CISM practice questions 711–720

1. Question 711 · 1243 in bank

   Which of the following is the BEST reason to consolidate security operations teams across a global organization?

   • ACompliance with regulatory requirements
   • BEnhanced visibility of threats
   • CDetection of fraud
   • DCost reduction

   Show answer

   Answer: B

   Explanation

   The best reason to consolidate security operations teams across a global organization would be B. Enhanced visibility of threats. By consolidating the security operations teams, organizations can centralize their monitoring, analysis, and response capabilities. This allows for better coordination and sharing of information, leading to improved visibility into potential threats across the entire organization. With enhanced visibility, organizations can more effectively detect and respond to security incidents, ultimately reducing the risk of cyber attacks. While compliance with regulatory requirements, detection of fraud, and cost reduction are important considerations, enhanced threat visibility is crucial for maintaining a strong cybersecurity posture.

   Source: Adapted from community discussion — koala_lay

   Next question

2. Question 712 · 1243 in bank

   Which of the following provides the MOST essential input for the development of an information security strategy?

   • AResults of an information security gap analysis
   • BMeasurement of security performance against IT goals
   • CResults of a technology risk assessment
   • DAvailability of capable information security resources

   Show answer

   Answer: A

   Explanation

   The results of an information security gap analysis provide a comprehensive understanding of the existing state of information security within an organization, identifying areas where security controls may be lacking or not meeting desired levels. This analysis helps in determining the current state of security and defining the desired future state, which is critical for developing an effective information security strategy. While measurement of security performance against IT goals (option B), results of a technology risk assessment (option C), and the availability of capable information security resources (option D) are important considerations, the information security gap analysis is a foundational step that informs the strategic direction and priorities for the development of the overall information security strategy.

   Source: Adapted from community discussion — Viperhunter

   Next question

3. Question 713 · 1243 in bank

   A business unit handles sensitive personally identifiable information (PII), which presents a significant financial liability to the organization should a breach occur. Which of the following is the BEST way to mitigate the risk to the organization?

   • AImplementing audit logging on systems
   • BIncluding indemnification into customer contracts
   • CContracting the process to a third party
   • DPurchasing insurance

   Show answer

   Answer: D

   Explanation

   The correct answer is (D) Purchasing insurance as this effectively transfer the cost to the insurer. Rationale: A. While Implementing audit logging on systems will help with IR, it does not address the financial liabilities that an organization may face in a breach. B. Including indemnification into customer contracts may solve some of the organization's liability by shifting some of that liability to the customers, but it doesn't protect them against all financial liabilities related to the incident like an insurance policy would. C. Contracting the process to a third party may outsource the responsibility, but not the accountability, and with that accountability comes the exposure to the liabilities. (i.e. still exposed to financial risk cause you can't outsource accountabiltiy)

   Source: Adapted from community discussion — dark_3k03r

   Next question

4. Question 714 · 1243 in bank

   Which of the following would be impacted the MOST by a business decision to move from traditional computing to cloud computing?

   • ASecurity awareness
   • BSecurity standards
   • CSecurity policies
   • DSecurity strategy

   Show answer

   Answer: D

   Next question

5. Question 715 · 1243 in bank

   Key risk indicators (KRIs) are MOST effective when they:

   • Aare mapped to core strategic initiatives.
   • Ballow for comparison with industry peers.
   • Care redefined on a regular basis.
   • Dassess progress toward declared goals.

   Show answer

   Answer: A

   Explanation

   A. are mapped to core strategic initiatives Key risk indicators (KRIs) are metrics that are used to measure the likelihood and potential impact of specific risks to an organization. They are most effective when they are mapped to the organization's core strategic initiatives, as this allows the organization to understand how the identified risks may impact its ability to achieve its goals. This information can then be used to prioritize risk management efforts and to make informed decisions about how to mitigate or manage those risks. While comparison with industry peers, redefining the KRIs on a regular basis, or assessing progress toward declared goals can also provide valuable insights, but these are secondary compared to the first one.

   Source: Adapted from community discussion — mohit05

   Next question

6. Question 716 · 1243 in bank

   An organization's intrusion prevention system (IPS) detected and blocked an unusually large number of external intrusion attempts within a 24-hour period. Which of the following should be the information security manager's FIRST course of action?

