CISM practice questions 501–510

1. Question 501 · 1243 in bank

   Which of the following is MOST effective in reducing the financial impact following a security breach leading to data disclosure?

   • ABackup and recovery strategy
   • BA business continuity plan (BCP)
   • CA data loss prevention (DLP) solution
   • DAn incident response plan

   Show answer

   Answer: D

   Explanation

   D. An incident response plan is the most effective in reducing the financial impact following a security breach leading to data disclosure. An incident response plan outlines the steps to be taken in the event of a security incident, including the roles and responsibilities of different teams, procedures for containing and mitigating the incident, and procedures for communicating with stakeholders. This allows for a quick and organized response to a security incident, which can help minimize the damage and reduce the financial impact of the incident.

   Source: Adapted from community discussion — Broesweelies

   Next question

2. Question 502 · 1243 in bank

   Which of the following is the MOST effective way to prevent information security incidents?

   • ADeploying intrusion detection tools in the network environment
   • BDeploying a consistent incident response approach
   • CImplementing a security information and event management (SIEM) tool
   • DImplementing a security awareness training program for employees

   Show answer

   Answer: D

   Explanation

   D. Implementing a security awareness training program for employees. While all of the options (A, B, C, and D) play important roles in an overall information security strategy, educating employees about security risks and best practices through a security awareness training program is often considered the most effective preventive measure. Security incidents often result from human error or lack of awareness, and a well-designed training program can help employees recognize potential threats, understand how to respond to them, and take proactive measures to prevent security breaches. An educated and security-conscious workforce can significantly reduce the likelihood of security incidents.

   Source: Adapted from community discussion — oluchecpoint

   Next question

3. Question 503 · 1243 in bank

   An organization has identified an increased threat of external brute force attacks in its environment. Which of the following is the MOST effective way to mitigate this risk to the organization's critical systems?

   • AIncrease the frequency of log monitoring and analysis.
   • BImplement a security information and event management system (SIEM).
   • CIncrease the sensitivity of intrusion detection systems.
   • DImplement multi-factor authentication.

   Show answer

   Answer: D

   Explanation

   Multi-factor authentication adds an additional layer of security by requiring users to provide multiple forms of identification before granting access. This makes it significantly more challenging for attackers to gain unauthorized access through brute force attacks, even if they manage to obtain or guess passwords. While options like increasing the frequency of log monitoring and analysis (option A), implementing a security information and event management system (SIEM) (option B), and increasing the sensitivity of intrusion detection systems (option C) are valuable security measures, multi-factor authentication is a highly effective control specifically designed to address the risk of unauthorized access through brute force attacks.

   Source: Adapted from community discussion — Viperhunter

   Next question

4. Question 504 · 1243 in bank

   Which of the following is the MOST important consideration when updating procedures for managing security devices?

   • AUpdates based on changes in risk, technology, and process
   • BReview and approval of procedures by management
   • CUpdates based on the organization's security framework
   • DNotification to management of the procedural changes

   Show answer

   Answer: A

   Next question

5. Question 505 · 1243 in bank

   Which of the following is the MAJOR advantage of conducting a post-incident review? The review:

   • Ahelps develop business cases for security monitoring tools
   • Bprovides continuous process improvement
   • Cfacilitates reporting on actions taken during the incident process
   • Dhelps identify current and desired level of risk

   Show answer

   Answer: B

   Next question

6. Question 506 · 1243 in bank

   A modification to a critical system was not detected until the system was compromised. Which of the following will BEST help to prevent future occurrences?

   • AConducting continuous network monitoring
   • BImproving the change control process
   • CConducting continuous risk assessments
   • DBaselining server configurations

   Show answer

   Answer: B

   Explanation

   The Correct answer is B: Improving the change control process as that is the only one that fixes the issue. Rationale: (A) Is incorrect cause monitoring doesn't fix anything (C) Is incorrect cause monitoring doesn't fix anything (D) Baselines are great, but it doesn't capture any new changes.

   Source: Adapted from community discussion — dark_3k03r

   Next question

7. Question 507 · 1243 in bank

   What would be the MAIN purpose of an immediate post-incident review after a comprehensive test of the incident response plan?

   • ATo reduce costs associated with incident response efforts
   • BTo determine ways to improve incident response plan processes
   • CTo document weaknesses for the next incident response plan test
   • DTo revalidate incident response plan activities

   Show answer

   Answer: B

   Explanation

   B is talking about the solution (improvement), C is talking about writing down issues. So B is more comprehensive answer.

   Source: Adapted from community discussion — AlexJacobson

   Next question

8. Question 508 · 1243 in bank

   An organization recently activated its business continuity plan (BCP). All employees were notified during the event, but some did not fully follow the communications plan. What is the BEST way to prevent a recurrence?

   • APerform tabletop testing with appropriate employees
   • BReprimand employees for not following the plan
   • CEnhance external communication instructions in the BCP
   • DIncorporate BCP communication expectations in job descriptions

   Show answer

   Answer: A

   Explanation

   The BEST way to prevent a recurrence of employees not fully following the communications plan during a business continuity event is to perform tabletop testing with appropriate employees. Tabletop exercises are designed to simulate a disaster or business interruption scenario, and they provide an opportunity to test communication and response procedures, identify weaknesses, and improve the BCP. By conducting tabletop testing, the organization can identify areas that need improvement and address them before the next event occurs. Reprimanding employees may not address the root cause of the problem and could create a negative culture of blame, while enhancing external communication instructions in the BCP and incorporating BCP communication expectations in job descriptions may help but may not be as effective as testing the plan in a realistic scenario.

   Source: Adapted from community discussion — Abhey

   Next question

9. Question 509 · 1243 in bank

   Which of the following is MOST helpful in determining an organization's current capacity to mitigate risks?

   • ACapability maturity model
   • BVulnerability assessment
   • CBusiness impact analysis (BIA)
   • DIT security risk and exposure

   Show answer

   Answer: A

   Explanation

   CISM Exam Prep Guide by Hemang Doshi, page 45: A maturity model is a tool that helps the organization assess the current effectiveness of a process and determine what capabilities they need to improve their performance. Capability maturity models (CMMs) are useful to determine the maturity level of governance processes.

   Source: Adapted from community discussion — AlexJacobson

   Next question

10. Question 510 · 1243 in bank

    Which of the following is the BEST way to present the status of an information security program to senior management?

    • ADetail latest security trends
    • BDisplay concise dashboards
    • CProvide detailed information regarding risk exposure
    • DReport on root causes of security incidents

    Show answer

    Answer: B

    Explanation

    B- Display concise dashboards. The rest of the answers are too detailed and senior management does not have time for such details.

    Source: Adapted from community discussion — Nillanash

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 501. 1243 questions available.