CISM practice questions 691–700

1. Question 691 · 1243 in bank

   Which of the following would be MOST useful to help senior management understand the status of information security compliance?

   • AKey performance indicators (KPIs)
   • BRisk assessment results
   • CIndustry benchmarks
   • DBusiness impact analysis (BIA) results

   Show answer

   Answer: A

   Explanation

   A. Key performance indicators (KPIs) would be MOST useful to help senior management understand the status of information security compliance. KPIs are metrics that are used to measure the performance of specific aspects of an organization's security program, such as the effectiveness of security controls, incident response times, and compliance with regulations and standards. These metrics can be presented in an easy-to-understand format, making it easier for senior management to understand the status of the organization's compliance efforts. Risk assessment results, industry benchmarks, and Business Impact Analysis (BIA) results can also provide important information but presenting it in a KPI format can make it easily understandable for senior management.

   Source: Adapted from community discussion — Broesweelies

   References

   • isaca.org documentation

   Next question

2. Question 692 · 1243 in bank

   An empowered security steering committee has decided to accept a critical risk. Which of the following is the information security manager's BEST course of action?

   • ANotify the chief risk officer (CRO) and internal audit.
   • BDetermine the impact to information security objectives.
   • CRemove the specific risk item from the risk register.
   • DDocument the risk acceptance and justification.

   Show answer

   Answer: D

   Explanation

   If an empowered security steering committee has decided to accept a critical risk, the BEST course of action for the information security manager is to document the risk acceptance and justification (Option D).

   Source: Adapted from community discussion — Souvik124

   Next question

3. Question 693 · 1243 in bank

   Which of the following is the PRIMARY benefit of implementing an information security governance framework?

   • AThe framework provides a roadmap to maximize revenue through the secure use of technology.
   • BThe framework is able to confirm the validity of business goals and strategies.
   • CThe framework defines managerial responsibilities for risk impacts to business goals.
   • DThe framework provides direction to meet business goals while balancing risks and controls.

   Show answer

   Answer: D

   Next question

4. Question 694 · 1243 in bank

   Which of the following is the BEST way to prevent insider threats?

   • AImplement strict security policies and password controls.
   • BConduct organization-wide security awareness training.
   • CEnforce segregation of duties and least privilege access.
   • DImplement logging for all access activities.

   Show answer

   Answer: C

   Explanation

   Yea, D is clearly the most incorrect answer here. The question is asking about preventing. Logging is a detective control and has provides no value to the question.

   Source: Adapted from community discussion — Dravidian

   Next question

5. Question 695 · 1243 in bank

   Which of the following should be done FIRST to ensure a new critical cloud application can be supported by internal personnel?

   • AEstablish a capability maturity model.
   • BDevelop a training plan.
   • CConduct a risk assessment.
   • DPerform a skills gap analysis.

   Show answer

   Answer: D

   Next question

6. Question 696 · 1243 in bank

   An organization is conducting a post-incident review to determine the root cause of an information security incident. Which of the following situations would be MOST harmful to this investigation?

   • AUnencrypted logs of the affected systems were saved on magnetic tapes.
   • BAntivirus signature update processes failed on the affected systems.
   • CSystems logs were cleared by the administrator to free up space on the affected systems.
   • DThe incident response plan has not been updated during the past year.

   Show answer

   Answer: C

   Next question

7. Question 697 · 1243 in bank

   When building support for an information security program, which of the following elements is MOST important?

   • ABusiness impact analysis (BIA)
   • BIdentification of existing vulnerabilities
   • CThreat analysis
   • DInformation risk assessment

   Show answer

   Answer: D

   Explanation

   I have read several explanations below. Addressing just few to help others understand the flaws in the arguments. Please note, I mean no disrespect to the comment owners. Dravidian: How you will be affected, i.e., impact is important. But what if likelihood is zero. BIA considers only internal factors (value of asset to business). RA considers both internal and external factors (threats, likelihood, vulnerabilities, exposure, and impact). BIA can be conducted before or sometimes as part of risk assessment. Besides, the question is asking not about what is done first but what is most important. 6and0: It is not uncommon for BIA to be done before establishing the IS program. Afterall, Risk Assessment is incomplete without impact assessment. To build support for IS program, threat, vulnerability, or impact by themselves mean nothing if the

   Source: Adapted from community discussion — CISSPST

   Next question

8. Question 698 · 1243 in bank

   Capacity planning would prevent:

   • Asystem downtime for scheduled security maintenance.
   • Bfile system overload arising from distributed denial of service (DDoS) attacks.
   • Capplication failures arising from insufficient hardware resources.
   • Dsoftware failures arising from exploitation of buffer capacity vulnerabilities.

   Show answer

   Answer: C

   Explanation

   C. application failures arising from insufficient hardware resources. Capacity planning is the process of determining the resources required to meet the expected demand. It involves forecasting the usage of resources such as storage, CPU, and memory, and ensuring that the system has enough capacity to handle the expected workload. By identifying and addressing potential resource constraints before they occur, capacity planning can prevent application failures that arise from insufficient hardware resources.

   Source: Adapted from community discussion — Broesweelies

   Next question

9. Question 699 · 1243 in bank

   Which of the following is the MOST effective way to ensure information security policies are understood?

   • AImplement a whistle-blower program.
   • BDocument security procedures.
   • CInclude security responsibilities in job descriptions.
   • DProvide regular security awareness training.

   Show answer

   Answer: D

   Next question

10. Question 700 · 1243 in bank

    Which of the following is the MOST effective method for testing an incident response plan?

    • ADisaster recovery testing
    • BRisk assessment
    • CTabletop exercises
    • DIndustry benchmarking

    Show answer

    Answer: C

    Explanation

    C. Tabletop exercises Tabletop exercises are considered the most effective method for testing an incident response plan. Tabletop exercises involve a simulated scenario where key stakeholders come together to discuss and practice their response to a hypothetical incident. This allows organizations to evaluate their response procedures, identify gaps, and improve their incident response plan in a controlled and collaborative environment.

    Source: Adapted from community discussion — oluchecpoint

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 691. 1243 questions available.