CISM practice questions 681–690

1. Question 681 · 1243 in bank

   Which of the following clauses would represent the MOST significant potential exposure if included in a contract with a third-party service provider?

   • AProvider responsibility in a disaster limited to best reasonable efforts
   • BProvider liability for loss of data limited to cost of physical media
   • CAudit rights limited to customer data and supporting infrastructure
   • DAccess to escrowed software restricted to specific conditions

   Show answer

   Answer: B

   Explanation

   B. Provider liability for loss of data limited to cost of physical media would represent the MOST significant potential exposure if included in a contract with a third-party service provider. Limiting the provider's liability for loss of data to the cost of physical media means that the provider would not be liable for any costs associated with the loss of data such as the cost of restoring the data, the cost of lost business, or the cost of regulatory fines. This type of clause could leave the customer with significant exposure in the event of data loss. Other clauses such as Provider responsibility in a disaster limited to best reasonable efforts, Audit rights limited to customer data and supporting infrastructure, and Access to escrowed software restricted to specific conditions could also represent significant exposure but they are not as severe as B.

   Source: Adapted from community discussion — Broesweelies

   Next question

2. Question 682 · 1243 in bank

   Which of the following should be the PRIMARY basis for determining information security objectives?

   • ABusiness strategy
   • BRegulatory requirements
   • CInformation security strategy
   • DData classification

   Show answer

   Answer: A

   Explanation

   A. Business strategy should be the PRIMARY basis for determining information security objectives. Information security objectives should be aligned with the organization's overall business strategy and objectives in order to support the organization's mission and goals. This means that the information security program should be designed to meet the specific needs of the organization, and that it should be continuously reviewed and updated to ensure that it remains aligned with changing business needs. Determining information security objectives based on business strategy will help ensure that the organization's resources are allocated in a way that maximizes the protection of the organization's assets while supporting the organization's overall mission and objectives.

   Source: Adapted from community discussion — Broesweelies

   Next question

3. Question 683 · 1243 in bank

   Which of the following is the BEST method to ensure compliance with password standards?

   • AA user-awareness program
   • BImplementing password-synchronization software
   • CUsing password-cracking software
   • DAutomated enforcement of password syntax rules

   Show answer

   Answer: D

   Explanation

   Automated enforcement of password syntax rules involves implementing technical controls that ensure users create and maintain passwords that meet the organization's password standards. This approach minimizes the risk of human error and ensures that password policies are consistently applied across the organization.

   Source: Adapted from community discussion — oluchecpoint

   Next question

4. Question 684 · 1243 in bank

   The PRIMARY purpose for deploying information security metrics is to:

   • Aensure that technical operations meet specifications.
   • Bcompare program effectiveness to benchmarks.
   • Csupport ongoing security budget requirements.
   • Dprovide information needed to make decisions.

   Show answer

   Answer: D

   Explanation

   D. provide information needed to make decisions. The primary purpose for deploying information security metrics is to provide the organization with the information it needs to make informed decisions about the management and protection of its information assets. This includes measuring the effectiveness of the organization's information security program, identifying areas for improvement, and tracking progress over time.

   Source: Adapted from community discussion — Broesweelies

   Next question

5. Question 685 · 1243 in bank

   Which of the following would BEST demonstrate the status of an organization's information security program to the board of directors?

   • AThe information security operations matrix
   • BChanges to information security risks
   • CInformation security program metrics
   • DResults of a recent external audit

   Show answer

   Answer: C

   Explanation

   Metrics can include key performance indicators (KPIs), such as the number of security incidents, incident response times, compliance with security policies, and other relevant data points that help the board understand how well the organization is managing its information security risks.

   Source: Adapted from community discussion — oluchecpoint

   Next question

6. Question 686 · 1243 in bank

   An intrusion has been detected and contained. Which of the following steps represents the BEST practice for ensuring the integrity of the recovered system?

   • ARestore the application and data from a forensic copy.
   • BInstall the OS, patches, and application from the original source.
   • CRestore the OS, patches, and application from a backup.
   • DRemove all signs of the intrusion from the OS and application.

   Show answer

   Answer: B

   Explanation

   I dont think that you are right. Forensic copies are made to preserve incident evidence and are created under chain of custody to yield court-ready evidence material. The use case of forensic copies is to understand what happened during the incident. The use case of forensic copies is NOT to have a clean source for restoration purposes. The right answer is B, since restoring the OS from a trusted source assures that the software packages are malware free. In case the incident was caused by a vulnerability, it is most likely that the vendor has either fixed the vulnerability or provided temporary workarounds for remediation purposes. Therefore, answer B is right.

   Source: Adapted from community discussion — Josef4CISM

   Next question

7. Question 687 · 1243 in bank

   Which of the following should an information security manager do FIRST when informed that customer data has been breached within a third-party vendor's environment?

   • ACommunicate the breach to leadership.
   • BRequest and verify evidence of the breach.
   • CNotify the incident response team.
   • DReview vendor obligations in the contract.

   Show answer

   Answer: B

   Explanation

   When informed that customer data has been breached within a third-party vendor's environment, the information security manager should request and verify evidence of the breach (option B) FIRST. It is important to confirm that a breach has actually occurred before taking any further action. Requesting and verifying evidence of the breach can help to confirm the extent of the breach and the types of data that may have been compromised. Once the evidence has been obtained and verified, the information security manager can then take the appropriate next steps, such as notifying the incident response team (option C) and communicating the breach to leadership (option A). Option D, reviewing vendor obligations in the contract, could be useful in understanding the rights and responsibilities of the vendor and the company in the event of a breach, but it should not be the first step taken.

   Source: Adapted from community discussion — Proctored_Expert

   Next question

8. Question 688 · 1243 in bank

   Which of the following is the GREATEST benefit of using cyber threat intelligence to improve an organization's patch management program?

   • AIt allows the organization to define its risk tolerance and appetite.
   • BIt identifies when to use workarounds to mitigate vulnerabilities rather than patching.
   • CIt reduces the number of patches the organization needs to apply.
   • DIt provides information about exploited vulnerabilities to expedite patching.

   Show answer

   Answer: D

   Next question

9. Question 689 · 1243 in bank

   Which of the following methods enables the MOST rigorous testing while avoiding the disruption of normal business operations?

   • AWalk-through test
   • BFull interruption test
   • CParallel test
   • DChecklist review test

   Show answer

   Answer: C

   Next question

10. Question 690 · 1243 in bank

    Which of the following is the BEST way to build a risk-aware culture?

    • APeriodically change risk awareness messages.
    • BEnsure that threats are communicated organization-wide in a timely manner.
    • CPeriodically test compliance with security controls and post results.
    • DEstablish incentives and a channel for staff to report risks.

    Show answer

    Answer: D

    Explanation

    According to ISACA REVIEW MANUAL, "Building a security-aware (in other words, risk-aware) culture depends on individuals in their respective roles performing their jobs in a way that protects information assets." (Page 31, 1.2 Organizational Culture). While rewards and incentives will MOTIVATE individuals to fulfill the responsibilities associated with their job-role, the CONSEQUENCES OF NON-COMPLIANCE (a low performance rating or getting fired) when reported to management will be a more COMPELLING FACTOR. Punishment trumps rewards. Consequently, employees are more likely to participate in awareness trainings and conform to organizational policies such as AUP (including use of security controls) so they do not over-step the organizational policies accidentally or intentionally. Therefore, 'Periodically test compliance with security controls and post results (a form of reporting)', is the most likely answer.

    Source: Adapted from community discussion — CISSPST

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 681. 1243 questions available.