CISM practice questions 451–460

1. Question 451 · 1243 in bank

   To inform a risk treatment decision, which of the following should the information security manager compare with the organization's risk appetite?

   • AGap analysis results
   • BLevel of risk treatment
   • CConfiguration parameters
   • DLevel of residual risk

   Show answer

   Answer: D

   Explanation

   D. Level of residual risk. When informing a risk treatment decision, the information security manager should compare the level of residual risk with the organization's risk appetite. Residual risk is the risk that remains after risk treatment has been applied. By comparing the level of residual risk to the organization's risk appetite, the information security manager can determine if the risk is acceptable or if additional treatment is required. The organization's risk appetite is a statement of the level of risk that the organization is willing to tolerate and accept. By understanding the residual risk, the information security manager can make informed decisions on risk treatment options and prioritize them accordingly. It is important to note that other factors such as gap analysis results, level of risk treatment and configuration parameters are important to consider, but they don't provide a clear picture of the risk level that the organization is willing to accept.

   Source: Adapted from community discussion — Broesweelies

   Next question

2. Question 452 · 1243 in bank

   Which of the following would be the MOST effective countermeasure against malicious programming that rounds down transaction amounts and transfers them to the perpetrator's account?

   • ASet up an agent to run a virus-scanning program across platforms.
   • BEnsure that proper controls exist for code review and release management.
   • CImplement controls for continuous monitoring of middleware transactions.
   • DApply the latest patch programs to the production operating systems.

   Show answer

   Answer: B

   Next question

3. Question 453 · 1243 in bank

   Which of the following is the PRIMARY responsibility of an information security governance committee?

   • AReviewing the information security risk register
   • BApproving changes to the information security strategy
   • CDiscussing upcoming information security projects
   • DReviewing monthly information security metrics

   Show answer

   Answer: B

   Explanation

   Yes, approving changes to the information security strategy is generally considered to be the primary responsibility of an information security governance committee. The information security governance committee is responsible for overseeing and guiding the overall information security program, including the development and maintenance of the information security strategy.

   Source: Adapted from community discussion — jaiz

   Next question

4. Question 454 · 1243 in bank

   The MOST important information for influencing management's support of information security is:

   • Aa report of a successful attack on a competitor.
   • Ba demonstration of alignment with the business strategy.
   • Can identification of the overall threat landscape.
   • Dan identification of organizational risks.

   Show answer

   Answer: B

   Next question

5. Question 455 · 1243 in bank

   What should be an information security manager's MOST important consideration when reviewing a proposed upgrade to a business unit's production database?

   • AEnsuring the application inventory is updated
   • BEnsuring residual risk is within appetite
   • CEnsuring a cost-benefit analysis is completed
   • DEnsuring senior management is aware of associated risk

   Show answer

   Answer: B

   Explanation

   The information security manager's MOST important consideration when reviewing a proposed upgrade to a business unit's production database is ensuring residual risk is within the organization's risk appetite. Upgrades to production databases can pose a significant risk to an organization's data, and it is essential to ensure that any residual risk is acceptable to the organization. A cost-benefit analysis and updating the application inventory are also essential considerations, but they are secondary to ensuring that residual risk is within the organization's risk appetite. Similarly, senior management should be made aware of the associated risk, but this is not the most important consideration.

   Source: Adapted from community discussion — Abhey

   Next question

6. Question 456 · 1243 in bank

   Prior to implementing a bring your own device (BYOD) program, it is MOST important to:

   • Areview currently utilized applications.
   • Bsurvey employees for requested applications.
   • Cselect mobile device management (MDM) software.
   • Ddevelop an acceptable use policy.

   Show answer

   Answer: D

   Next question

7. Question 457 · 1243 in bank

   When developing an incident escalation process, the BEST approach is to classify incidents based on:

   • Atheir root causes.
   • Binformation assets affected.
   • Crecovery point objectives (RPOs).
   • Destimated time to recover.

   Show answer

   Answer: B

   Explanation

   B. Information assets affected. Classifying incidents based on the information assets affected helps prioritize incidents according to their potential impact on the organization's data and operations. This allows for a more targeted and effective incident response, ensuring that critical assets are protected and restored in a timely manner. While considering root causes, recovery point objectives (RPOs), and estimated time to recover are important aspects of incident management, they are usually secondary to understanding the impact on information assets when determining the escalation process.

   Source: Adapted from community discussion — oluchecpoint

   Next question

8. Question 458 · 1243 in bank

   Deciding the level of protection a particular asset should be given is BEST determined by:

   • Athe corporate risk appetite.
   • Ba risk analysis.
   • Ca threat assessment.
   • Da vulnerability assessment.

   Show answer

   Answer: B

   Explanation

   At 1st i thought A. After re-reading the question, which "should" be given vs "will" be given. "Should be given" will be determined by Risk Analysis. "Will be given" will be risk appetite. So B for me.

   Source: Adapted from community discussion — AWSgenio

   Next question

9. Question 459 · 1243 in bank

   Which of the following is the PRIMARY objective of defining a severity hierarchy for security incidents?

   • ATo streamline the risk analysis process
   • BTo facilitate the classification of an organization's IT assets
   • CTo prioritize available incident response resources
   • DTo facilitate root cause analysis of incidents

   Show answer

   Answer: C

   Next question

10. Question 460 · 1243 in bank

    For an enterprise implementing a bring your own device (BYOD) program, which of the following would provide the BEST security of corporate data residing on unsecured mobile devices?

    • ADevice certification process
    • BAcceptable use policy
    • CContainerization solution
    • DData loss prevention (DLP)

    Show answer

    Answer: C

    Explanation

    C. Containerization solution Containerization separates corporate data and applications from the personal data and apps on the mobile device by creating a secure and isolated container. This container ensures that corporate data is protected and can be remotely managed or wiped without affecting the personal data on the device. It offers a strong layer of security for BYOD programs because it effectively separates and protects corporate data while allowing employees to use their personal devices for work.

    Source: Adapted from community discussion — oluchecpoint

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 451. 1243 questions available.