CISM practice questions 421–430

1. Question 421 · 1243 in bank

   Which of the following processes can be used to remediate identified technical vulnerabilities?

   • AUpdating the business impact analysis (BIA)
   • BPerforming penetration testing
   • CEnforcing baseline configurations
   • DConducting a risk assessment

   Show answer

   Answer: C

   Explanation

   C. Enforcing baseline configurations Enforcing baseline configurations involves ensuring that all systems and devices within an organization are configured according to a predetermined standard or baseline. This helps in reducing vulnerabilities by eliminating misconfigurations and ensuring that security settings are aligned with best practices.

   Source: Adapted from community discussion — oluchecpoint

   Next question

2. Question 422 · 1243 in bank

   Which of the following BEST enables the detection of advanced persistent threats (APTs)?

   • AVulnerability scanning
   • BSecurity information and event management system (SIEM)
   • CInternet gateway filtering
   • DPeriodic reviews of intrusion prevention system (IPS)

   Show answer

   Answer: B

   Explanation

   Vulnerability scanning is typically focused on identifying known vulnerabilities and exploits that are publicly available. It may not be able to detect APTs that use new or unknown exploits, or that have been specifically designed to evade detection by security tools. APTs often use advanced evasion techniques, such as encryption, code obfuscation, and anti-virus avoidance techniques, to avoid detection by security tools.

   Source: Adapted from community discussion — jaiz

   Next question

3. Question 423 · 1243 in bank

   Which of the following is the BEST way to strengthen the security of corporate data on a personal mobile device?

   • AImplementing a strong password policy
   • BUsing containerized software
   • CMandating use of pre-approved devices
   • DImplementing multi-factor authentication

   Show answer

   Answer: B

   Explanation

   The correct answer is B. Using containerized software. Explanation: Among the options provided, using containerized software is the best way to strengthen the security of corporate data on a personal mobile device. Containerization involves creating isolated environments on a device to separate corporate data and applications from personal data and apps. B. Using containerized software: Containerization ensures that corporate data and applications are isolated within a secure container on the personal mobile device. This prevents data leakage and minimizes the risk of unauthorized access to corporate information even if the device is compromised.

   Source: Adapted from community discussion — Hugo1717

   Next question

4. Question 424 · 1243 in bank

   An organization has implemented a new security control in response to a recently discovered vulnerability. Several employees have voiced concerns that the control disrupts their ability to work. Which of the following is the information security manager's BEST course of action?

   • AEvaluate compensating control options.
   • BEducate users about the vulnerability.
   • CAccept the vulnerability.
   • DReport the control risk to senior management.

   Show answer

   Answer: D

   Explanation

   A. Evaluate compensating control options. Explanation: Compensating controls are security measures or countermeasures that are put in place to mitigate the risk of a vulnerability when the primary control measure may disrupt normal operations. In this case, if employees are experiencing disruptions due to the new security control, it's essential to assess whether there are alternative or compensating controls that can provide the necessary security without causing significant disruptions. The goal of this action is to balance security needs with operational requirements. It demonstrates a proactive approach to addressing security concerns while minimizing the impact on employees' ability to work.

   Source: Adapted from community discussion — oluchecpoint

   Next question

5. Question 425 · 1243 in bank

   A legacy application does not comply with new regulatory requirements to encrypt sensitive data at rest, and remediating this issue would require significant investment. What should the information security manager do FIRST?

   • AAssess the business impact to the organization.
   • BPresent the noncompliance risk to senior management.
   • CInvestigate alternative options to remediate the noncompliance.
   • DDetermine the cost to remediate the noncompliance.

   Show answer

   Answer: A

   Explanation

   The action plan for non-compliance would follow the below order: A. Assess the business impact to the organization. C. Investigate alternative options to remediate the noncompliance. D. Determine the cost to remediate the noncompliance. B. Present the noncompliance risk to senior management.

   Source: Adapted from community discussion — CISSPST

   Next question

6. Question 426 · 1243 in bank

   Which of the following would be MOST helpful when determining appropriate access controls for an application?

   • AIndustry best practices
   • BGap analysis results
   • CEnd-user input
   • DData criticality

   Show answer

   Answer: D

   Next question

7. Question 427 · 1243 in bank

   An information security manager has become aware that a third-party provider is not in compliance with the statement of work (SOW). Which of the following is the BEST course of action?

   • AAssess the extent of the issue.
   • BReport the issue to legal personnel.
   • CNotify senior management of the issue.
   • DInitiate contract renegotiation.

   Show answer

   Answer: A

   Next question

8. Question 428 · 1243 in bank

   An incident response team recently encountered an unfamiliar type of cyber event. Though the team was able to resolve the issue, it took a significant amount of time to identify. What is the BEST way to help ensure similar incidents are identified more quickly in the future?

   • AEstablish performance metrics for the team.
   • BPerform a post-incident review.
   • CPerform a threat analysis.
   • DImplement a SIEM solution.

   Show answer

   Answer: B

   Explanation

   A post-incident review is an important step in the incident response process. It allows the incident response team to evaluate their response to the incident and identify any areas for improvement. By conducting a thorough analysis of the incident, including the cause, the actions taken and the outcomes, the team can identify any gaps in their knowledge or processes that led to the incident taking longer to identify. This information can then be used to improve incident response procedures and to develop new strategies for identifying similar incidents more quickly in the future.

   Source: Adapted from community discussion — Broesweelies

   Next question

9. Question 429 · 1243 in bank

   Who should an information security manager contact FIRST upon discovering that a cloud-based payment system used by the organization may be infected with malware?

   • ASenior management
   • BAffected customers
   • CCloud service provider
   • DThe incident response team

   Show answer

   Answer: D

   Explanation

   "may be infected" is not the same as "has been infected". "may be infected" requires first a confirmation of the cloud-based system provider that the probability of an infection is sufficient to trigger a security incident and that it is not just a rumor. So the only good response is C.

   Source: Adapted from community discussion — todush

   Next question

10. Question 430 · 1243 in bank

    An organization's operations have been significantly impacted by a cyberattack resulting in data loss. Once the attack has been contained, what should the security team do NEXT?

    • AUpdate the incident response plan.
    • BPerform a root cause analysis.
    • CImplement compensating controls.
    • DConduct a lessons learned exercise.

    Show answer

    Answer: B

    Explanation

    B. Perform a root cause analysis: It's crucial to understand how the cyberattack occurred in the first place. A root cause analysis helps identify the vulnerabilities or weaknesses in the organization's security posture that allowed the attack to happen. This analysis informs future security improvements and helps prevent similar incidents in the future.

    Source: Adapted from community discussion — oluchecpoint

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 421. 1243 questions available.