CISM practice questions 551–560

1. Question 551 · 1243 in bank

   An organization that has outsourced its incident management capabilities just discovered a significant privacy breach by an unknown attacker. Which of the following is the MOST important action of the information security manager?

   • AFollow the outsourcer's response plan
   • BRefer to the organization's response plan
   • CNotify the outsourcer of the privacy breach
   • DAlert the appropriate law enforcement authorities

   Show answer

   Answer: B

   Explanation

   The Correct Answer is (B) Refer to the organization's response plan. The first thing an organization should do is look at their incident response plan. Rationale: A. The organization can not outsource its responsibility to another organization. C. The outsourcer should only be contacted once the organization has been prepared and has a plan. D. Alert the appropriate law enforcement authorities should be part of the organization's incident response plan. This should be carefully evaluated cause once the organization calls the police the org loses control of the situation and thus should only be called once activated by the incident response plan.

   Source: Adapted from community discussion — dark_3k03r

   Next question

2. Question 552 · 1243 in bank

   Which of the following would BEST support an information security manager's efforts to obtain management approval for an identity and access management (IAM) system implementation?

   • AA recent security incident involving access authorization
   • BAn established security policy with access management requirements
   • CA third-party audit finding based on regulatory requirements
   • DA business case proposal for the solution

   Show answer

   Answer: D

   Next question

3. Question 553 · 1243 in bank

   Internal audit has reported a number of information security issues that are not in compliance with regulatory requirements. What should the information security manager do FIRST?

   • ACreate a security exception
   • BAssess the risk to business operations
   • CPerform a vulnerability assessment
   • DPerform a gap analysis to determine needed resources

   Show answer

   Answer: B

   Explanation

   Assess the extend of the risk in a first step (B). If the resulting risk is not acceptable, perform a gap analysis to assess the as-is state and the desired state. Doing so will show you what steps and resources are needed to close the gap.

   Source: Adapted from community discussion — Josef4CISM

   Next question

4. Question 554 · 1243 in bank

   An organization is about to purchase a rival organization. The PRIMARY reason for performing information security due diligence prior to making the purchase is to:

   • Adetermine the security exposures
   • Bassess the ability to integrate the security department operations
   • Censure compliance with international standards
   • Devaluate the security policy and standards

   Show answer

   Answer: A

   Next question

5. Question 555 · 1243 in bank

   When considering whether to adopt bring your own device (BYOD), it is MOST important for the information security manager to ensure that:

   • Athe applications are tested prior to implementation
   • Bsecurity controls are applied to each device when joining the network
   • Cusers have read and signed acceptable use agreements
   • Dbusiness leaders have an understanding of security risks

   Show answer

   Answer: D

   Explanation

   When considering the adoption of bring your own device (BYOD), the information security manager needs to ensure that security risks are well understood and mitigated. Therefore, the most important consideration is that business leaders have an understanding of security risks.

   Source: Adapted from community discussion — chanke

   Next question

6. Question 556 · 1243 in bank

   The security baselines of an organization should be based on:

   • Aprocedures.
   • Bstandards.
   • Cpolicies.
   • Dguidelines.

   Show answer

   Answer: B

   Next question

7. Question 557 · 1243 in bank

   Which of the following would be MOST effective in changing the security culture and behavior of staff?

   • APromoting the information security mission within the enterprise
   • BEnforcing strict technical information security controls
   • CAuditing compliance with the information security policy
   • DDeveloping procedures to enforce the information security policy

   Show answer

   Answer: A

   Explanation

   Promoting the information security mission within the enterprise (option A) goes beyond just developing procedures. It focuses on creating awareness, engaging employees, and fostering a security-conscious mindset. By promoting the mission, organizations can encourage employees to actively participate in security initiatives, take ownership of information security, and understand the role they play in protecting sensitive data. This approach can lead to a more sustainable and effective change in security culture and behavior.

   Source: Adapted from community discussion — wello

   Next question

8. Question 558 · 1243 in bank

   Labeling information according to its security classification:

   • Areduces the need to identify baseline controls for each classification.
   • Breduces the number and type of countermeasures required.
   • Cenhances the likelihood of people handling information securely.
   • Daffects the consequences if information is handled insecurely.

   Show answer

   Answer: C

   Explanation

   No. You are wrong. The consequences will occur regardless of whether or not the data is classified AND it's mishandled. Should be C.

   Source: Adapted from community discussion — CarlLimps

   Next question

9. Question 559 · 1243 in bank

   Which of the following MUST be performed once risk has been accepted?

   • AReassess the risk on a regular basis.
   • BCalculate the business impact of acceptance.
   • CFlag the risk to avoid future reassessment.
   • DRemove the risk from the risk register.

   Show answer

   Answer: A

   Explanation

   A. Reassess the risk on a regular basis AIO Page 179 "After an organization accepts a risk, instead of closing the matter for perpetuity, it should review the risk at least annually (or after a significant event that would change the conditions surrounding the accepted risk) for the following reasons: • The value of the asset may have changed during the year. • The value of the business activity related to the asset may have changed during the year. • The potency of threats may have changed during the year, potentially leading to a higher risk rating. • The cost of mitigation may have changed during the year, potentially leading to greater feasibility for risk mitigation or transfer."

   Source: Adapted from community discussion — Jess20

   Next question

10. Question 560 · 1243 in bank

    Which of the following is the FIRST step in developing a business continuity plan (BCP)?

    • AIdentify critical business processes.
    • BDetermine the business recovery strategy
    • CDetermine available resources
    • DIdentify the applications with the shortest recovery time objectives (RTOs)

    Show answer

    Answer: A

    Explanation

    From CISM Certified Information Security Manager Study Guide by Mike Chappell 1. Project Scope and Planning As with any formalized business process, the development of a resilient business continuity plan requires the use of a proven methodology. Organizations should approach the planning process with several goals in mind: Perform a structured review of the business’s organization from a crisis planning point of view. (A) Create a BCP team with the approval of senior management. Assess the resources available to participate in business continuity activities. (C) Analyse the legal and regulatory landscape that governs an organization’s response to a catastrophic event. (B)

    Source: Adapted from community discussion — AaronS1990

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 551. 1243 questions available.