CISM practice questions 651–660

1. Question 651 · 1243 in bank

   Which of the following is a PRIMARY function of an incident response team?

   • ATo provide a single point of contact for critical incidents
   • BTo provide a risk assessment for zero-day vulnerabilities
   • CTo provide a business impact analysis (BIA)
   • DTo provide effective incident mitigation

   Show answer

   Answer: D

   Explanation

   The Correct Answer is (D) to provide effective incident mitigation. Rationale: A. To provide a single point of contact for critical incidents is incorrect cause that role would fall on someone with an authority to make decisions. The IR team simply carries out those decisions and provides the information to the point of contact to make those decisions. B. To provide a risk assessment for zero-day vulnerabilities is incorrect because this is done by: Risk managers, Security professionals, IT professionals, Subject matter experts C. To provide a business impact analysis (BIA) incorrect cause BIA is done by BCP pros, info pros, risk management and SME of business units. Not by the IR team.

   Source: Adapted from community discussion — dark_3k03r

   Next question

2. Question 652 · 1243 in bank

   Using which of the following metrics will BEST help to determine the resiliency of IT infrastructure security controls?

   • APercentage of outstanding high-risk audit issues
   • BNumber of incidents resulting in disruptions
   • CNumber of successful disaster recovery tests
   • DFrequency of updates to system software

   Show answer

   Answer: B

   Explanation

   The question is clear in asking how can we best measure the resiliency of the security program. This is not all about DR. The best way to measure resiliency would be see how many incidents that actually end up causing a disruption. B is the right answer.

   Source: Adapted from community discussion — Dravidian

   Next question

3. Question 653 · 1243 in bank

   Which of the following is the MAIN reason for integrating an organization's incident response plan with its business continuity process?

   • AIncidents can escalate into disasters needing proper response
   • BRecovery time objectives (RTOs) need to be determined
   • CIncidents will be reported more timely when categorized as a disaster
   • DIntegration of the plan will reduce resource costs to the organization

   Show answer

   Answer: A

   Explanation

   A. Incidents can escalate into disasters needing proper response Integrating incident response with business continuity recognizes that some incidents, if not properly managed, can escalate into larger-scale disasters that affect the organization's overall operations. By having an integrated approach, an organization can ensure a coordinated and effective response to incidents, helping to prevent them from becoming full-blown disasters and minimizing their impact on business continuity. This approach aims to detect, respond to, and mitigate incidents at an early stage, reducing the likelihood of them evolving into larger-scale disasters.

   Source: Adapted from community discussion — oluchecpoint

   Next question

4. Question 654 · 1243 in bank

   Which of the following should be the PRIMARY basis for a severity hierarchy for information security incident classification?

   • ALegal and regulatory requirements
   • BRoot cause analysis results
   • CAvailability of resources
   • DAdverse effects on the business

   Show answer

   Answer: D

   Next question

5. Question 655 · 1243 in bank

   Which of the following would BEST enable the timely execution of an incident response plan?

   • ADefinition of trigger events
   • BCentralized service desk
   • CThe introduction of a decision support tool
   • DClearly defined data classification process

   Show answer

   Answer: A

   Next question

6. Question 656 · 1243 in bank

   Which of the following is the BEST approach to identify new security issues associated with IT systems and applications in a timely manner?

   • ARequiring periodic security audits of IT systems and applications
   • BComparing current state to established industry benchmarks
   • CPerforming a vulnerability assessment for each change to IT systems
   • DIntegrating risk assessments into the change management process

   Show answer

   Answer: D

   Explanation

   "new security issues associated with IT systems" If it said "security issues with new systems" i'd understand why it's D. But in this case we aren't really talking about making changes to a system, rather keeping an eye out for emerging threats to existing systems. This looks more like A to me... Anyone else have any thoughts?

   Source: Adapted from community discussion — AaronS1990

   Next question

7. Question 657 · 1243 in bank

   When designing security controls, it is MOST important to:

   • Afocus on preventive controls.
   • Bapply controls to confidential information.
   • Cevaluate the costs associated with the controls.
   • Dapply a risk-based approach.

   Show answer

   Answer: D

   Explanation

   Applying a risk-based approach involves identifying and assessing the risks faced by the organization and then designing security controls that are proportionate to the identified risks. This ensures that resources are allocated efficiently and that security measures are aligned with the organization's risk tolerance and priorities. While focusing on preventive controls (option A) is important, an exclusive focus on prevention may not adequately address all potential risks. Applying controls to confidential information (option B) is essential but should be guided by the overall risk landscape. Evaluating the costs associated with controls (option C) is also important, but cost-effectiveness should be considered in the context of risk reduction. A risk-based approach helps organizations prioritize and tailor their security controls to address the most significant threats and vulnerabilities.

   Source: Adapted from community discussion — Viperhunter

   Next question

8. Question 658 · 1243 in bank

   Which of the following is MOST important to include in an information security strategy?

   • AIndustry benchmarks
   • BStakeholder requirements
   • CRisk register
   • DRegulatory requirements

   Show answer

   Answer: B

   Next question

9. Question 659 · 1243 in bank

   The PRIMARY reason to create and externally store the disk hash value when performing forensic data acquisition from a hard disk is to:

   • Avalidate the integrity during analysis
   • Bprovide backup in case of media failure
   • Creinstate original data when accidental changes occur
   • Dvalidate the confidentiality during analysis

   Show answer

   Answer: A

   Next question

10. Question 660 · 1243 in bank

    Which of the following is the MOST important issue in a penetration test?

    • APerforming the test without the benefit of any insider knowledge
    • BHaving an independent group perform the test
    • CHaving a defined goal as well as success and failure criteria
    • DObtaining permission from audit

    Show answer

    Answer: C

    Explanation

    C. Having a defined goal as well as success and failure criteria In a penetration test, having a defined goal and clear success and failure criteria is the most important issue. Without a well-defined objective and criteria for success, the penetration test may lack focus and effectiveness. It's essential to understand what you are trying to achieve through the test and how you will measure whether it was successful or not.

    Source: Adapted from community discussion — oluchecpoint

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 651. 1243 questions available.