CISM practice questions 601–610

1. Question 601 · 1243 in bank

   For the information security manager, integrating the various assurance functions of an organization is important PRIMARILY to enable:

   • Aconsistent security.
   • Ba security-aware culture.
   • Ccompliance with policy.
   • Dcomprehensive audits.

   Show answer

   Answer: A

   Explanation

   Integrating the various assurance functions of an organization is important primarily to enable consistent security because it ensures that all aspects of security, such as risk management, incident response, and compliance, are working together in a cohesive manner. This helps to protect the organization from potential security threats and vulnerabilities by providing a unified and comprehensive approach to security. Additionally, it helps to ensure that all employees and departments within the organization are aware of and adhere to the same security standards and procedures, which helps to further enhance the overall security of the organization.

   Source: Adapted from community discussion — Broesweelies

   Next question

2. Question 602 · 1243 in bank

   An organization has concerns regarding a potential advanced persistent threat (APT). To ensure that the risk associated with this threat is appropriately managed, what should be the organization's FIRST action?

   • AImplement additional controls.
   • BReport to senior management.
   • CInitiate incident response processes.
   • DConduct an impact analysis.

   Show answer

   Answer: D

   Explanation

   I agree, D is the correct answer. Conducting an Impact Analysis should be the first action to take which then allows an organization to plan for the next step regarding this concern.

   Source: Adapted from community discussion — EZPASS

   Next question

3. Question 603 · 1243 in bank

   Which of the following is the MOST important step when establishing guidelines for the use of social networking sites in an organization?

   • AIdentify secure social networking sites
   • BEstablish disciplinary actions for noncompliance
   • CPerform a vulnerability assessment
   • DDefine acceptable information for posting

   Show answer

   Answer: D

   Explanation

   guidelines are not mandatory so disciplinary action wouldn't be the right answer with B. You can define and recommend what to post though.

   Source: Adapted from community discussion — Seasondream

   Next question

4. Question 604 · 1243 in bank

   Which of the following roles is accountable for ensuring the impact of a new regulatory framework on a business system is assessed?

   • ASenior management
   • BApplication owner
   • CLegal representative
   • DInformation security manager

   Show answer

   Answer: A

   Explanation

   Senior management is typically accountable for ensuring that the impact of a new regulatory framework on a business system is assessed. They are responsible for overseeing the overall operations of the organization and making strategic decisions that align with the organization's goals and objectives. As such, they are in a position to ensure that the necessary resources and support are allocated to assess the impact of new regulations on the organization's systems and to develop and implement the appropriate compliance measures. Additionally, senior management is responsible for ensuring that the organization is in compliance with all relevant laws and regulations, and therefore should be aware of any new regulations that may affect the business.

   Source: Adapted from community discussion — Broesweelies

   Next question

5. Question 605 · 1243 in bank

   During the initiation phase of the system development life cycle (SDLC) for a software project, information security activities should address:

   • Abaseline security controls
   • Bsecurity objectives
   • Ccost-benefit analyses
   • Dbenchmarking security metrics

   Show answer

   Answer: B

   Next question

6. Question 606 · 1243 in bank

   Which of the following is the BEST way to reduce the risk associated with a successful social engineering attack targeting help desk staff?

   • AConduct security awareness training
   • BImplement two-factor authentication
   • CBlock access to social media sites
   • DEnforce role based access to help desk systems

   Show answer

   Answer: A

   Explanation

   MFA has nothing to do with social engineering. Also, question is asking about reducing the risks not next steps after an attack.

   Source: Adapted from community discussion — Dravidian

   Next question

7. Question 607 · 1243 in bank

   During the implementation of a new system, which of the following processes proactively minimizes the likelihood of disruption unauthorized alterations and errors?

   • APassword management
   • BVersion management
   • CChange management
   • DConfiguration management

   Show answer

   Answer: C

   Explanation

   C. Change management is a PROACTIVE measure to reduce disruption, unauthorized alterations...and errors. I think this is a better answer when implementing a new systems. Configuration managment, to me, helps get you to a baseline configuration and detect when changes occur.

   Source: Adapted from community discussion — CarlLimps

   Next question

8. Question 608 · 1243 in bank

   When evaluating the risk from external hackers the maximum exposure time would be the difference between:

   • Alog refresh and restoration.
   • Bidentification and resolution.
   • Cdetection and response.
   • Dcompromise and containment.

   Show answer

   Answer: D

   Explanation

   When evaluating the risk from external hackers, the maximum exposure time refers to the time frame between when the hacker has successfully compromised a system or network and when the organization is able to contain and remediate the compromise. The maximum exposure time is critical in determining the potential impact of a security incident and the amount of damage that can be done.

   Source: Adapted from community discussion — giovi

   Next question

9. Question 609 · 1243 in bank

   What should be the FIRST step when implementing data loss prevention (DLP) technology?

   • ABuild a business case
   • BPerform due diligence with vendor candidates
   • CClassify the organization's data
   • DPerform a cost benefit analysis

   Show answer

   Answer: C

   Explanation

   Classifying data is the next step when you are implementing a DLP system. Business cases are more for winning the hearts and approval of the higher-ups.

   Source: Adapted from community discussion — chanke

   Next question

10. Question 610 · 1243 in bank

    When creating an incident response plan, the PRIMARY benefit of establishing a clear definition of a security incident is that it helps to:

    • Adevelop effective escalation and response procedures
    • Bmake tabletop testing more effective
    • Cadequately staff and train incident response teams
    • Dcommunicate the incident response process to stakeholders

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 601. 1243 questions available.