CISM practice questions 731–740

1. Question 731 · 1243 in bank

   Changes have been proposed to a large organization's enterprise resource planning (ERP) system that would violate existing security standards. Which of the following should be done FIRST to address this conflict?

   • APerform a cost-benefit analysis
   • BCalculate business impact levels.
   • CValidate current standards.
   • DImplement updated standards.

   Show answer

   Answer: B

   Explanation

   By calculating the business impact levels, the organization can assess the potential consequences and risks associated with the proposed changes. This includes considering the impact on data integrity, confidentiality, availability, compliance, and overall business operations. Once the business impact levels have been determined, the organization can then make informed decisions regarding the acceptance, mitigation, or modification of the proposed changes in order to align with the existing security standards and minimize any adverse effects.

   Source: Adapted from community discussion — wello

   Next question

2. Question 732 · 1243 in bank

   Which of the following should an information security manager do NEXT after creating a roadmap to execute the strategy for an information security program?

   • ADevelop a project plan to implement the strategy
   • BObtain consensus on the strategy from the executive board
   • CDefine organizational risk tolerance
   • DReview alignment with business goals

   Show answer

   Answer: A

   Next question

3. Question 733 · 1243 in bank

   An organization has just updated its backup capability to a new cloud-based solution. Which of the following tests will MOST effectively verify this change is working as intended?

   • ASimulation testing
   • BTabletop testing
   • CParallel testing
   • DBlack box testing

   Show answer

   Answer: C

   Next question

4. Question 734 · 1243 in bank

   Which of the following should be the PRIMARY focus of a status report on the information security program to senior management?

   • AConfirming the organization complies with security policies
   • BVerifying security costs do not exceed the budget
   • CDemonstrating risk is managed at the desired level
   • DProviding evidence that resources are performing as expected

   Show answer

   Answer: C

   Explanation

   Demonstrating that risk is managed at the desired level is a key aspect of informing senior management about the effectiveness and success of the information security program. This involves providing an overview of risk assessments, mitigation efforts, and the overall state of the organization's risk posture. It enables senior management to make informed decisions about the allocation of resources and the ongoing effectiveness of the information security program in addressing organizational risks. While confirming compliance with security policies (option A), verifying security costs do not exceed the budget (option B), and providing evidence that resources are performing as expected (option D) are important considerations, the primary goal is to ensure that the organization's risk is managed effectively in alignment with its risk tolerance and business objectives.

   Source: Adapted from community discussion — Viperhunter

   Next question

5. Question 735 · 1243 in bank

   Which of the following is the BEST way to obtain reliable information to help an incident response team maintain awareness of emerging security threats and vulnerabilities?

   • ASubscribe to a reputed threat intelligence group.
   • BAssign staff to engage with social media hacking groups.
   • CReview alerts from a security information and event management (SIEM) system.
   • DImplement vulnerability scanners.

   Show answer

   Answer: A

   Next question

6. Question 736 · 1243 in bank

   Which of the following is the MOST effective approach to ensure seamless integration between the business continuity plan (BCP) and the incident response plan?

   • AThe BCP manager is included in the core incident response team.
   • BCriteria for escalating to the BCP manager are in the incident response plan.
   • CBoth response teams contain the same members.
   • DConsistent event classifications are used in both plans.

   Show answer

   Answer: D

   Explanation

   The MOST effective approach to ensure seamless integration between the business continuity plan (BCP) and the incident response plan is to use consistent event classifications in both plans. This approach will ensure that the same events are recognized and handled consistently across both plans, facilitating a smooth transition between incident response and business continuity activities. While the other options may also help to integrate the two plans, they are not as effective as using consistent event classifications.

   Source: Adapted from community discussion — Souvik124

   Next question

7. Question 737 · 1243 in bank

   Which of the following is an information security manager's BEST course of action when a potential business breach is discovered in a critical business system?

   • AUpdate the incident response plan.
   • BInform affected stakeholders.
   • CInform IT management.
   • DImplement mitigating actions immediately.

   Show answer

   Answer: B

   Explanation

   I misread and didn't realise at this stage it is only a potential issue. I think it's a shit question because: Why tell stakeholders when there isn't definitely an issue? Why begin mitigation efforts if there may not be an issue? You wouldn't do either.

   Source: Adapted from community discussion — AaronS1990

   Next question

8. Question 738 · 1243 in bank

   Which of the following is MOST important to include in a report of an organization's information security risk?

   • AControl risk
   • BMitigated risk
   • CResidual risk
   • DInherent risk

   Show answer

   Answer: C

   Next question

9. Question 739 · 1243 in bank

   Which of the following is an information security manager's BEST recommendation to senior management following a breach at the organization's Software as a Service (SaaS) vendor?

   • AEngage legal counsel
   • BTerminate the relationship with the vendor
   • CRenegotiate the vendor contract
   • DUpdate the vendor risk assessment

   Show answer

   Answer: A

   Explanation

   The Correct answer is (A) Engage legal counsel as we must now interact with the SaaS provider in a way that may turn litigious. Rationale: B. Terminating the relationship with the vendor does not absolve the organization from the security breach responsibilities. C. Renegotiate the vendor contract may be in the cards, but this has to be done after the situation is resolved. D. Update the vendor risk assessment is something that should have been done proactively not after the fact. Doing this at this part of the stage is a bit late.

   Source: Adapted from community discussion — dark_3k03r

   Next question

10. Question 740 · 1243 in bank

    Which of the following is MOST important to consider when determining asset valuation?

    • APotential business loss
    • BAsset classification level
    • CAsset recovery cost
    • DCost of insurance premiums

    Show answer

    Answer: A

    Explanation

    A. Potential business loss. When determining asset valuation, it is crucial to consider the potential business loss associated with the asset. The potential business loss refers to the impact or consequences that would arise if the asset were compromised, damaged, or lost. By evaluating the potential business loss, organizations can prioritize their investments in protecting and securing assets based on their criticality and the potential impact on business operations, reputation, and financial stability.

    Source: Adapted from community discussion — mad68

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 731. 1243 questions available.