CISM practice questions 621–630

1. Question 621 · 1243 in bank

   Which of the following is the MOST important requirement for a successful security program?

   • AManagement decision on asset value
   • BPenetration testing on key systems
   • CNondisclosure agreements (NDA) with employees
   • DMapping security processes to baseline security standards

   Show answer

   Answer: A

   Explanation

   I'd say it's A, because before you implement information security program in any shape or form, you need to have clear understanding of what you're trying to protect. How would you perform a risk assessment and prioritize risks or implement cost-effective controls if management didn't tell you the value of the assets you have to protect?

   Source: Adapted from community discussion — AlexJacobson

   Next question

2. Question 622 · 1243 in bank

   Which of the following is the GREATEST value provided by a security information and event management (SIEM) system?

   • AFacilitating the monitoring of risk occurrences
   • BMeasuring impact of exploits on business processes
   • CMaintaining a repository base of security policies
   • DRedirecting event logs to an alternate location for business continuity plan (BCP)

   Show answer

   Answer: A

   Explanation

   A. Facilitating the monitoring of risk occurrences A SIEM system helps in collecting, correlating, and analyzing security events and logs from various sources within an organization's IT infrastructure. By consolidating and centralizing this information, the SIEM system enables effective monitoring of risk occurrences and security incidents. It provides real-time visibility into potential threats, anomalies, and security events happening across the organization's network, systems, and applications.

   Source: Adapted from community discussion — mad68

   Next question

3. Question 623 · 1243 in bank

   A critical vulnerability is found on a server hosting multiple applications owned by different business units. One of the business units finds its hosted application will not function with the patch applied and chooses to accept the risk. Which of the following should be the information security manager s NEXT course of action?

   • AUpdate the risk register
   • BDevelop a business case for compensating controls
   • CUpdate the information security policy
   • DConsult the incident management process

   Show answer

   Answer: A

   Explanation

   A. Update the risk register The information security manager's next course of action should be to update the risk register. The risk register is a document that is used to identify, assess, and prioritize risks to the organization.

   Source: Adapted from community discussion — Broesweelies

   Next question

4. Question 624 · 1243 in bank

   The MOST important element in achieving executive commitment to an information security governance program is:

   • Aidentified business drivers.
   • Ba process improvement model.
   • Cestablished security strategies.
   • Da defined security framework.

   Show answer

   Answer: A

   Explanation

   A. identified business drivers. Executive commitment to an information security governance program often hinges on understanding the business drivers and how information security aligns with and supports these drivers. When executives see the connection between information security and the organization's goals, profitability, or competitive advantage, they are more likely to commit resources and support the program. This makes A. identified business drivers the most crucial element in gaining executive commitment.

   Source: Adapted from community discussion — oluchecpoint

   Next question

5. Question 625 · 1243 in bank

   Which of the following BEST prepares a computer incident response team for a variety of information security scenarios?

   • ATabletop exercises
   • BForensics certification
   • CPenetration tests
   • DDisaster recovery drills

   Show answer

   Answer: A

   Explanation

   Tabletop exercises are simulated, interactive sessions where team members discuss and role-play their responses to various security incidents. These exercises help the incident response team practice and refine their incident response plans, communication strategies, and decision-making processes in a controlled environment. Tabletop exercises are valuable for preparing teams to handle a range of information security scenarios without the actual impact or disruption that may occur during live incidents. While options like forensics certification (option B), penetration tests (option C), and disaster recovery drills (option D) are important for specific aspects of information security, tabletop exercises offer a holistic approach to testing and improving the overall incident response capabilities of a team.

   Source: Adapted from community discussion — Viperhunter

   References

   • isaca.org documentation

   Next question

6. Question 626 · 1243 in bank

   Which of the following recovery approaches generally has the LOWEST periodic cost?

   • AShared contingency center
   • BReciprocal agreement
   • CRedundant site
   • DCold site

   Show answer

   Answer: D

   Explanation

   D. Cold site A cold site generally has the lowest periodic cost among the recovery approaches. A cold site is a type of disaster recovery facility that includes basic infrastructure such as power and communications, but does not include equipment, software, or data. It can be used as a temporary location for an organization to resume operations in the event of a disaster. Because a cold site does not include any active equipment or data, the costs associated with maintaining and updating the site are typically lower than other recovery approaches such as a redundant site or a shared contingency center.

   Source: Adapted from community discussion — Broesweelies

   Next question

7. Question 627 · 1243 in bank

   Which of the following tasks should he performed once a disaster recovery plan (DRP) has been developed?

   • AIdentify recovery time objectives (RTOs)
   • BDevelop the test plan
   • CAnalyze the business impact
   • DDefine response team roles

   Show answer

   Answer: B

   Explanation

   The correct answer is B. Develop the test plan. Once a disaster recovery plan (DRP) has been developed, the next step is to develop a test plan for the DRP. The test plan should include a description of the steps to be taken to test the DRP, the objectives of the test, the resources required, and the expected outcome. The purpose of testing the DRP is to ensure that the plan is complete, accurate, and effective in responding to a disaster.

   Source: Adapted from community discussion — Broesweelies

   Next question

8. Question 628 · 1243 in bank

   Which of the following should be the MOST important consideration of business continuity management?

   • AEnsuring human safety
   • BSecuring critical information assets
   • CEnsuring the reliability of backup data
   • DIdentifying critical business processes

   Show answer

   Answer: A

   Next question

9. Question 629 · 1243 in bank

   Which of the following should be the FIRST step of incident response procedures?

   • AClassify the event depending on severity and type
   • BPerform a risk assessment to determine the business impact
   • CEvaluate the cause of the control failure
   • DIdentify if there is a need for additional technical assistance

   Show answer

   Answer: A

   Explanation

   The first step of incident response procedures should be A. Classify the event depending on severity and type. This is important because it will help the incident response team to prioritize the incident and determine the appropriate course of action. For example, a minor incident may only require a few people to investigate, while a major incident may require the entire incident response team to be activated.

   Source: Adapted from community discussion — chanke

   Next question

10. Question 630 · 1243 in bank

    Which of the following is the BEST method for reducing the risk of data loss due to phishing attacks?

    • AChanging passwords frequently
    • BImplementing data loss prevention
    • CUsing spam filtering solutions
    • DEducating users

    Show answer

    Answer: D

    Explanation

    Phishing won't necessarily come through as 'spam'. An example being if hackers get hold of the CEO's email account. It's D

    Source: Adapted from community discussion — AaronS1990

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 621. 1243 questions available.