Certified Information Security Manager1,243 questions across 125 pages are complete and free, with no account or card.
1243 questions in this bank
Free access · progress saved on this device
An organization wants to ensure its confidential data is isolated in a multi-tenanted environment at a well-known cloud service provider. Which of the following is the BEST way to ensure the data is adequately protected?
Answer: D
If the option is there to get an audit of the providers security controls, then that would absolutely be the BEST way to ensure proper protections are in place.
Source: Adapted from community discussion — kortcl
The BEST indication of a change in risk that may negatively impact an organization is an increase in the number of:
Answer: A
The correct answer is A, because if it is bad enough for a user to notice then that means it's painfully obvious and impacting the organization in a negative way. Rationale B. malware infections may be detected, but that doesn't mean they were successful. C. excessive alerts triggered by a SIEM could be a sign of false positives D. excessive events logged by the intrusion detection system (IDS) could also point to false positives as well.
Source: Adapted from community discussion — dark_3k03r
Which of the following is MOST important to consider when determining the criticality and sensitivity of an information asset?
Answer: D
To prevent ransomware attacks, it is MOST important to ensure:
Answer: B
I will go with B. the question does not state to recover from ransomware attack but to prevent. I can't figure out how data backup and restoration process helps stop a ransomware attack from happening
Source: Adapted from community discussion — Funshykay
A security policy exception is leading to an unexpected increase in the number of alerts about suspicious Internet traffic on an organization's network. Which of the following is the BEST course of action?
Answer: B
B. Present a risk analysis with recommendations to senior management. If a security policy exception is leading to an unexpected increase in the number of alerts about suspicious Internet traffic on an organization's network, the best course of action would be to conduct a risk analysis to determine the potential impact of the exception on the organization and present recommendations to senior management. The risk analysis should include an assessment of the likelihood and potential impact of the increased traffic, as well as an evaluation of the existing security controls and their effectiveness in mitigating the risk. Based on the results of the analysis, recommendations can be made to senior management on how to address the issue, such as implementing additional security controls or revising the security policy.
Source: Adapted from community discussion — Broesweelies
The MAIN purpose of documenting information security guidelines for use within a large, international organization is to:
Answer: A
I vote A. Keywords being "preferred practices", meaning "not mandatory, operational-level stuff". All other answers would require policies being implemented.
Source: Adapted from community discussion — AlexJacobson
Senior management has launched an enterprise-wide initiative to streamline internal processes to reduce costs, including security processes. What should the information security manager rely on MOST to allocate resources efficiently?
Answer: B
The Correct answer is B: Risk Classification. The reason is that B is the only one that allows you to effectively compare resources against another using a standardized set of criteria. Rationale: A. Capability maturity assessment can be used to identify areas where the organization needs to improve its security posture, but it does not provide information on the relative importance of different risks. C. Return on investment (ROI) is a financial instrument used to justify the purchase of something but says nothing about the relative risks and how to address them. D. Internal audit reports provide the findings, but does not provide for prioritization of risk.
Source: Adapted from community discussion — dark_3k03r
Which of the following would be of GREATEST assistance in determining whether to accept residual risk of a critical security system?
Answer: D
D. Cost-benefit analysis of mitigating controls involves evaluating the costs of implementing security measures (such as controls and safeguards) against the potential benefits or reduction in risk. This analysis helps in determining whether the cost of mitigating the residual risk is justified by the expected reduction in risk. It takes into account both financial and security aspects, making it the most comprehensive approach for deciding whether to accept residual risk.
Source: Adapted from community discussion — oluchecpoint
Which of the following should an information security manager do FIRST to address complaints that a newly implemented security control has slowed business operations?
Answer: D
An information security manager is preparing incident response plans for an organization that processes personal and financial information. Which of the following is the MOST important consideration?
Answer: C
C. Identifying regulatory requirements All the options are important, identifying regulatory requirements takes precedence because it directly relates to legal obligations and potential legal consequences. Processing personal and financial information often involves compliance with a range of laws and regulations, such as GDPR (General Data Protection Regulation), HIPAA (Health Insurance Portability and Accountability Act), or various financial industry regulations (e.g., PCI DSS for payment card data). Failing to comply with these regulations can lead to severe penalties, fines, and reputational damage.
Source: Adapted from community discussion — oluchecpoint
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISM practice, question 471. 1243 questions available.
Version 1.0.0. How we source questions