CISM practice questions 701–710

1. Question 701 · 1243 in bank

   A penetration test was conducted by an accredited third party. Which of the following should be the information security manager's FIRST course of action?

   • ARequest funding needed to resolve the top vulnerabilities.
   • BEnsure a risk assessment is performed to evaluate the findings.
   • CReport findings to senior management.
   • DEnsure vulnerabilities found are resolved within acceptable timeframes.

   Show answer

   Answer: B

   Explanation

   The information security manager to prioritize option B: Ensure a risk assessment is performed to evaluate the findings as their first course of action. A risk assessment is crucial to understand the impact and likelihood of the vulnerabilities identified during the penetration test. It helps in determining the potential risks and prioritizing them based on their severity and potential impact on the organization's security posture. Once the risk assessment is performed, the information security manager can then proceed with other actions such as reporting findings to senior management, requesting funding, and ensuring vulnerabilities are resolved within acceptable timeframes. However, without a proper understanding of the risks associated with the vulnerabilities, these actions may not be prioritized effectively.

   Source: Adapted from community discussion — koala_lay

   Next question

2. Question 702 · 1243 in bank

   Which of the following is the MOST important reason for an organization to develop an information security governance program?

   • AEstablishment of accountability
   • BCompliance with audit requirements
   • CCreation of tactical solutions
   • DMonitoring of security incidents

   Show answer

   Answer: A

   Explanation

   Information security governance involves the development and implementation of a framework that ensures accountability for information security at all levels of the organization. This includes defining roles, responsibilities, and decision-making processes related to information security. By establishing accountability, organizations can create a structured approach to managing and protecting their information assets. While compliance with audit requirements (option B), creation of tactical solutions (option C), and monitoring of security incidents (option D) are important aspects of information security, the establishment of accountability through a governance program is foundational. It provides a structured and strategic approach to managing information security that aligns with business objectives and ensures that responsibilities are clearly defined throughout the organization.

   Source: Adapted from community discussion — Viperhunter

   Next question

3. Question 703 · 1243 in bank

   An information security team must obtain approval from the information security steering committee to implement a key control. Which of the following is the MOST important input to assist the committee in making this decision?

   • AIT strategy
   • BSecurity architecture
   • CRisk assessment
   • DBusiness case

   Show answer

   Answer: D

   Explanation

   For this type of activities, you go with the business case, and one of the elements of the business case is the results of the Risk Assessment. But the risk assessment without the business case, probably won't be very beneficial for the management to take the decision.

   Source: Adapted from community discussion — CarlPTY07

   Next question

4. Question 704 · 1243 in bank

   What should a global information security manager do FIRST when informed that a new regulation with significant impact will go into effect soon?

   • APerform a vulnerability assessment.
   • BPerform a business impact analysis (BIA).
   • CPerform a privacy impact assessment.
   • DPerform a gap analysis.

   Show answer

   Answer: D

   Explanation

   I disagree that it is BIA. Answer should be D-gap analysis. In the ISACA training book it states "A BIA is performed to determine the impact to an enterprise of losing the availability of any resource. It establishes the escalation of that loss over time, identifies the minimum resources needed to recover, and prioritizes the recovery of processes and supporting system."

   Source: Adapted from community discussion — CarlLimps

   Next question

5. Question 705 · 1243 in bank

   Which of the following will have the MOST negative impact to the effectiveness of incident response processes?

   • AHigh organizational risk tolerance
   • BDecentralized incident monitoring
   • CAmbiguous severity criteria
   • DManual incident reporting processes

   Show answer

   Answer: C

   Explanation

   C. Ambiguous severity criteria will have the most negative impact to the effectiveness of incident response processes. This is because having ambiguous severity criteria can lead to confusion and inconsistent decisions about how to prioritize and respond to different incidents. This can result in important incidents being overlooked or not receiving the appropriate level of attention and resources, while less critical incidents are given excessive attention. Clear and well-defined severity criteria are essential for effective incident response, as they provide a consistent framework for assessing the urgency and importance of different incidents and determining an appropriate response.