   • APerform security assessments on Internet-facing systems.
   • BIdentify the source and nature of the attempts.
   • CReview the server and firewall audit logs.
   • DReport the issue to senior management.

   Show answer

   Answer: B

   Explanation

   B. Identify the source and nature of the attempts should be the information security manager's first course of action after an organization's intrusion prevention system (IPS) detected and blocked an unusually large number of external intrusion attempts within a 24-hour period. Identifying the source of the intrusion attempts, such as the IP addresses or domains involved, and the nature of the attempts, such as the types of attack vectors used, can help to determine the level of threat and the potential impact on the organization. This information can then be used to take appropriate defensive measures, such as blocking the IP addresses or domains involved, and hardening systems against the attack vectors used. The other options such as performing security assessments on Internet-facing systems, reviewing the server and firewall audit logs and reporting the issue to senior management are also important, but identifying the source and nature of the attempts should be the first step to take.

   Source: Adapted from community discussion — Broesweelies

   Next question

7. Question 717 · 1243 in bank

   Which of the following should be the GREATEST consideration when determining the recovery time objective (RTO) for an in-house critical application, database, or server?

   • ADirection from senior management
   • BResults of recovery testing
   • CDetermination of recovery point objective (RPO)
   • DImpact of service interruption

   Show answer

   Answer: D

   Explanation

   D. Impact of service interruption should be the greatest consideration when determining the recovery time objective (RTO) for an in-house critical application, database, or server. RTO is the amount of time within which a business process must be restored after a disaster or disruption, in order to avoid unacceptable consequences. The impact of service interruption will vary depending on the specific application, database, or server in question, and it can include financial loss, reputational damage, legal liability, and loss of customer trust. By understanding the impact of service interruption, the organization can set a realistic RTO that balances the cost of recovery with the potential impact of not recovering in time.

   Source: Adapted from community discussion — Broesweelies

   Next question

8. Question 718 · 1243 in bank

   Which of the following is the PRIMARY purpose of implementing information security standards?

   • ATo provide a basis for developing information security policies
   • BTo provide step-by-step instructions for performing security-related tasks
   • CTo provide management direction with a specific security objective
   • DTo establish a minimum acceptable security baseline

   Show answer

   Answer: D

   Explanation

   D. To establish a minimum acceptable security baseline is the primary purpose of implementing information security standards. Standards provide a framework for achieving a set of security objectives and establish a common set of security controls and guidelines that organizations should implement to protect their information systems. They are designed to be a starting point for organizations to build their own security programs and help ensure that the security measures in place are adequate to protect the organization's sensitive information and assets. Standards provide a common language and a consistent approach to security, which helps organizations to understand their security risks, identify vulnerabilities, and implement appropriate controls to mitigate those risks.

   Source: Adapted from community discussion — Broesweelies

   Next question

9. Question 719 · 1243 in bank

   Which of the following should be the FIRST step in patch management procedures when receiving an emergency security patch?

   • AValidate the authenticity of the patch.
   • BConduct comprehensive testing of the patch.
   • CSchedule patching based on the criticality.
   • DInstall the patch immediately to eliminate the vulnerability.

   Show answer

   Answer: A

   Explanation

   A. Validate the authenticity of the patch should be the first step in patch management procedures when receiving an emergency security patch. Before installing any patch, it is important to ensure that it is genuine and has been released by a trusted source. This step will help to prevent the installation of malicious software or unauthorized patches that could have negative consequences on the system. This step can be done by checking the software vendor's website or by contacting them directly to confirm the authenticity of the patch. After the authenticity of the patch is confirmed, then it is important to schedule patching based on the criticality and conduct comprehensive testing of the patch to ensure that it will not cause any issues on the system before installing it.

   Source: Adapted from community discussion — Broesweelies

   Next question

10. Question 720 · 1243 in bank

    The MOST effective tools for responding to new and advanced attacks are those that detect attacks based on:

    • Abehavior analysis.
    • Bpenetration testing.
    • Csignature analysis.
    • Ddata packet analysis.

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 711. 1243 questions available.