CISM practice questions 431–440

1. Question 431 · 1243 in bank

   Which of the following would BEST help to ensure an organization's security program is aligned with business objectives?

   • AThe organization's board of directors includes a dedicated information security advisor.
   • BThe security strategy is reviewed and approved by the organization's steering committee.
   • CSecurity policies are reviewed and approved by the chief information officer (CIO)
   • DBusiness leaders receive annual information security awareness training This question has been

   Show answer

   Answer: B

   Explanation

   The correct answer is B. The security strategy is reviewed and approved by the organization's steering committee. Explanation: Among the options provided, having the security strategy reviewed and approved by the organization's steering committee would best help to ensure that the security program is aligned with business objectives. The steering committee typically consists of high-level executives and stakeholders who represent various areas of the organization. A. The organization's board of directors includes a dedicated information security advisor: While having an information security advisor on the board is important, the steering committee is more directly involved in operational decision-making and strategy alignment

   Source: Adapted from community discussion — Hugo1717

   Next question

2. Question 432 · 1243 in bank

   When defining and communicating roles and responsibilities between an organization and cloud service provider, which of the following situations would present the GREATEST risk to the organization's ability to ensure information risk is managed appropriately?

   • AThe service agreement uses a custom-developed RACI instead of an industry standard RACI to document responsibilities
   • BThe organization believes the provider accepted responsibility for issues affecting security that the provider did not accept
   • CThe organization and provider identified multiple information security responsibilities that neither party was planning to provide
   • DThe service agreement results in unnecessary duplication of effort because shared responsibilities have not been clearly defined

   Show answer

   Answer: B

   Explanation

   In a cloud service provider relationship, clearly defining and communicating roles and responsibilities is crucial to ensure effective information risk management. Option B poses the greatest risk because it indicates a misalignment or misunderstanding between the organization and the provider regarding the allocation of security responsibilities. If the organization believes that the provider has accepted responsibility for security issues that the provider did not actually agree to, there may be critical security gaps or vulnerabilities that go unaddressed.

   Source: Adapted from community discussion — wello

   Next question

3. Question 433 · 1243 in bank

   An IT department plans to migrate an application to the public cloud. Which of the following is the information security manager's MOST important action in support of this initiative?

   • AReview cloud provider independent assessment reports.
   • BProvide cloud security requirements
   • CEvaluate service level agreements (SLAs)
   • DCalculate security implementation costs

   Show answer

   Answer: B

   Explanation

   B. Provide cloud security requirements The information security manager's most important action in support of this initiative is to provide cloud security requirements. This includes identifying and documenting the specific security controls, policies and procedures that are required to protect the organization's data and systems in the cloud environment. It also includes ensuring that the cloud provider's security capabilities meet these requirements. By providing clear and comprehensive security requirements, the information security manager can help ensure that the application migration is secure and compliant with relevant regulations and standards.

   Source: Adapted from community discussion — Broesweelies

   Next question

4. Question 434 · 1243 in bank

   An executive's personal mobile device used for business purposes is reported lost. The information security manager should respond based on:

   • Athe acceptable use policy.
   • Basset management guidelines.
   • Cthe business impact analysis (BIA).
   • Dincident classification.

   Show answer

   Answer: D

   Next question

5. Question 435 · 1243 in bank

   What is the BEST approach for the information security manager to reduce the impact on a security program due to turnover within the security staff?

   • ARecruit certified staff
   • BRevise the information security program
   • CDocument security procedures
   • DEnsure everyone is trained in their roles

   Show answer

   Answer: C

   Explanation

   The correct answer is (C) Document security procedures, cause anyone who has access to the procedures is able to learn from them and reproduce the same results using the same process. A. When the certified user leaves another one may bring a different approach B. Revise the information security program does nothing to address the issue of turnover, only the objectives of the program. D. Ensure everyone is trained in their roles is a great idea, but once they leave and another group enters, the process may be inconsistent and thus doing nothing to minimize the impact.

   Source: Adapted from community discussion — dark_3k03r

   Next question

6. Question 436 · 1243 in bank

   Which of the following BEST enables effective information security governance?

   • ASecurity-aware corporate culture
   • BAdvanced security technologies
   • CPeriodic vulnerability assessments
   • DEstablished information security metrics

   Show answer

   Answer: A

   Explanation

   A security-aware corporate culture is foundational to effective information security governance. It involves creating a mindset within the organization where employees at all levels understand the importance of security, follow security policies, and actively contribute to the protection of information assets. A strong security culture promotes accountability, awareness, and a collective commitment to information security. While advanced security technologies (option B), periodic vulnerability assessments (option C), and established information security metrics (option D) are essential components of a comprehensive security program, a security-aware corporate culture provides the organizational context and human factor necessary for successful information security governance.

   Source: Adapted from community discussion — Viperhunter

   Next question

7. Question 437 · 1243 in bank

   Which of the following roles is BEST suited to validate user access requirements during an annual user access review?

   • AAccess manager
   • BSystem administrator
   • CBusiness owner
   • DIT director

   Show answer

   Answer: C

   Explanation

   Which of the following roles is BEST suited to validate user access requirements during an annual user access review? A. Access manager B. System administrator C. Business owner D. IT director

   Source: Adapted from community discussion — Broesweelies

   Next question

8. Question 438 · 1243 in bank

   For an organization that is experiencing outages due to malicious code, which of the following is the BEST index of the effectiveness of countermeasures?

   • ANumber of virus infections detected
   • BAverage recovery time per incident
   • CAmount of infection-related downtime
   • DNumber of downtime-related help desk calls

   Show answer

   Answer: C

   Explanation

   The correct answer is (C.) Amount of infection-related downtime as countermeasures are meant to reduce the downtime related to infection-related incidents. It's in the answer "infection-related" and the keywords "malicious code" and "outage". Rationale: (A.) Number of virus infections detected does not measure outages so this can't be the correct answer. (B.) Average recovery time per incident is incorrect it is not as specific as C. It also measures time and not a number of occurrences like C and every incident is different. Some take more time some take less, so this variable measurement is not good for consistent measurement. (D.) Number of downtime-related help desk calls is incorrect cause this could be for a number of reasons.

   Source: Adapted from community discussion — dark_3k03r

   Next question

9. Question 439 · 1243 in bank

   Which of the following should be the MOST important consideration when reviewing an information security strategy?

   • AChanges to the security budget
   • BNew business initiatives
   • CInternal audit findings
   • DRecent security incidents

   Show answer

   Answer: B

   Explanation

   Changes to the security budget can certainly impact the implementation of an information security strategy, but they should not be the most important consideration when reviewing the strategy. The most important consideration when reviewing an information security strategy should be new business initiatives, as they can introduce new risks and threats that may need to be addressed by the existing security controls and processes. For example, the introduction of new technology, products, or services can bring new vulnerabilities and attack surfaces, and the information security strategy should be reviewed and updated to address these new risks. On the other hand, changes to the security budget, internal audit findings, and recent security incidents can certainly inform the review and update of the information security strategy, but new business initiatives should always be the most important consideration.

   Source: Adapted from community discussion — Broesweelies

   Next question

10. Question 440 · 1243 in bank

    Human resources (HR) is evaluating potential Software as a Service (SaaS) cloud services. Which of the following should the information security manager do FIRST to support this effort?

    • APerform a cost-benefit analysis of using cloud services
    • BConduct a security audit on the cloud service providers
    • CReview the cloud service providers' control reports
    • DPerform a risk assessment of adopting cloud services

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 431. 1243 questions available.