   Source: Adapted from community discussion — Broesweelies

   Next question

6. Question 706 · 1243 in bank

   Which of the following tasks would provide a newly appointed information security manager with the BEST view of the organization's existing security posture?

   • APerforming a business impact analysis (BIA)
   • BReviewing policies and procedures
   • CPerforming a risk assessment
   • DInterviewing business managers and employees

   Show answer

   Answer: C

   Explanation

   C. Performing a risk assessment would provide a newly appointed information security manager with the best view of the organization's existing security posture. This is because a risk assessment is a comprehensive process for identifying, assessing, and prioritizing the risks facing an organization, and determining the appropriate controls and countermeasures to mitigate those risks. A risk assessment will provide the information security manager with a clear understanding of the organization's vulnerabilities and threats, as well as the existing controls in place to mitigate those risks, which is an important step in identifying areas where the security posture can be improved.

   Source: Adapted from community discussion — Broesweelies

   Next question

7. Question 707 · 1243 in bank

   Which of the following is the MOST important consideration when developing incident classification methods?

   • AData classification
   • BData owner input
   • CService level agreements (SLAs)
   • DBusiness impact

   Show answer

   Answer: D

   Explanation

   I stand corrected. I read the question wrong. The correct answer is indeed D. Business impact. If the question was refering to data classification as opposed to incident classification, then the correct answer would have been B. Data owner. However, in this case the right answer is D. Business impact.

   Source: Adapted from community discussion — Soleandheel

   Next question

8. Question 708 · 1243 in bank

   Which of the following should be the PRIMARY goal of an information security manager when designing information security policies?

   • AMinimizing the cost of security controls
   • BReducing organizational security risk
   • CImproving the protection of information
   • DAchieving organizational objectives

   Show answer

   Answer: D

   Explanation

   I'd say it's D for two reasons: 1) ISACA tends to emphasize that the whole point of security is to support the business and business goals and objectives. 2) Security risk is actually reduced through security controls, not policies. Policies are high-level stuff that provide a general idea what management wants to achieve.

   Source: Adapted from community discussion — AlexJacobson

   Next question

9. Question 709 · 1243 in bank

   An organization has outsourced many application development activities to a third party that uses contract programmers extensively. Which of the following would provide the BEST assurance that the third party's contract programmers comply with the organization's security policies?

   • APerform periodic security assessments of the contractors' activities.
   • BConduct periodic vulnerability scans of the application.
   • CRequire annual signed agreements of adherence to security policies.
   • DInclude penalties for noncompliance in the contracting agreement.

   Show answer

   Answer: A

   Explanation

   A. Perform periodic security assessments of the contractors' activities would provide the best assurance that the third party's contract programmers comply with the organization's security policies. This is because security assessments involve a thorough review of the contractors' activities, including their development processes, tools and methodologies, as well as the security controls they have implemented. This will allow the organization to identify any potential vulnerabilities or noncompliance issues and address them proactively. While the other options such as conducting periodic vulnerability scans, requiring annual signed agreements, and including penalties for noncompliance in the contracting agreement, are also important and can help to ensure compliance, they are not as comprehensive as security assessments, and may not provide the same level of assurance.

   Source: Adapted from community discussion — Broesweelies

   Next question

10. Question 710 · 1243 in bank

    How does an organization's information security steering committee facilitate the achievement of information security program objectives?

    • AMonitoring information security resources
    • BMaking decisions on security priorities
    • CEnforcing regulatory and policy compliance
    • DEvaluating information security metrics

    Show answer

    Answer: B

    Explanation

    An information security steering committee can facilitate the achievement of information security program objectives by making decisions on security priorities. The committee is responsible for setting the direction and vision of the organization's information security program and establishing priorities based on risk assessments and business needs. They can allocate resources and make decisions on what security measures should be implemented, such as technology, policies, and procedures, to achieve the security objectives. The committee may also review and evaluate the effectiveness of the security measures implemented and make necessary adjustments to ensure that the organization's information security program remains effective.

    Source: Adapted from community discussion — Souvik124

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 701. 1243 questions available.