Question 511 · 1243 in bank
Which of the following should be the PRIMARY basis for an information security strategy?
Show answer
Answer: C
Certified Information Security Manager1,243 questions across 125 pages are complete and free, with no account or card.
1243 questions in this bank
Free access · progress saved on this device
Which of the following should be the PRIMARY basis for an information security strategy?
Answer: C
What should an information security manager do FIRST to establish a roadmap for security investments?
Answer: B
The correct answer is B. Gain a thorough understanding of the organization's operating processes. Before investing in security, an information security manager should understand the organization's operating processes, including the systems and technologies that support them, the data and information that flow through them, and the risks that may impact them. This will provide a foundation for identifying the most critical security needs and for developing a roadmap for security investments that align with the organization's objectives. Without this understanding, cost-benefit analyses, business cases, and strategic alignment may be misguided and ineffective.
Source: Adapted from community discussion — Abhey
Which of the following is the MOST effective way to detect security incidents?
Answer: B
When supporting an organization's privacy officer which of the following is the information security manager's PRIMARY role regarding privacy requirements?
Answer: A
Ensuring appropriate controls are in place is a fundamental responsibility in supporting privacy requirements. The information security manager plays a key role in implementing and maintaining security controls to protect the privacy of sensitive information. This includes measures such as access controls, encryption, data classification, and other security safeguards to safeguard private data. While monitoring the transfer of private data (option B), determining data classification (option C), and conducting privacy awareness programs (option D) are also important activities, the primary focus of the information security manager is to ensure that the necessary security controls are implemented to protect privacy in accordance with legal and regulatory requirements.
Source: Adapted from community discussion — Viperhunter
Which of the following should be the PRIMARY outcome of an information security program?
Answer: B
B is correct according to CISM RM 16th 3.1.5 - Stategic alignment is one of the Outcomes of Information Security Program
Source: Adapted from community discussion — beever
Which of the following is the MOST effective way to help ensure web developers understand the growing severity of web application security risks?
Answer: D
I picked Option B as well first. But D does make more sense. The question is talking about most effective way to make them "understand" the risks. Training would it.
Source: Adapted from community discussion — Dravidian
When collecting admissible evidence, which of the following is the MOST important requirement?
Answer: C
When collecting admissible evidence, the most important requirement is the chain of custody (option C). This refers to the chronological documentation or paper trail that records the sequence of custody, control, transfer, analysis, and disposition of physical or electronic evidence. A proper chain of custody ensures that the integrity of the evidence is maintained and that it can be authenticated in a court of law.
Source: Adapted from community discussion — Broesweelies
Which of the following is the MOST effective way to detect information security incidents?
Answer: D
Regular testing of the incident response program, including simulations and exercises, is a proactive and systematic approach to assessing the effectiveness of an organization's ability to detect and respond to security incidents. This testing helps identify weaknesses, strengths, and areas for improvement in the incident detection and response process. Option B
Source: Adapted from community discussion — iTmarcus
During the due diligence phase of an acquisition, the MOST important course of action for an information security manager is to:
Answer: C
Agreed> For Third-party risk mgt programs, it is important for Information security to conduct risk assessment and document all findings for all short-listed vendors which in turns help procuremnent/businness to make an informed decision for proper selcetion.
Source: Adapted from community discussion — Funshykay
After the occurrence of a major information security incident, which of the following will BEST help an information security manager determine corrective actions?
Answer: D
The keyword here is corrective actions which means making improvements which will happen as part of lessons learned or post incident review/assessment, so the best answer is D
Source: Adapted from community discussion — acf4e9a
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISM practice, question 511. 1243 questions available.
Version 1.0.0. How we source questions