CISM practice questions 561–570

1. Question 561 · 1243 in bank

   A multinational organization is required to follow governmental regulations with different security requirements at each of its operating locations. The chief information security officer (CISO) should be MOST concerned with:

   • Adeveloping a security program that meets global and regional requirements.
   • Bensuring effective communication with local regulatory bodies.
   • Cmonitoring compliance with defined security policies and standards.
   • Dusing industry best practice to meet local legal regulatory requirements.

   Show answer

   Answer: A

   Explanation

   You need to cover regional and global, since the business has multiple locations all over the globe. There will be information sharing and each location needs to abide by the reginal and global requirements.

   Source: Adapted from community discussion — POWNED

   Next question

2. Question 562 · 1243 in bank

   Which of the following is the MOST important consideration when defining security configuration baselines?

   • AThe baselines address applicable regulatory standards.
   • BThe baselines are proportionate to risk.
   • CThe baselines address known system vulnerabilities.
   • DThe baselines align with lines of business.

   Show answer

   Answer: B

   Explanation

   While regulatory compliance is important, it's not necessarily the most important consideration when defining security configuration baselines. Compliance with regulations can help reduce risk, but baselines should first and foremost be proportionate to the risks the organization faces. This means that the baselines should be tailored to the specific risks and threats that the organization is most likely to encounter, rather than simply aiming to meet a minimum standard set by a regulation. Compliance with regulations is important, but it should not be the only or primary consideration when defining security configuration baselines.

   Source: Adapted from community discussion — Broesweelies

   Next question

3. Question 563 · 1243 in bank

   An anomaly-based intrusion detection system (IDS) operates by gathering data on:

   • Anormal network behavior and using it as a baseline for measuring abnormal activity.
   • Babnormal network behavior and using it as 4 baseline for measuring normal activity.
   • Cabnormal network behavior and issuing instructions to the firewall to drop rogue connections.
   • Dattack pattern signatures from historical data.

   Show answer

   Answer: A

   Next question

4. Question 564 · 1243 in bank

   Which of the following factors would have the MOST significant impact on an organization's information security governance model?

   • ACorporate culture
   • BOutsourced processes
   • CNumber of employees
   • DSecurity budget

   Show answer

   Answer: A

   Next question

5. Question 565 · 1243 in bank

   A newly appointed information security manager of a retailer with multiple stores discovers an HVAC (heating, ventilation, and air conditioning) vendor has remote access to the stores to enable real-time monitoring and equipment diagnostics. Which of the following should be the information security manager's FIRST course of action?

   • ADisconnect the real-time access.
   • BConduct a penetration test of the vendor.
   • CReview the vendor contract.
   • DReview the vendor's technical security controls.

   Show answer

   Answer: C

   Explanation

   C. Review the vendor contract. The first step that the information security manager should take is to review the vendor contract, as it will provide important information about the vendor's access rights and responsibilities. The contract should detail what type of access the vendor has, what data they are able to access, and what measures are in place to protect that data. The review of vendor contract will help the manager understand the scope of the vendor's access and the security controls that are in place to protect the organization's data. Based on the findings, further action can be taken such as reviewing vendor's technical security controls, conducting a penetration test or even disconnecting the real-time access.

   Source: Adapted from community discussion — Broesweelies

   Next question

6. Question 566 · 1243 in bank

   Reverse lookups can be used to prevent successful:

   • Adenial of service (DoS) attacks.
   • Bphishing attacks.
   • Csession hacking.
   • DInternet protocol (IP) spoofing.

   Show answer

   Answer: D

   Explanation

   D. Internet protocol (IP) spoofing. Reverse lookups, also known as reverse DNS (Domain Name System) lookups, can be used to verify the authenticity of the source IP address of a network connection. This helps prevent Internet protocol (IP) spoofing, where an attacker tries to impersonate a legitimate IP address to gain unauthorized access or carry out malicious activities. By performing a reverse lookup, you can check whether the hostname associated with an IP address matches the expected hostname, helping to detect and prevent IP spoofing attempts.

   Source: Adapted from community discussion — oluchecpoint

   Next question

7. Question 567 · 1243 in bank

   A post-incident review revealed that key stakeholders took longer than acceptable to decide whether an application should be shut down following a security breach. Which of the following is management's BEST course of action to rectify this issue?

   • AImprove incident response criteria.
   • BImprove incident response testing.
   • CDefine incident classification.
   • DEstablish containment procedures.

   Show answer

   Answer: C

   Explanation

   C. Define incident classification. One of the key things that management can do to rectify the issue of key stakeholders taking too long to decide whether an application should be shut down following a security breach is to define incident classification. Incident classification is the process of categorizing incidents based on their severity and potential impact on the organization. By clearly defining the different levels of incidents, management can establish clear criteria for when an application should be shut down and can ensure that key stakeholders are aware of these criteria. This will help to ensure that decisions regarding application shutdowns are made quickly and effectively in the event of a security breach, which is crucial for containing the damage and minimizing the impact of the incident.

   Source: Adapted from community discussion — Broesweelies

   Next question

8. Question 568 · 1243 in bank

   To help ensure that an information security training program is MOST effective, its contents should be:

   • Aaligned to business processes.
   • Bbased on employees' roles.
   • Cbased on recent incidents.
   • Dfocused on information security policy.

   Show answer

   Answer: B

   Explanation

   The most effective information security training program would be based on employees' roles. This means that the contents of the training should be tailored to each employee's specific job responsibilities and the information security risks associated with those responsibilities. This approach ensures that each employee understands their specific obligations regarding information security and how their actions can impact the security of sensitive information.

   Source: Adapted from community discussion — Broesweelies

   Next question

9. Question 569 · 1243 in bank

   Which of the following is the MOST effective approach for determining whether an organization's information security program supports the information security strategy?

   • AEnsure resources meet information security program needs
   • BAudit the information security program to identify deficiencies
   • CIdentify gaps impacting information security strategy
   • DDevelop key performance indicators (KPIs) of information security

   Show answer

   Answer: D

   Explanation

   What you have to keep in mind for this test is what is the best option so that everyone can track what is going on. For this question that would be KPI. KPI's are user friendly charts and graphs that a child could understand what is going on. This would be a great tool in order to show the stakeholders what is going on.

   Source: Adapted from community discussion — POWNED

   Next question

10. Question 570 · 1243 in bank

    A technical vulnerability assessment on a personnel information management server should be performed when:

    • Athe data owner leaves the organization unexpectedly
    • Bthe number of unauthorized access attempts increases
    • Cchanges are made to the system configuration
    • Dan unexpected server outage has occurred

    Show answer

    Answer: C

    Explanation

    C. Changes are made to the system configuration Regularly assessing vulnerabilities in a server's configuration is a best practice for maintaining security. When changes are made to the system configuration, there is a risk that these changes could introduce new vulnerabilities or misconfigurations that could be exploited by attackers. Therefore, conducting vulnerability assessments after any significant changes to the system configuration is important to ensure the server's security posture is not compromised.

    Source: Adapted from community discussion — oluchecpoint

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 561. 1243 questions available.