CISM practice questions 491–500

1. Question 491 · 1243 in bank

   Which of the following is the BEST method for determining whether a firewall has been configured to provide a comprehensive perimeter defense?

   • AA port scan of the firewall from an internal source
   • BA simulated denial of service (DoS) attack against the firewall
   • CA validation of the current firewall rule set
   • DA ping test from an external source

   Show answer

   Answer: C

   Explanation

   The correct answer is C. A validation of the current firewall rule set. Explanation: Among the options provided, validating the current firewall rule set is the best method for determining whether a firewall has been configured to provide a comprehensive perimeter defense. Here's why this option is the best method: C. A validation of the current firewall rule set: This involves reviewing and analyzing the existing firewall rules to ensure they align with the organization's security policies and objectives. By validating the rule set, you can identify any misconfigurations, unnecessary rules, or potential security gaps. This method directly assesses the effectiveness of the firewall's configuration in providing comprehensive perimeter defense.

   Source: Adapted from community discussion — Hugo1717

   Next question

2. Question 492 · 1243 in bank

   Which of the following is the BEST way for an organization to determine the maturity level of its information security program?

   • AReview the results of information security awareness testing.
   • BValidate the effectiveness of implemented security controls.
   • CBenchmark the information security policy against industry standards.
   • DTrack the trending of information security incidents.

   Show answer

   Answer: C

   Explanation

   Benchmarking the information security policy against industry standards is a comprehensive approach that allows organizations to assess the maturity of their information security program in comparison to established best practices and industry benchmarks. This involves evaluating the organization's policies, processes, and controls against recognized standards such as ISO/IEC 27001, NIST Cybersecurity Framework, or other relevant frameworks. While options like reviewing the results of information security awareness testing (option A), validating the effectiveness of implemented security controls (option B), and tracking the trending of information security incidents (option D) are important activities, benchmarking against industry standards provides a broader and more systematic evaluation of the overall maturity of the information security program.

   Source: Adapted from community discussion — Viperhunter

   Next question

3. Question 493 · 1243 in bank

   To ensure that a new application complies with information security policy, the BEST approach is to:

   • Aperform a vulnerability analysis
   • Breview the security of the application before implementation
   • Cintegrate security functionality during the development stage
   • Dperiodically audit the security of the application

   Show answer

   Answer: C

   Explanation

   Badly written question, as others have stated already...not enough information to choose between B or C. Anyway, I think this question is meant to test you on the SDLC so in that case, you integrate security into it as early as possible (in this case, development phase, although it should be even earlier, in the design phase). So I vote C.

   Source: Adapted from community discussion — AlexJacobson

   Next question

4. Question 494 · 1243 in bank

   Which of the following is the PRIMARY driver for determining the classification of application systems?

   • AThe cost of repairing damage to system elements
   • BThe extent that compromise can affect revenue
   • CThe cost to implement regulatory requirements
   • DControlling access based on the need to know

   Show answer

   Answer: B

   Explanation

   According to the CISM Review Manual, 15th Edition: "Information security policies must address asset classification and handling, including the definition and relative hierarchy of classifications... Organizations should also implement procedures to address authorization based on a need-to-know/need-to-use basis, especially for highly sensitive data."

   Source: Adapted from community discussion — [Removed]

   Next question

5. Question 495 · 1243 in bank

   Which of the following departments should be responsible for classifying customer relationship management (CRM) system data on a database server maintained by IT?

   • ASales
   • BInformation security
   • CHuman resources (HR)
   • DIT

   Show answer

   Answer: A

   Explanation

   Classification of data always done by data owner. In this case data in CRM system is certainly owned by sales function. IT function just supports the custodian role and should not be classifying the data so the most appropriate option is A sales department.

   Source: Adapted from community discussion — acf4e9a

   Next question

6. Question 496 · 1243 in bank

   What is the role of the information security manager in finalizing contract negotiations with service providers?

   • ATo perform a risk analysis on the outsourcing process
   • BTo obtain a security standard certification from the provider
   • CTo update security standards for the outsourced process
   • DTo ensure that clauses for periodic audits are included

   Show answer

   Answer: D

   Explanation

   D. To ensure that clauses for periodic audits are included. The information security manager is responsible for ensuring that the contract with the service provider includes appropriate security measures to protect the organization's information assets. This may include clauses that require the service provider to undergo periodic security audits to ensure compliance with security standards, policies, and procedures. The information security manager may also work with legal and procurement teams to negotiate and include relevant security clauses in the contract to protect the organization's interests. Additionally, the information security manager may collaborate with other stakeholders to perform a risk analysis on the outsourcing process, obtain security standard certifications from the provider, and update security standards for the outsourced process as needed. However, ensuring that clauses for periodic audits are included is a key responsibility of the information security manager in contract negotiations with service providers to ensure that security requirements are met and maintained throughout the duration of the contract.

   Source: Adapted from community discussion — cheesesteak

   Next question

7. Question 497 · 1243 in bank

   Which of the following is the BEST justification for making a revision to a password policy?

   • AA risk assessment
   • BIndustry best practice
   • CAudit recommendation
   • DVendor recommendation

   Show answer

   Answer: A

   Next question

8. Question 498 · 1243 in bank

   Which of the following is MOST important for an information security manager to verify before conducting full-functional continuity testing?

   • AIncident response and recovery plans are documented in simple language
   • BCopies of recovery and incident response plans are kept offsite
   • CTeams and individuals responsible for recovery have been identified
   • DRisk acceptance by the business has been documented.

   Show answer

   Answer: C

   Explanation

   While having documented risk acceptance by the business is important, it is more critical for the information security manager to verify that the teams and individuals responsible for recovery have been identified. This is because in the event of a disaster or interruption, the focus should be on restoring normal operations as quickly as possible, and having identified and trained teams and individuals in place will aid in this process. If the responsible individuals are not known, this can result in delays and confusion during the recovery process.

   Source: Adapted from community discussion — Broesweelies

   Next question

9. Question 499 · 1243 in bank

   The BEST indicator the effectiveness of a security program conducted for users is an increase in the number of:

   • Asocial engineering attempts reported to information security
   • Brequests for more security training information
   • Cparticipants in the security awareness program
   • Dthreats detected by information security staff

   Show answer

   Answer: A

   Next question

10. Question 500 · 1243 in bank

    When preventive controls to appropriately mitigate risk are not feasible, which of the following is the MOST important action for the information security manager?

    • AIdentifying unacceptable risk levels
    • BAssessing vulnerabilities
    • CEvaluating potential threats
    • DManaging the impact

    Show answer

    Answer: D

    Explanation

    Risk is a function of probability and impact. When mitigating risk there are only two things that can be mitigated to reduce risk: Probability and impact. The probability is reduced by preventative controls. This means that the only thing left to reduce is impact option (D). Rationale: (A) The identification has already been done (B) the vulnerability has already been identified that is how the controls were selected to mitigate the risk as best as possible. (C) The threat has already been identified as controls has already been applied.

    Source: Adapted from community discussion — dark_3k03r

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 491. 1243 questions available.