CISM practice questions 461–470

1. Question 461 · 1243 in bank

   Which of the following should be the PRIMARY driver for delaying the delivery of an information security awareness program?

   • AChange in senior management
   • BHigh employee turnover
   • CEmployee acceptance
   • DRisk appetite

   Show answer

   Answer: D

   Explanation

   In the context of the CISM examination, risk appetite refers to the organization's willingness to accept or tolerate risk. If there is a significant misalignment between the risk appetite of the organization and the planned content or approach of the information security awareness program, it may be necessary to delay the program's delivery. Ensuring that the program aligns with the organization's risk appetite is crucial for its effectiveness and support from senior management.

   Source: Adapted from community discussion — mad68

   Next question

2. Question 462 · 1243 in bank

   An organization is developing a disaster recovery strategy and needs to identify each application's criticality so that the recovery sequence can be established. Which of the following is the BEST course of action?

   • ARestore the applications with the shortest recovery times first
   • BDocument the data flow and review the dependencies
   • CPerform a business impact analysis (BIA) on each application
   • DIdentify which applications contribute the most cash flow

   Show answer

   Answer: C

   Next question

3. Question 463 · 1243 in bank

   An organization's IT department needs to implement security patches. Recent reports indicate these patches could result in stability issues. Which of the following is the information security manager's BEST recommendation?

   • AResearch alternative software solutions
   • BEvaluate the patches in a test environment
   • CIncrease monitoring after patch implementation
   • DResearch compensating security controls

   Show answer

   Answer: B

   Next question

4. Question 464 · 1243 in bank

   An organization has established a bring your own device (BYOD) program. Which of the following is the MOST important security consideration when allowing employees to use personal devices for corporate applications remotely?

   • AMandatory controls for maintaining security policy
   • BMobile operating systems support
   • CSecurity awareness training
   • DSecure application development

   Show answer

   Answer: A

   Explanation

   A. Mandatory controls for maintaining security policy is the MOST important security consideration when allowing employees to use personal devices for corporate applications remotely. This includes having policies in place for device management, network access, and data encryption, as well as ensuring that employees understand and comply with these policies. The other options (B, C, and D) are also important considerations, but without strong mandatory controls in place, the security of the organization's data and systems may be at risk.

   Source: Adapted from community discussion — Broesweelies

   Next question

5. Question 465 · 1243 in bank

   What is the BEST way for an information security manager to ensure critical assets are prioritized in a new information security program?

   • AUpdate operating procedures to include new requirements.
   • BConduct security awareness training.
   • CConduct an inventory of information assets.
   • DBackup information assets and store them offsite.

   Show answer

   Answer: C

   Next question

6. Question 466 · 1243 in bank

   Which of the following would provide the MOST useful information when prioritizing controls to be added to a system?

   • AThe risk register
   • BBalanced scorecard
   • CCompliance requirements
   • DBaseline to industry standards

   Show answer

   Answer: A

   Explanation

   A. The risk register would provide the MOST useful information when prioritizing controls to be added to a system. A risk register is a document that identifies, assesses, and prioritizes potential risks to an organization's assets, and it can be used to inform the development of security controls. The other options (B, C, and D) can provide useful information as well, but a risk register would be the most direct and informative way to identify and prioritize specific controls that need to be added to a system in order to mitigate identified risks.

   Source: Adapted from community discussion — Broesweelies

   Next question

7. Question 467 · 1243 in bank

   An organization has recently acquired a smaller company located in a different geographic region. Which of the following is the BEST approach for addressing conflicts between the parent organization's security standards and local regulations affecting the acquired company?

   • AAdopt the standards of the newly acquired company
   • BGive precedence to the parent organization's standards
   • CCreate a local version of the parent organization's standards
   • DCreate a global version of the local regulations

   Show answer

   Answer: C

   Next question

8. Question 468 · 1243 in bank

   A new regulatory requirement affecting an organization's information security program is released. Which of the following should be the information security manager's FIRST course of action?

   • AConduct benchmarking
   • BPerform a gap analysis
   • CNotify the legal department
   • DDetermine the disruption to the business

   Show answer

   Answer: B

   Explanation

   Gap analysis allows you to identify the controls you have in place. Therefore, you will be able to determine if current controls mitigate the risk of the new regulations

   Source: Adapted from community discussion — dedfef

   Next question

9. Question 469 · 1243 in bank

   To gain a clear understanding of the impact that a new regulatory requirement will have on an organization's information security controls, an information security manager should FIRST:

   • Aconduct a cost-benefit analysis.
   • Bconduct a risk assessment.
   • Cinterview senior management.
   • Dperform a gap analysis.

   Show answer

   Answer: D

   Explanation

   Clearly it is B, how do you gain a clear understanding of the impact of new regulations: perform a risk assessment. If the question was: What is the first step on getting compliant? Then a gap analysis would be correct. But not in this case.

   Source: Adapted from community discussion — Broesweelies

   Next question

10. Question 470 · 1243 in bank

    What should be an information security manager's FIRST step when developing a business case for a new intrusion detection system (IDS) solution?

    • ACalculate the total cost of ownership (TCO).
    • BDefine the issues to be addressed.
    • CPerform a cost-benefit analysis.
    • DConduct a feasibility study.

    Show answer

    Answer: B

    Explanation

    Defining the issues to be addressed is the first step in developing a business case for a new intrusion detection system (IDS) solution because it allows the information security manager to clearly understand and communicate the specific problems that the organization is facing with its current security controls. Once the issues have been identified, the information security manager can then evaluate different solutions to determine which one is the best fit to address those issues. This will help in creating a more effective and compelling case for the new IDS solution, it also allows the manager to demonstrate the potential benefits and cost savings of the new solution to the organization, and helps in gaining the support of stakeholders.

    Source: Adapted from community discussion — Broesweelies

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 461. 1243 questions available.