure. By maintaining consistent and secure configurations, organizations can minimize the risk of exploitable vulnerabilities and improve their overall security posture.
Source: Adapted from community discussion — mad68
Which of the following is MOST important to ensure when considering exceptions to an information security policy?
Answer: C
The most important thing to ensure when considering exceptions to an information security policy is that exceptions reflect the organizational risk appetite. This means that the organization's risk management strategy and risk appetite should be taken into account when determining whether to grant an exception to the security policy. An organization's risk appetite is its tolerance for risk and the level of risk that it is willing to accept in order to achieve its business objectives. Exceptions to the security policy should not exceed the organization's risk appetite, and should be carefully evaluated to ensure that they do not create unacceptable risks.
Source: Adapted from community discussion — Broesweelies
An external security audit has reported multiple instances of control noncompliance. Which of the following is MOST important for the information security manager to communicate to senior management?
Answer: A
A. The impact of noncompliance on the organization's risk profile. The impact of noncompliance on the organization's risk profile is crucial information that senior management needs to understand. It helps senior management grasp the potential consequences and implications of the control noncompliance in relation to the organization's overall risk posture.
Source: Adapted from community discussion — Jae_kes
An organization's security policy is to disable access to USB storage devices on laptops and desktops. Which of the following is the STRONGEST justification for granting an exception to the policy?
Answer: B
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISM practice, question 401. 1243 questions available.
Version 1.0.0. How we source questions