CISM practice questions 611–620

1. Question 611 · 1243 in bank

   A financial company executive is concerned about recently increasing cyberattacks and needs to take action to reduce risk. The organization would BEST respond by:

   • Aincreasing budget and staffing levels tor the incident response team
   • Brevalidating and mitigating risks to an acceptable level
   • Cimplementing an intrusion detection system (IDS)
   • Dtesting the business continuity plan (BCP)

   Show answer

   Answer: B

   Explanation

   The BEST response for the financial company to reduce risk in the face of increasing cyberattacks would be to revalidate and mitigate risks to an acceptable level (Option B). This involves conducting a thorough assessment of the organization's existing risks, vulnerabilities, and controls, and implementing appropriate risk mitigation measures. By identifying and addressing vulnerabilities and implementing effective controls, the organization can reduce the likelihood and impact of cyberattacks.

   Source: Adapted from community discussion — mad68

   Next question

2. Question 612 · 1243 in bank

   The effectiveness of an information security governance framework will BEST be enhanced if:

   • Aconsultants review the information security governance framework
   • BIS auditors are empowered to evaluate governance activities
   • Ca culture of legal and regulatory compliance is promoted by management
   • Drisk management is built into operational and strategic activities

   Show answer

   Answer: D

   Explanation

   D. Risk management is built into operational and strategic activities The effectiveness of an information security governance framework will best be enhanced if risk management is built into operational and strategic activities. This means that the organization considers and manages information security risks as part of its day-to-day operations and decision-making processes. When risk management is integrated into organizational activities, it becomes a fundamental part of the organization's culture, and not just an isolated function. This allows the organization to more effectively identify, evaluate, and mitigate information security risks, and to align its information security efforts with its overall business goals and objectives.

   Source: Adapted from community discussion — Broesweelies

   Next question

3. Question 613 · 1243 in bank

   Which of the following should be an information security manager's FIRST course of action when developing an incident management and response plan?

   • AReassess management's risk appetite
   • BConduct a gap analysis
   • CUpdate the current risk register
   • DRevise the business continuity plan (BCP)

   Show answer

   Answer: B

   Explanation

   From the ISACA CISM examination perspective, the information security manager's FIRST course of action when developing an incident management and response plan would typically be to conduct a gap analysis (Option B). The gap analysis helps identify the existing capabilities and the desired state of incident management and response within the organization. It allows the manager to assess the gaps and deficiencies in processes, resources, and controls, which then inform the development of the incident management and response plan.

   Source: Adapted from community discussion — mad68

   Next question

4. Question 614 · 1243 in bank

   Regular vulnerability scanning on an organization's internal network has identified that many user workstations have unpatched versions of software. What is the BEST way for the information security manager to help senior management understand the related risk?

   • AInclude the impact of the risk as part of regular metrics.
   • BSend regular notifications directly to senior managers.
   • CRecommend the security steering committee conduct a review.
   • DUpdate the risk assessment at regular intervals.

   Show answer

   Answer: A

   Explanation

   Including the impact of the risk as part of regular metrics allows senior management to receive ongoing, systematic information about the state of vulnerabilities in user workstations. By incorporating this information into regular metrics, senior management can better understand the potential consequences of unpatched software and make informed decisions about prioritizing and allocating resources to address the identified risk. While options like sending regular notifications directly to senior managers (option B), recommending the security steering committee conduct a review (option C), and updating the risk assessment at regular intervals (option D) may also be valuable actions, incorporating the impact into regular metrics provides a consistent and integrated approach to communicating the risk over time.

   Source: Adapted from community discussion — Viperhunter

   Next question

5. Question 615 · 1243 in bank

   An information security manager has observed multiple exceptions for a number of different security controls. Which of the following should be the information security manager's FIRST course of action?

   • APrioritize the risk and implement treatment options
   • BReport the noncompliance to the board of directors
   • CInform respective risk owners of the impact of exceptions
   • DDesign mitigating controls tor the exceptions

   Show answer

   Answer: C

   Explanation

   C The information security manager's FIRST course of action should be to inform respective risk owners of the impact of exceptions. This is important because the risk owners are responsible for managing the risks associated with the security controls, and they need to be aware of any exceptions to their controls so that they can take appropriate action. Once the risk owners are informed, they can prioritize the risk and implement treatment options, design mitigating controls for the exceptions, and report the noncompliance to the board of directors as necessary. However, informing the risk owners should be the first step in addressing the issue.

   Source: Adapted from community discussion — giovi

   Next question

6. Question 616 · 1243 in bank

   Who is accountable for ensuring proper controls are in place to address the confidentiality and availability of an information system?

   • AInformation order
   • BBusiness manager
   • CSenior management
   • DInformation security manager

   Show answer

   Answer: C

   Explanation

   C. Senior management I based the answer on the keyword "accountable." Senior management holds the ultimate accountability for ensuring proper controls are in place to address the confidentiality and availability of an information system. They are responsible for setting the strategic direction of the organization, defining policies and objectives, allocating resources, and making decisions regarding risk management and control implementation. It is their role to provide oversight and governance to ensure that the necessary controls are established, maintained, and continuously improved to protect the organization's information assets. The information security manager, business managers, and other stakeholders play important roles in implementing and supporting these controls, but ultimate accountability lies with senior management.

   Source: Adapted from community discussion — mad68

   Next question

7. Question 617 · 1243 in bank

   Which of the following is the MOST effective way to help assure the integrity of an organization's accounting system?

   • APerforming frequent security reviews of the audit log
   • BImplementing two-factor authentication
   • CConducting an annual security audit of the system
   • DProviding security awareness training to accounting staff

   Show answer

   Answer: A

   Explanation

   The correct answer is (A) Performing frequent security reviews of the audit log as that is the only one that is focused on finding the errors quickly. (B) This is good for confidentiality (MFA), but no integrity (C) Conducting an annual security audit of the system would be too late (D) Providing security awareness training to accounting staff is great for awareness, but does nothing to address finding and fixing the integrity of the system.

   Source: Adapted from community discussion — dark_3k03r

   Next question

8. Question 618 · 1243 in bank

   An organization faces severe fines and penalties if not in compliance with local regulatory requirements by an established deadline. Senior management has asked the information security manager to prepare an action plan to achieve compliance. Which of the following would provide the MOST useful information for planning purposes?

   • AResults from a business impact analysts (BIA)
   • BResults from a gap analysis
   • CAn inventory of security controls currently in place
   • DDeadlines and penalties for noncompliance

   Show answer

   Answer: B

   Next question

9. Question 619 · 1243 in bank

   An organization's HR department requires that employee account privileges be removed from all corporate IT systems within three days of termination to comply with a government regulation. However, the systems all have different user directories, and it currently takes up to four weeks to remove the privileges. Which of the following would BEST enable regulatory compliance?

   • AIdentity and access management (IAM) system
   • BPrivileged access management (PAM) system
   • CMulti-factor authentication (MFA) system
   • DGovernance risk, and compliance (GRC) system

   Show answer

   Answer: A

   Next question

10. Question 620 · 1243 in bank

    The information security manager of a multinational organization has been asked to consolidate the information security policies of its regional locations. Which of the following would be of GREATEST concern?

    • AVarying threat environments
    • BDisparate reporting lines
    • CConflicting legal requirements
    • DDifferences in work culture

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 611. 1243 questions available.