CISM practice questions 441–450

1. Question 441 · 1243 in bank

   Which of the following is the BEST way to evaluate the impact of threat events on an organization's IT operations?

   • ARisk assessment
   • BPenetration testing
   • CScenario analysis
   • DControls review

   Show answer

   Answer: C

   Explanation

   C. Scenario analysis Scenario analysis is the best way to evaluate the impact of threat events on an organization's IT operations. Scenario analysis involves identifying potential threat events and simulating their impact on the organization's IT systems and processes. This allows organizations to assess the risks associated with different threat scenarios and to develop plans and procedures to respond to and mitigate those risks. This approach can help organizations understand the potential impact of a threat event and make informed decisions about how to best protect their IT operations. Risk assessment, penetration testing and controls review are important activities, but they do not provide a clear picture of the impact of the threat event on IT operations as a whole.

   Source: Adapted from community discussion — Broesweelies

   Next question

2. Question 442 · 1243 in bank

   Which of the following BEST demonstrates that an anti-phishing campaign is effective?

   • AImproved staff attendance in awareness sessions
   • BDecreased number of incidents that have occurred
   • CDecreased number of phishing emails received
   • DImproved feedback on the anti-phishing campaign

   Show answer

   Answer: B

   Explanation

   The correct answer is B. Decreased number of incidents that have occurred. Explanation: Among the options provided, the decreased number of incidents that have occurred is the best demonstration that an anti-phishing campaign is effective. Here's why this option is the best choice: B. Decreased number of incidents that have occurred: The primary goal of an anti-phishing campaign is to reduce the number of successful phishing attacks and incidents. A decrease in the number of incidents indicates that the campaign's educational efforts and awareness training are helping employees recognize and avoid phishing attempts. C. Decreased number of phishing emails received: While a decrease in the number of phishing emails received is positive, it may not solely indicate that the campaign is effective, as attackers can change tactics.

   Source: Adapted from community discussion — Hugo1717

   Next question

3. Question 443 · 1243 in bank

   The GREATEST benefit resulting from well-documented information security procedures is that they:

   • Afacilitate security training of new staff.
   • Bensure that security policies are consistently applied.
   • Cprovide a basis for auditing security practices.
   • Densure processes can be followed by temporary staff.

   Show answer

   Answer: B

   Explanation

   "well-documented information security procedures" doesn't meant that the procedures are implemented, so the only good response is C, not B.

   Source: Adapted from community discussion — todush

   Next question

4. Question 444 · 1243 in bank

   Which of the following is the MOST reliable way to ensure network security incidents are identified as soon as possible?

   • AInstall stateful inspection firewalls.
   • BConduct workshops and training sessions with end users.
   • CCollect and correlate IT infrastructure event logs.
   • DTrain help desk staff to identify and prioritize security incidents.

   Show answer

   Answer: C

   Explanation

   C. Collect and correlate IT infrastructure event logs. Collecting and correlating IT infrastructure event logs is the most reliable way to ensure that network security incidents are identified as soon as possible. Event logs are records of activity on a system or network, and they can provide valuable information about security incidents. By collecting and analyzing event logs from different systems and devices, organizations can identify patterns of activity that may indicate a security incident. Correlating event logs can help organizations quickly identify the root cause of an incident, as well as its scope and potential impact. This can help organizations quickly respond to security incidents, minimizing the damage they cause. While other options such as installing firewalls or training employees can help improve security, they do not provide the same level of real-time visibility into network activity and potential incidents.

   Source: Adapted from community discussion — Broesweelies

   Next question

5. Question 445 · 1243 in bank

   Which of the following would BEST help to ensure compliance with an organization's information security requirements by an IT service provider?

   • ARequiring an external security audit of the IT service provider
   • BDefining the business recovery plan with the IT service provider
   • CDefining information security requirements with internal IT
   • DRequiring regular reporting from the IT service provider

   Show answer

   Answer: A

   Explanation

   The correct answer is: (A.) Requiring an external security audit of the IT service provider. This is because you can't have the wolf guarding the henhouse. (i.e. Providers may lie, not provide accurate/complete information, but you can't do that with an independent auditor) Rationale: (B.) Defining the business recovery plan with the IT service provider is incorrect cause there is no way to measure this. (C.) Defining information security requirements with internal IT, that's great for your internal IT, but that excludes the provide so this is wrong. (D.) Requiring regular reporting from the IT service provider is incorrect cause the provider may have an incentive to not give complete or accurate information.

