Question 591 · 1243 in bank
Which of the following is the MOST important constraint to be considered when developing an information security strategy?
Show answer
Answer: D
Certified Information Security Manager1,243 questions across 125 pages are complete and free, with no account or card.
1243 questions in this bank
Free access · progress saved on this device
Which of the following is the MOST important constraint to be considered when developing an information security strategy?
Answer: D
An organization is concerned with the potential for exploitation of vulnerabilities in its server systems. Which of the following is the BEST control to mitigate the associated risk?
Answer: A
Enforcing standard system configurations based on secure configuration benchmarks ensures that servers are configured in a secure and consistent manner. This reduces the likelihood of vulnerabilities resulting from misconfigurations that could be exploited by attackers. Secure configuration benchmarks provide guidelines and best practices for configuring systems to minimize security risks. While implementing network and system-based anomaly monitoring software (option B), enforcing configurations for secure logging and audit trails (option C), and implementing host-based intrusion detection systems (IDS) (option D) are valuable security measures, enforcing secure configurations is a foundational control that addresses the root cause of many vulnerabilities.
Source: Adapted from community discussion — Viperhunter
Which of the following would BEST justify continued investment in an information security program?
Answer: B
Which of the following BEST facilitates the effective execution of an incident response plan?
Answer: D
D. The response team is trained on the plan. The effective execution of an incident response plan relies heavily on the preparedness and capabilities of the response team. Training the response team on the plan is critical because it ensures that team members are familiar with their roles and responsibilities, as well as the procedures outlined in the plan. This familiarity with the plan enables a more efficient and coordinated response to security incidents, reducing the potential impact and damage caused by the incident.
Source: Adapted from community discussion — oluchecpoint
Which of the following is the PRIMARY reason that an information security manager should restrict the use of generic administrator accounts in a multi-user environment?
Answer: A
I really like A here. I've seen this play out before when sharing accounts. It's a who dunnit game. Accountability should drive this. Yes, SOD is important but knowing who did what trumps this. IMO.
Source: Adapted from community discussion — CarlLimps
Which of the following documents should contain the INITIAL prioritization of recovery of services?
Answer: C
The initial prioritization of recovery of services should be contained in a Business Impact Analysis (BIA). A BIA is a document that assesses the potential consequences of an interruption to critical business operations and services, and it is used to determine the priority of those services in the event of a disaster. The BIA considers factors such as the criticality of business functions, the dependencies between different business processes, and the consequences of a service interruption, and it prioritizes the recovery of services based on these factors
Source: Adapted from community discussion — Broesweelies
The department head of application development has decided to accept the risks identified in a recent assessment. No recommendations will be implemented, even though the recommendations are required by regulatory oversight. What should the information security manager do NEXT?
Answer: A
A. is the best answer. Why the heck would you do D AGAIN? You just did an assessment. Formally documenting to me means get this shit in front of the executives in the organziation and provide their awareness. Unfortunately, or fortunately, it is a CYA(Cover Your Ass) step as well, which is very important.
Source: Adapted from community discussion — CarlLimps
A company has a remote office located in a different country. The company's chief information security officer (CISO) has just learned of a new regulatory requirement mandated by the country of the remote office. Which of the following should be the NEXT step?
Answer: B
When integrating security risk management into an organization it is MOST important to ensure:
Answer: B
B. A riskt treatment plan is part of a risk methodology, so C is part of it but not complete. As a leader you want to make sure the other business leaders approve of the risk management methodology that you use. This helps in the future event they don't like a finding or a gap that you've identified.
Source: Adapted from community discussion — CarlLimps
Mitigating technology risks to acceptable levels should be based PRIMARILY upon:
Answer: A
A. business process requirements. Mitigating technology risks to acceptable levels should primarily be based on aligning with business process requirements. Technology is a tool that should support and enable the achievement of business goals and objectives. Therefore, the risk mitigation strategy should be closely tied to the specific requirements and needs of the business processes.
Source: Adapted from community discussion — oluchecpoint
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISM practice, question 591. 1243 questions available.
Version 1.0.0. How we source questions