CISM practice questions 581–590

1. Question 581 · 1243 in bank

   When drafting the corporate privacy statement for a public web site, which of the following MUST be included?

   • ALimited liability clause
   • BAccess control requirements
   • CExplanation of information usage
   • DInformation encryption requirements

   Show answer

   Answer: C

   Explanation

   The Correct answer is C cause it is the only one that could be interpreted as a statement. The rest are either contracts or requirements. A is incorrect cause a limited liability clause is a contract that limits the amount of money or damages that one party can recover from another party for breaches or performance failures. But the privacy statement is statement not a contract. B. Access Controls requirements are not a statement C. Explaining how information is used could be a statement. D. B. Access Controls requirements are not a statement

   Source: Adapted from community discussion — dark_3k03r

   Next question

2. Question 582 · 1243 in bank

   An employee of an organization has reported losing a smartphone that contains sensitive information. The BEST step to address this situation is to:

   • Aremotely wipe the device.
   • Bterminate the device connectivity.
   • Cdisable the user's access to corporate resources.
   • Descalate to the user's management.

   Show answer

   Answer: A

   Explanation

   Slow down on this one, it is not identified whether this was a company device, or a personal device. Remote wipe capability may not even be available. Need more analysis on this one. Other questions identified the device as being personal or company owned.

   Source: Adapted from community discussion — examdj101j

   Next question

3. Question 583 · 1243 in bank

   Which of the following BEST determines the allocation of resources during a security incident response?

   • ADefined levels of severity
   • BSenior management commitment
   • CA business continuity plan (BCP)
   • DAn established escalation process

   Show answer

   Answer: A

   Explanation

   A. Defined levels of severity The allocation of resources during a security incident response is best determined by defined levels of severity. These levels provide a framework for assessing the urgency and impact of an incident, which in turn guides the allocation of resources, such as personnel and equipment, to effectively respond to and resolve the incident.

   Source: Adapted from community discussion — Broesweelies

   Next question

4. Question 584 · 1243 in bank

   During the response to a serious security breach, who is the BEST organizational staff member to communicate with external entities?

   • AThe resource designated by senior management
   • BThe incident response team leader
   • CThe resource specified in the incident response plan
   • DA dedicated public relations spokesperson

   Show answer

   Answer: C

   Explanation

   It’s important that there is a chapter in the incident response plan dedicated to communication. I don’t agree with “D” because is not even requested a “public” communication, just for example for incidents that the management want to communicate just to some stakeholders or external entities

   Source: Adapted from community discussion — Agamennore

   Next question

5. Question 585 · 1243 in bank

   Which of the following is the BEST way to demonstrate the alignment of the information security strategy with the business strategy?

   • AShow the relationship between information security goals and corporate goals.
   • BCompare the allocated budget for business with the information security budget.
   • CPresent senior management's approval of information security policies.
   • DProvide evidence that information security is included in the change management process.

   Show answer

   Answer: A

   Next question

6. Question 586 · 1243 in bank

   A newly appointed information security manager has been asked to update all security-related policies and procedures that have been static for five years or more. What is the BEST next step?

   • ATo gain an understanding of the current business direction
   • BTo update in accordance with the best business practices
   • CTo perform a risk assessment of the current IT environment
   • DTo assess corporate culture

   Show answer

   Answer: A

   Explanation

   I really like A here. o gain an understanding of the current business direction. I agree, how do you acces culture and have it impact your procedures? Need a clear understanding of the business to know what policies and procedures to update.

   Source: Adapted from community discussion — CarlLimps

   Next question

7. Question 587 · 1243 in bank

   Implementing the principle of least privilege PRIMARILY requires the identification of:

   • Ajob duties.
   • Bprimary risk factors.
   • Cauthentication controls.
   • Ddata owners.

   Show answer

   Answer: A

   Explanation

   A. job duties. The principle of least privilege is a security concept that dictates that individuals or systems should be granted the minimum level of access or permissions necessary to perform their job duties or functions. Therefore, to implement this principle, it is crucial to first identify and understand the job duties and roles within an organization. Once you have a clear understanding of these job duties, you can then determine the appropriate level of access and permissions required for each role, ensuring that individuals have access only to the resources and data necessary for their specific job responsibilities.

   Source: Adapted from community discussion — oluchecpoint

   Next question

8. Question 588 · 1243 in bank

   Which of the following is MOST helpful in preventing cybersecurity incidents?

   • ATesting the backup plan according to a defined schedule
   • BDocumenting and testing incident response plans
   • CDelivering periodic end-user security awareness training
   • DImplementing best practice password parameters

   Show answer

   Answer: C

   Next question

9. Question 589 · 1243 in bank

   Which of the following is the MOST important consideration when determining which type of failover site to employ?

   • ADisaster recovery test results
   • BReciprocal agreements
   • CRecovery time objectives (RTOs)
   • DData retention requirements

   Show answer

   Answer: C

   Explanation

   C. Recovery time objectives (RTOs). Recovery time objectives (RTOs) define the maximum allowable downtime for a system or service after a failure or disaster. It represents the target time within which the system should be fully operational again. Choosing the appropriate failover site type largely depends on your organization's RTO requirements because it directly relates to how quickly you need to recover from a failure.

   Source: Adapted from community discussion — oluchecpoint

   Next question

10. Question 590 · 1243 in bank

    A risk owner has accepted a large amount of risk due to the high cost of controls. Which of the following should be the information security manager's PRIMARY focus in this situation?

    • AConducting an independent review of risk responses
    • BEstablishing a strong ongoing risk monitoring process
    • CPresenting the risk profile for approval by the risk owner
    • DUpdating the information security standards to include the accepted risk

    Show answer

    Answer: B

    Explanation

    B. Establishing a strong ongoing risk monitoring process. The primary focus of the information security manager in this situation should be to establish a robust ongoing risk monitoring process to ensure that the risk is being managed effectively and that any issues or concerns are identified and addressed in a timely manner. This will allow the manager to ensure that the risk owner is aware of any potential issues and can take appropriate action to mitigate or manage the risk as necessary.

    Source: Adapted from community discussion — Broesweelies

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 581. 1243 questions available.