   Source: Adapted from community discussion — dark_3k03r

   Next question

6. Question 446 · 1243 in bank

   Which of the following is MOST important to include in an information security status report to senior management?

   • AReview of information security policies
   • BList of recent security events
   • CKey risk indicators (KRIs)
   • DInformation security budget requests

   Show answer

   Answer: C

   Next question

7. Question 447 · 1243 in bank

   Application data integrity risk is MOST directly addressed by a design that includes.

   • Astrict application of an authorized data dictionary.
   • Breconciliation routines such as checksums, hash totals, and record counts.
   • Capplication log requirements such as field-level audit trails and user activity logs.
   • Daccess control technologies such as role-based entitlements.

   Show answer

   Answer: B

   Explanation

   Reconciliation routines, including checksums, hash totals, and record counts, are designed to ensure the accuracy and integrity of application data. These methods help detect errors or unauthorized changes to data by comparing the current state of data with a known or expected state. Reconciliation routines play a crucial role in maintaining data integrity and detecting any discrepancies that may indicate data corruption or tampering. While the other options (strict application of an authorized data dictionary, application log requirements, and access control technologies) are important for various aspects of information security, reconciliation routines directly address the risk of data integrity by providing a means to verify the consistency and accuracy of application data.

   Source: Adapted from community discussion — Viperhunter

   Next question

8. Question 448 · 1243 in bank

   Which of the following MOST effectively allows for disaster recovery testing without interrupting business operations?

   • AStructured walk-through
   • BSimulation testing
   • CParallel testing
   • DFull interruption testing

   Show answer

   Answer: C

   Explanation

   C. Parallel testing Parallel testing is the most effective way to allow for disaster recovery testing without interrupting business operations. In parallel testing, the organization runs a copy of its production systems in parallel with the live systems. This allows the organization to test its disaster recovery processes and procedures without disrupting the normal operations of the business. The organization can test its disaster recovery procedures in a controlled environment and identify any issues or gaps in its plans. By doing this, it can improve its disaster recovery capabilities and ensure that it is able to quickly and effectively recover its systems in the event of a disaster.

   Source: Adapted from community discussion — Broesweelies

   Next question

9. Question 449 · 1243 in bank

   The PRIMARY goal of the eradication phase in an incident response process is to:

   • Aprovide effective triage and containment of the incident.
   • Bremove the threat and restore affected systems.
   • Cmaintain a strict chain of custody.
   • Dobtain forensic evidence from the affected system.

   Show answer

   Answer: B

   Explanation

   b is right Answer Eradication Once you've contained the issue, you need to find and eliminate the root cause of the breach. This means all malware should be securely removed, systems should again be hardened and patched, and updates should be applied

   Source: Adapted from community discussion — it_expert_cism

   Next question

10. Question 450 · 1243 in bank

    Which of the following is MOST important to ensuring that incident management plans are executed effectively?

    • AManagement support and approval has been obtained.
    • BAn incident response maturity assessment has been conducted.
    • CA reputable managed security services provider has been engaged.
    • DThe incident response team has the appropriate training.

    Show answer

    Answer: D

    Explanation

    D. The incident response team has the appropriate training. Ensuring that incident management plans are executed effectively is crucial to minimize the impact of a security incident. One of the most important factors to consider is that the incident response team has the appropriate training. This includes training on incident response procedures and best practices, as well as training on the specific tools and technologies that will be used to respond to incidents. This will ensure that the team is properly prepared to handle the incident, and that they are able to respond quickly and effectively. Training also helps to build the team's confidence and expertise, which can be critical in high-pressure incident response situations. Management support and approval, conducting incident response maturity assessment, and engaging with a reputable managed security services provider are all important, but without the appropriate training, incident response team may not be able to execute the incident management plans effectively.

    Source: Adapted from community discussion — Broesweelies

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 441. 1243 questions available.