CISM practice questions 41–50

1. Question 41 · 1243 in bank

   Which of the following BEST enables an organization to enhance its incident response plan processes and procedures?

   • AInformation security audits
   • BSecurity risk assessments
   • CLessons learned analysis
   • DKey performance indicators (KPIs)

   Show answer

   Answer: C

   Next question

2. Question 42 · 1243 in bank

   Which of the following is BEST used to determine the maturity of an information security program?

   • AOrganizational risk appetite
   • BRisk assessment results
   • CSecurity metrics
   • DSecurity budget allocation

   Show answer

   Answer: C

   Next question

3. Question 43 · 1243 in bank

   Which of the following should be done FIRST when developing an information security strategy that is aligned with organizational goals?

   • AEstablish a security risk framework with key risk indicators (KRIs).
   • BDetermine information security's impact on the achievement of organizational goals.
   • CAssess information security risk associated with the organizational goals
   • DSelect information security projects related to the organizational goals.

   Show answer

   Answer: C

   Explanation

   Going with C. The B says "impact on the achievement of organizational goals.". On the "achievement of organizational goals"? does not make sense. C seems more good, it talks about "Assess"

   Source: Adapted from community discussion — Marcelus1714

   Next question

4. Question 44 · 1243 in bank

   A business impact analysis (BIA) BEST enables an organization to establish:

   • Aannualized loss expectancy (ALE).
   • Brecovery methods.
   • Crestoration priorities.
   • Dtotal cost of ownership (TCO).

   Show answer

   Answer: C

   Explanation

   C - A BIA assesses the impact of disruptions on business processes. By identifying critical functions and their dependencies, an organization can prioritize restoration efforts effectively.

   Source: Adapted from community discussion — Booict

   Next question

5. Question 45 · 1243 in bank

   Which of the following is the PRIMARY objective of developing an information security program that aligns with the information security strategy?

   • ATo define the resources required to achieve information security goals
   • BTo define a bottom-up approach for implementing information security policies
   • CTo define standards to be implemented
   • DTo define risk mitigation plans for security technologies

   Show answer

   Answer: A

   Next question

6. Question 46 · 1243 in bank

   Which of the following is MOST important to include in an information security framework?

   • AGuidance for designing information security controls
   • BInformation security organizational structure
   • CIndustry benchmarks of information security metrics
   • DInformation security risk assessment

   Show answer

   Answer: D

   Next question

7. Question 47 · 1243 in bank

   The PRIMARY goal of conducting a business impact analysis (BIA) as part of an overall continuity planning process is to:

   • Aobtain the support of executive management.
   • Bdocument the disaster recovery process.
   • Cmap the business process to supporting IT and other corporate resources.
   • Didentify critical processes and the degree of reliance on support services.

   Show answer

   Answer: D

   Next question

8. Question 48 · 1243 in bank

   An organization learns that a service provider experienced a breach last month and did not notify the organization. Which of the following should be the information security manager's FIRST course of action?

   • ATerminate the provider contract.
   • BConduct a business impact analysis (BIA).
   • CInform senior management.
   • DReview the provider contract.

   Show answer

   Answer: D

   Explanation

   D. Review the provider contract.Terminating the provider contract (Option A) might be premature without understanding the contractual obligations and the specific details of the breach. Conducting a BIA (Option B) is important but secondary to understanding the legal and contractual aspects. Informing senior management (Option C) is a crucial step but should typically follow an initial assessment and understanding of the situation based on the contract review.

   Source: Adapted from community discussion — jcisco123

   Next question

9. Question 49 · 1243 in bank

   Which of the following approaches to communication with senior management BEST enables an information security manager to maximize the effectiveness of the information security program?

   • AReporting on industry security threats with potential impact to business objectives
   • BConducting periodic one-on-one meetings to align security with business objectives
   • CParticipating in operational review meetings to discuss daily operations and dependencies
   • DProviding regular status of updates to security policies and standards

   Show answer

   Answer: B

   Next question

10. Question 50 · 1243 in bank

    Which of the following control types should be considered FIRST for aligning employee behavior with an organization's information security objectives?

    • AAdministrative security controls
    • BAccess security controls
    • CTechnical security controls
    • DPhysical security controls

    Show answer

    Answer: A

    Explanation

    Administrative security controls provides NDA to be signed, Security policies to be adhered to etc. This is critical for employee to understand upon commencement of employment on what is expected of the employee in relation to security.

    Source: Adapted from community discussion — yottabyte

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 41. 1243 questions available.