CISM practice questions 411–420

1. Question 411 · 1243 in bank

   Which of the following is an information security manager's FIRST priority after a high-profile system has been compromised?

   • AImplement improvements to prevent recurrence.
   • BIdentify the malware that compromised the system.
   • CRestore the compromised system.
   • DPreserve incident-related data.

   Show answer

   Answer: D

   Explanation

   The FIRST priority of an information security manager after a high-profile system has been compromised is to preserve incident-related data. This is because the incident data can help in investigating the cause and extent of the compromise, as well as in identifying any data that may have been lost or stolen. Failure to preserve the incident data may result in loss of critical evidence and hinder any further investigation. Once the incident-related data has been preserved, the information security manager can then proceed with identifying the malware that caused the compromise, restoring the compromised system, and implementing improvements to prevent recurrence.

   Source: Adapted from community discussion — Abhey

   Next question

2. Question 412 · 1243 in bank

   Which of the following has the MOST direct impact on the usability of an organization's asset classification policy?

   • AThe granularity of classifications in the hierarchy
   • BThe support of IT management for the classification scheme
   • CThe frequency of updates to the organization's risk register
   • DThe business objectives of the organization

   Show answer

   Answer: A

   Explanation

   The most direct impact on the usability of an organization's asset classification policy is the granularity of classifications in the hierarchy. Asset classification is the process of identifying, categorizing, and labeling an organization's assets based on their value, criticality, and the risks associated with them. The granularity of classifications in the hierarchy refers to the level of detail and specificity in the classification scheme, and how finely assets are divided into different categories. A classification scheme with a high granularity will be more detailed and specific, making it easier to understand the different types of assets and their associated risks. This can improve the usability of the classification policy by making it easier for employees to understand which assets need to be protected and how they should be protected.

   Source: Adapted from community discussion — Broesweelies

   Next question

3. Question 413 · 1243 in bank

   A corporate information security program is BEST positioned for success when:

   • Astaff is receptive to the program.
   • Bsenior management supports the program.
   • Csecurity is thoroughly assessed in the program.
   • Dthe program aligns with industry best practice.

   Show answer

   Answer: B

   Next question

4. Question 414 · 1243 in bank

   Which of the following is the MOST important consideration when developing information security objectives?

   • AThey are regularly reassessed and reported to stakeholders
   • BThey are approved by the IT governance function
   • CThey are clear and can be understood by stakeholders
   • DThey are identified using global security frameworks and standards

   Show answer

   Answer: C

   Explanation

   Clear and understandable information security objectives are crucial for effective communication and alignment with stakeholders. When objectives are transparent and easily comprehensible, they facilitate better understanding and buy-in from various stakeholders, including employees, management, and other relevant parties. Clarity in objectives helps ensure that everyone involved understands the goals and expectations related to information security, fostering a more cohesive and focused security culture within the organization. While the other options (regular reassessment and reporting, approval by the IT governance function, and identification using global security frameworks and standards) are important aspects of managing information security, clarity and understanding by stakeholders are foundational for successful implementation and support.

   Source: Adapted from community discussion — Viperhunter

   Next question

5. Question 415 · 1243 in bank

   Following a significant change to the underlying code of an application, it is MOST important for the information security manager to:

   • Ainform senior management.
   • Bupdate the risk assessment.
   • Cvalidate the user acceptance testing (UAT).
   • Dmodify key risk indicators (KRIs).

   Show answer

   Answer: B

   Explanation

   (A) This is only done after the risk assessment (B) It's a risk assessment that needs to occur cause risk is based on impact and probability, both which are based on the attack surface which of course is based on the functionality of the app. This is what has changed and needs to be reflected in the risk assessment (C) Information security should be focused on UAT that's a developer role (D) KRI probable but unlikely.

   Source: Adapted from community discussion — dark_3k03r

   Next question

6. Question 416 · 1243 in bank

   Which of the following is the PRIMARY responsibility of an information security steering committee composed of management representation from business units?

   • AOversee the execution of the information security strategy.
   • BPerform business impact analyses (BIAs).
   • CManage the implementation of the information security plan.
   • DMonitor the treatment of information security risk.

   Show answer

   Answer: A

   Next question

7. Question 417 · 1243 in bank

   Audit trails of changes to source code and object code are BEST tracked through:

   • Ause of compilers.
   • Bcode review.
   • Cprogram library software.
   • Djob control statements.

   Show answer

   Answer: C

   Explanation

   C. program library software. Program library software, often referred to as version control or source code management systems (e.g., Git, Subversion), is designed specifically to track changes to source code and object code. These tools allow developers to commit their code changes, provide comments about the changes made, and maintain a history of revisions. This makes it easier to review, roll back to previous versions, and track who made specific changes to the code, providing a comprehensive audit trail.

   Source: Adapted from community discussion — oluchecpoint

   Next question

8. Question 418 · 1243 in bank

   Which of the following should be determined FIRST when preparing a risk communication plan?

   • AReporting content
   • BCommunication channel
   • CTarget audience
   • DReporting frequency

   Show answer

   Answer: C

   Next question

9. Question 419 · 1243 in bank

   Which of the following will protect the confidentiality of data transmitted over the Internet?

   • AMessage digests
   • BEncrypting file system
   • CNetwork address translation
   • DIPsec protocol

   Show answer

   Answer: D

   Explanation

   D. IPsec protocol The IPsec (Internet Protocol Security) protocol is specifically designed to protect the confidentiality, integrity, and authenticity of data transmitted over the Internet. It provides encryption and authentication mechanisms to secure the communication between two devices or networks, ensuring that the data remains confidential during transmission. Option A (Message digests) is a cryptographic technique used for data integrity, not confidentiality. Option B (Encrypting file system) is used for encrypting data at rest on a storage device, not for data transmitted over the network. Option C (Network address translation) is a technique used for translating private IP addresses to a public IP address for routing purposes but does not directly protect data confidentiality during transmission.

   Source: Adapted from community discussion — oluchecpoint

   Next question

10. Question 420 · 1243 in bank

    Which of the following would MOST effectively communicate the benefits of an information security program to executive management?

    • AKey performance indicators (KPIs)
    • BThreat models
    • CKey risk indicators (KRIs)
    • DIndustry benchmarks

    Show answer

    Answer: A

    Explanation

    I guess you guys need me to define KRI: Key risk indicators are metrics that predict potential risks that can negatively impact businesses. They provide a way to quantify and monitor each risk. Think of them as change-related metrics that act as an early warning risk detection system to help companies effectively monitor, manage and mitigate risks. KRI in no way is going to communicate the benefits of the security program to executive management. The Answer is KPI and is also the correct answer in similar questions before this one.

    Source: Adapted from community discussion — POWNED

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 411. 1243 questions available.