Question 661 · 1243 in bank
An organization has decided to conduct a postmortem analysis after experiencing a loss from an information security attack. The PRIMARY purpose of this analysis should be to:
Show answer
Answer: C
Certified Information Security Manager1,243 questions across 125 pages are complete and free, with no account or card.
1243 questions in this bank
Free access · progress saved on this device
An organization has decided to conduct a postmortem analysis after experiencing a loss from an information security attack. The PRIMARY purpose of this analysis should be to:
Answer: C
When a critical system incident is reported, the FIRST step of the incident handler should be to:
Answer: C
A multinational organization is introducing a security governance framework. The information security manager's concern is that regional security practices differ. Which of the following should be evaluated FIRST?
Answer: D
Several months after the installation of a new firewall with intrusion prevention features to block malicious activity, a breach was discovered that came in through the firewall shortly after installation. This breach could have been detected earlier by implementing firewall:
Answer: D
D. log monitoring Log monitoring involves analyzing the logs generated by the firewall and other network devices to identify suspicious or malicious activity. It allows you to proactively detect and respond to security incidents, including breaches, by reviewing logs for signs of unauthorized access or unusual behavior. While web surfing controls, packet filtering, and application awareness are important security measures, they may not necessarily detect breaches as effectively
Source: Adapted from community discussion — oluchecpoint
Which of the following BEST enables successful identification of a potential IT security incident?
Answer: B
Which of the following is MOST important when providing updates during a security incident?
Answer: B
B. Validating the reliability of information prior to dissemination It is crucial to ensure that the information you share with the public, internal stakeholders, and the media is accurate and reliable. Rushing to provide information without proper validation can lead to misinformation, confusion, and potentially make the situation worse. Designating a communications representative (C) and ensuring timely incident information to internal stakeholders (D) are important as well, but they should be done in conjunction with the careful validation of information. Responding immediately to questions from the public (A) is also important, but it should be done based on accurate and validated information to maintain trust and credibility during a security incident.
Source: Adapted from community discussion — oluchecpoint
Which of the following BEST demonstrates the added value of an information security program?
Answer: D
An information security team plans to increase password complexity requirements for a customer-facing site, but there are concerns it will negatively impact the user experience. Which of the following is the information security manager's BEST course of action?
Answer: C
Assessing the business impact against security risk involves weighing the potential security benefits of increased password complexity against the potential negative impact on the user experience. This approach considers both security and usability factors, helping the information security team make informed decisions that strike a balance between security requirements and user satisfaction. While options like evaluating business compensating controls (option A), quantifying the security risk to the business (option B), and conducting industry benchmarking (option D) are valuable activities, assessing business impact against security risk specifically addresses the trade-off between security and user experience, allowing for a more balanced decision-making process.
Source: Adapted from community discussion — Viperhunter
To overcome the perception that security is a hindrance to business activities, it is important for an information security manager to:
Answer: C
Which of the following is the BEST indication of a mature information security program?
Answer: C
1. Initial. At the initial level, processes are disorganized, ad hoc and even chaotic. Success likely depends on individual efforts and is not considered to be repeatable. This is because processes are not sufficiently defined and documented to enable them to be replicated. 2. Repeatable. At the repeatable level, requisite processes are established, defined and documented. As a result, basic project management techniques are established, and successes in key process areas are able to be repeated. 3. Defined. At the defined level, an organization develops its own standard software development process. These defined processes enable greater attention to documentation, standardization and integration. 4. Managed. At the managed level, an organization monitors and controls its own processes through data collection and analysis. 5. Optimizing. At the optimizing level, processes are constantly improved through monitoring feedback from processes and introducing innovative processes and functionality.
Source: Adapted from community discussion — POWNED
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISM practice, question 661. 1243 questions available.
Version 1.0.0. How we source questions