CISM practice questions 671–680

1. Question 671 · 1243 in bank

   An organization recently updated and published its information security policy and standards. What should the information security manager do NEXT?

   • AUpdate the organization's risk register.
   • BDevelop a policy exception process.
   • CCommunicate the changes to stakeholders.
   • DConduct a risk assessment.

   Show answer

   Answer: C

   Explanation

   "Stakeholders" is a broad term and it may also encompass people not involved in the policy design and update, but are rather on the "receiving end". Meaning that changes in policies have to be made known to everybody that are affected by them. For example, I know that our CISO sends emails to entire company when policy changes that can affect employees on all levels of the company occur.

   Source: Adapted from community discussion — AlexJacobson

   Next question

2. Question 672 · 1243 in bank

   Which type of recovery site is MOST reliable and can support stringent recovery requirements?

   • ACold site
   • BWarm site
   • CMobile site
   • DHot site

   Show answer

   Answer: D

   Next question

3. Question 673 · 1243 in bank

   Which of the following has the MOST influence on the information security investment process?

   • ASecurity key performance indicators (KPIs)
   • BOrganizational risk appetite
   • CIT governance framework
   • DInformation security policy

   Show answer

   Answer: B

   Explanation

   B. Organizational risk appetite Organizational risk appetite is the factor that has the MOST influence on the information security investment process. Risk appetite refers to an organization's willingness to accept and manage risks. It sets the tone for how much an organization is willing to invest in information security to protect its assets, data, and operations. The level of risk appetite directly impacts decisions regarding budget allocation, resource allocation, and the overall approach to information security.

   Source: Adapted from community discussion — oluchecpoint

   Next question

4. Question 674 · 1243 in bank

   An organization's information security manager is performing a post-incident review of a security incident in which the following events occurred: ✑ A bad actor broke into a business-critical FTP server by brute forcing an administrative password ✑ The third-party service provider hosting the server sent an automated alert message to the help desk, but was ignored ✑ The bad actor could not access the administrator console, but was exposed to encrypted data transferred to the server ✑ After three (3) hours, the bad actor deleted the FTP directory, causing incoming FTP attempts by legitimate customers to fail Which of the following could have been prevented by conducting regular incident response testing?

   • AStolen data
   • BThe server being compromised
   • CThe brute force attack
   • DIgnored alert messages

   Show answer

   Answer: D

   Explanation

   D. Ignored alert messages Regular incident response testing helps an organization evaluate its readiness to respond to security incidents effectively. In this scenario, the fact that the third-party service provider sent an automated alert message to the help desk, but it was ignored, indicates a breakdown in the incident response process

   Source: Adapted from community discussion — oluchecpoint

   Next question

5. Question 675 · 1243 in bank

   Which of the following is MOST important when designing an information security governance framework?

   • AAssessing the availability of information security resources
   • BAssessing the current state of information security
   • CAligning with the information security strategy
   • DAligning with industry best practice frameworks

   Show answer

   Answer: C

   Explanation

   C. Aligning with the information security strategy Aligning with the information security strategy ensures that your governance framework is in line with the organization's overall goals and objectives related to security. It helps ensure that security measures are integrated into the broader business strategy and that security efforts are focused on addressing the most critical risks and vulnerabilities. While the other factors mentioned (assessing resource availability, assessing the current state of information security, and aligning with industry best practice frameworks) are also important, they should be done in the context of and in alignment with the organization's security strategy.

   Source: Adapted from community discussion — oluchecpoint

   Next question

6. Question 676 · 1243 in bank

   A serious vulnerability was detected in a business application that can be exploited by external attackers to compromise the system. What is the information security manager's BEST course of action?

   • AImplement temporary remediation.
   • BRequest an immediate shutdown of the application.
   • CReport the risk to the business application owner.
   • DAsk the business application owner to apply the fix immediately.

   Show answer

   Answer: C

   Explanation

   The best course of action would be to report the risk to the business application owner (option C). It is crucial to communicate the vulnerability to the owner of the application, as they are responsible for managing and maintaining the application. They should be made aware of the situation so that appropriate action can be taken. It is their responsibility to apply the necessary fix (option D) to address the vulnerability. Additionally, it may be advisable to collaborate with the business application owner to develop a temporary remediation plan (option A) if the fix cannot be immediately applied.

   Source: Adapted from community discussion — koala_lay

   Next question

7. Question 677 · 1243 in bank

   Which of the following is MOST important to consider when defining escalation processes for incident response procedures?

   • AKey risk indicators (KRIs)
   • BBusiness continuity plans (BCPs)
   • CRecovery time objectives (RTOs)
   • DKey performance indicators (KPIs)

   Show answer

   Answer: C

   Explanation

   and Google Bard says the answer is C cause of the following: RTOs are the maximum amount of time that an organization can be without a critical system or service before it starts to experience significant financial or operational losses. They are an important consideration when defining escalation processes for incident response procedures because they help to determine when an incident should be escalated to a higher level of management. The other options are also important, but they are not as important as RTOs. Option A: Key risk indicators (KRIs). KRIs are metrics that are used to measure the likelihood and impact of risks. They are important for identifying and prioritizing risks, but they are not as important as RTOs when defining escalation processes for incident response procedures.

   Source: Adapted from community discussion — dark_3k03r

   Next question

8. Question 678 · 1243 in bank

   To optimize the implementation of information security governance in an organization, an information security manager should:

   • Aimplement processes consistent with international standards.
   • Butilize existing governance structures when possible.
   • Censure changes are consistent with existing standards.
   • Dmake gradual changes to governance to minimize employee resistance.

   Show answer

   Answer: B

   Explanation

   B makes sense to me, we are not changing anything, we are implementing it so using existing structures when possible seems more logical

   Source: Adapted from community discussion — cangurer

   Next question

9. Question 679 · 1243 in bank

   Which of the following is the PRIMARY responsibility of an information security manager in an organization that is implementing the use of company-owned mobile devices in its operations?

   • AReview and update existing security policies.
   • BEnforce passwords and data encryption on the devices.
   • CConduct security awareness training.
   • DRequire remote wipe capabilities for devices.

   Show answer

   Answer: A

   Explanation

   A. Again, you have to get out of the technical solution mindset. Its not correct and you will fail. You are a manager and are serving a business function. Policies and procedures are you job, hands on enforcing encryption is for the folks lower on the totem poll. You policy will dictate how other teams will implement the solution - you are hands off baby.

   Source: Adapted from community discussion — Azurefox79

   Next question

10. Question 680 · 1243 in bank

    Which of the following should be the PRIMARY goal of information security?

    • ABusiness alignment
    • BRegulatory compliance
    • CData governance
    • DInformation management

    Show answer

    Answer: A

    Explanation

    A. Business alignment: The primary focus of information security is to align security practices with the organization's business goals and objectives. Security measures should enable the business to function securely and effectively.

    Source: Adapted from community discussion — oluchecpoint

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 671. 1243 questions available.