CISM practice questions 531–540

1. Question 531 · 1243 in bank

   Inadvertent disclosure of internal business information on social media is BEST minimized by which of the following?

   • AImplementing data loss prevention (DLP) solutions
   • BLimiting access to social media sites
   • CDeveloping social media guidelines
   • DEducating users on social media risks

   Show answer

   Answer: D

   Explanation

   D. Educating users on social media risks is the best way to minimize the risk of inadvertently disclosing internal business information on social media. DLP solutions can help prevent data loss, limiting access to social media sites can prevent employees from using them, but both of these methods don't prevent the employees to inadvertently disclose internal information. Developing social media guidelines can help employees understand what kind of information is appropriate to share and what isn't, but education is the key. Educating employees on the risks associated with social media use, as well as providing them with guidelines and best practices for using social media in a professional setting, can help reduce the risk of sensitive information being accidentally disclosed.

   Source: Adapted from community discussion — Broesweelies

   Next question

2. Question 532 · 1243 in bank

   Conflicting objectives are MOST likely to compromise the effectiveness of the information security process when information security management is:

   • Apartially staffed by external security consultants
   • Bcombined with the change management function
   • Creporting to the network infrastructure manager
   • Doutside of information technology

   Show answer

   Answer: C

   Explanation

   Yet another vague question. It seems the point is all the network manager will care about is availability and not integrity or confidentiality. In which case, C

   Source: Adapted from community discussion — AaronS1990

   Next question

3. Question 533 · 1243 in bank

   Which of the following is MOST important to the effectiveness of an information security program?

   • AOrganizational culture
   • BRisk management
   • CIT governance
   • DSecurity metrics

   Show answer

   Answer: A

   Explanation

   The CISM Review Manual, 27th Edition, on page 27, states that "The influence of organizational culture on the information security governance framework is significant. An organization's culture influences the behavior of its employees. This, in turn, has an effect on the security of information within the organization. A security-aware culture reduces the likelihood of incidents occurring and increases the likelihood of incidents being reported and dealt with appropriately when they do occur."

   Source: Adapted from community discussion — [Removed]

   Next question

4. Question 534 · 1243 in bank

   An information security manager has been asked to provide contract guidance from a security perspective for outsourcing the organization's payroll processing Which of the following is MOST important to address?

   • AVendor compliance with the most stringent data security regulations
   • BVendor compliance with the organization's information security policies
   • CVendor compliance with organizational service level agreement (SLA) requirements
   • DVendor compliance with recognized industry security standards

   Show answer

   Answer: B

   Explanation

   The Correct answer is (B) Vendor compliance with the organization's information security policies. Without the vendor adhering to the organization's security policies the org's critical information is surely going to be at risk. Rationale (A) Just because the vendor is complying with the most stringent data security regulations doesn't mean that it is meeting the org's security policy as the org could have some obtuse or org-specific policy that isn't covered by the regulation. (C.)SLA don't may or may not be security related. (B) is a better answer in this case. (D) Vendor compliance with recognized industry security standards doesn't mean that it will be compliant with the ORG's security policy and posture. So as you can see the only one that truly aligns with the org's security stance is (B) Vendor compliance with the organization's information security policies.

   Source: Adapted from community discussion — dark_3k03r

   Next question

5. Question 535 · 1243 in bank

   Which of the following should include contact information for representatives of equipment and software vendors?

   • ABusiness continuity plan (BCP)
   • BService level agreements (SLAs)
   • CInformation security program charter
   • DBusiness impact analysis (BIA)

   Show answer

   Answer: A

   Explanation

   The correct answer is (A) Business continuity plan [BCP] as that is the only one that has the proper contact information. Rationale: (A) a BCP has all the things required to respond to a disaster this includes the following: - Executive summary - Business impact analysis - Recovery strategies - Communication plan - Testing and maintenance (B) An SLA measures the quality of the service and has the following components in it: - Description of services - Service levels - Measurements - Reporting - Remedies - Termination As you can see there is no contact information (C) A Security charter talks about intent so this doesn't work either (D) Business Impact Analysis is a decomposition of critical processes using the following: - Identification of critical business functions and process - assessment of the impact of disruption - quantification of the impact - prioritization of critical business functions and processes - development of recovery strategies.

   Source: Adapted from community discussion — dark_3k03r

   Next question

6. Question 536 · 1243 in bank

   An organization's CIO has tasked the information security manager with drafting the charter for an information security steering committee. The committee will be comprised of the CIO, the IT shared services manager, the vice president of marketing, and the information security manager. Which of the following is the MOST significant issue with the development of this committee?

   • AThe committee consists of too many senior executives.
   • BThe committee lacks sufficient business representation.
   • CThere is a conflict of interest between the business and IT.
   • DThe CIO is not taking charge of the committee.

   Show answer

   Answer: B

   Next question

7. Question 537 · 1243 in bank

   Organization A offers e-commerce services and uses secure transport protocol! to protect Internet communication. To confirm communication with Organization A, which of the following would be the BEST for a client to verify?

   • AThe certificate of the e-commerce server
   • BThe browser's indication of SSL use
   • CThe IP address of the e-commerce server
   • DThe URL of the e-commerce server

   Show answer

   Answer: A

   Explanation

   The correct answer is (A) The certificate of the e-commerce server as validating the commerce server's identity depends on checking with the Certificate authority the server's certificate. (i.e. trusted third party just like the state department verifies your identity with a passport. Except in this case the state department is the certificate authority and the passport is the certificate) B. Phishing campaigns typically use valid SSL so this wouldn't help with that. You need to verify that you are indeed connecting to the correct server and not just any old server that has a certificate. C. The IP address is not a valid form of identification like a certificate is. D. The URL of the e-commerce server is not a valid option as DNS records could be poisoned and machines can be arp spoofed. Hell, even man-in-the-middle attacks can make this a bad form of identification. But a certificate is digitally signed and thus due to one-way cryptographic hashes and third-party validation (CA), it's a much more secure method to use option (A) certificates.

   Source: Adapted from community discussion — dark_3k03r

   Next question

8. Question 538 · 1243 in bank

   During the eradication phase of an incident response, it is MOST important to:

   • Aidentify the root cause
   • Brestore from the most recent backup
   • Cnotify affected users
   • Dwipe the affected system

   Show answer

   Answer: A

   Explanation

   The correct answer is (A) identifying the root cause. This is cause you have to know what the root cause is in order to truly eliminate the threat. If it is not properly scoped then the attacker may still be able to log in or use another system to move throughout the environment. Rationale: (B) Restoring a system from a backup does nothing to address other potential points an attacker may hop from. (C) notifying affected users without understanding the true scope of the incident may mislead users (D) wiping the affected system only stops the attacker at this particular system, but not all the other systems that haven't been identified cause the root cause hasn't been identified yet.

   Source: Adapted from community discussion — dark_3k03r

   Next question

9. Question 539 · 1243 in bank

   Which of the following should be an information security manager's FIRST course of action when a newly introduced privacy regulation affects the business?

   • AIdentify and assess the risk in the context of business objectives
   • BConsult with IT staff and assess the risk based on their recommendations
   • CUpdate the security policy based on the regulatory requirements
   • DPropose relevant controls to ensure the business complies with the regulation

   Show answer

   Answer: A

   Next question

10. Question 540 · 1243 in bank

    Which of the following should be done FIRST once a cybersecurity attack has been confirmed?

    • AIsolate the affected system
    • BPower down the system
    • CNotify senior management
    • DContact legal authorities

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 531. 1243 questions available.