CISM practice questions 741–750

1. Question 741 · 1243 in bank

   Which of the following should an information security manager do FIRST to address the risk associated with a new third-party cloud application that will not meet organizational security requirements?

   • ARestrict application network access temporarily.
   • BUpdate the risk register.
   • CConsult with the business owner.
   • DInclude security requirements in the contract.

   Show answer

   Answer: C

   Explanation

   The FIRST step an information security manager should take to address the risk associated with a new third-party cloud application that will not meet organizational security requirements is to consult with the business owner.

   Source: Adapted from community discussion — Souvik124

   Next question

2. Question 742 · 1243 in bank

   An event occurred that resulted in the activation of the business continuity plan (BCP). All employees were notified during the event, and they followed the plan. However, two major suppliers missed deadlines because they were not aware of the disruption. What is the BEST way to prevent a similar situation in the future?

   • AEnsure service level agreements (SLAs) with suppliers are enforced.
   • BConduct a vulnerability assessment.
   • CPerform testing of the BCP communication plan.
   • DProvide suppliers with access to the BCP document.

   Show answer

   Answer: C

   Explanation

   You are wrong. It is C. See here - two major suppliers missed deadlines because they were not aware of the disruption - this is because of the communication plan NOT because they didn't have acopy of the plan.

   Source: Adapted from community discussion — CarlLimps

   Next question

3. Question 743 · 1243 in bank

   When performing a data classification project, an information security manager should:

   • Aassign information criticality and sensitivity.
   • Bidentify information custodians.
   • Cidentify information owners.
   • Dassign information access privileges.

   Show answer

   Answer: C

   Explanation

   In a data classification project, it is important to identify information owners who are responsible for the data and have the authority to make decisions regarding its classification. The information security manager should work closely with the information owners to understand the nature of the data, its value to the organization, and the appropriate classification levels. By involving information owners in the classification process, the organization can ensure that the classification accurately reflects the criticality and sensitivity of the information.

   Source: Adapted from community discussion — wello

   Next question

4. Question 744 · 1243 in bank

   Which of the following is MOST likely to be a component of a security incident escalation policy?

   • ANames and telephone numbers of key management personnel
   • BA severity-ranking mechanism tied only to the duration of the outage
   • CSample scripts and press releases for statements to media
   • DDecision criteria for when to alert various groups

   Show answer

   Answer: D

   Explanation

   A security incident escalation policy typically includes decision criteria that define when and how to escalate the incident to various levels of management or response teams. This includes clear guidelines on the severity, impact, or characteristics of the incident that warrant escalation to different groups within the organization. This helps ensure a timely and appropriate response to security incidents based on their nature and potential impact. While names and telephone numbers of key management personnel (option A) may be included in the policy, it is not the primary component. A severity-ranking mechanism tied only to the duration of the outage (option B) may not capture the full complexity of security incidents. Sample scripts and press releases for statements to the media (option C) are typically part of a communication plan rather than an escalation policy.

   Source: Adapted from community discussion — Viperhunter

   Next question

5. Question 745 · 1243 in bank

   Which of the following provides the MOST comprehensive information related to an organization's current risk profile?

   • AGap analysis results
   • BRisk register
   • CHeat map
   • DRisk assessment results

   Show answer

   Answer: B

   Explanation

   B. Risk register provides the most comprehensive information related to an organization's current risk profile. A risk register is a document or database that captures and tracks identified risks, their likelihood and impact, the existing controls in place to mitigate them, and the actions that are planned or in progress to address them. It provides a clear overview of all the risks that an organization is currently facing and helps to prioritize risk management efforts.

   Source: Adapted from community discussion — Broesweelies

   Next question

6. Question 746 · 1243 in bank

   Which of the following has the GREATEST impact on the viability of an information security roadmap?

   • ARegulatory requirements
   • BManagement support
   • CThreat landscape
   • DResource availability

   Show answer

   Answer: B

   Explanation

   B. Management support. While all the options (A, B, C, and D) can have an impact on the viability of an information security roadmap, management support plays a critical role in determining the success and effectiveness of the roadmap. Here's a brief explanation of the other options:

   Source: Adapted from community discussion — mad68

   Next question

7. Question 747 · 1243 in bank

   An information security manager is recommending an investment in a new security initiative to address recently published threats. Which of the following is MOST important to include in the business case?

   • AAlignment with the approved IT strategy
   • BPotential impact of threat realization
   • CAvailability of resources to implement the initiative
   • DPeer group threat intelligence report

   Show answer

   Answer: B

   Explanation

   B. Potential impact of threat realization While all of the options listed are relevant and important, assessing the potential impact of threat realization should take precedence. Understanding the potential consequences and harm that can result from these threats is essential for making a strong business case for security investments. This information helps the organization assess the risk and prioritize security initiatives effectively. It allows decision-makers to weigh the potential costs and damages associated with not addressing the threats against the investment required for mitigation. Ultimately, the potential impact of threat realization is a critical factor in demonstrating the urgency and necessity of the security initiative.

   Source: Adapted from community discussion — oluchecpoint

   Next question

8. Question 748 · 1243 in bank

   Which of the following is the MOST important output from a post-incident review?

   • ADocumentation of lessons learned
   • BRepository of digital forensic artifacts
   • CRevised business impact analysis (BIA)
   • DCompilation of incident-related costs

   Show answer

   Answer: A

   Next question

9. Question 749 · 1243 in bank

   Which of the following is the GREATEST benefit of using a network-based intrusion prevention system (IPS)?

   • AThe ability to review and monitor data streams by network segment
   • BThe ability to shut down or block suspicious connections
   • CIncreased visibility into user web surfing
   • DCentralized controls for incident handling

   Show answer

   Answer: B

   Next question

10. Question 750 · 1243 in bank

    What should be the GREATEST concern for an information security manager of a large multinational organization when outsourcing data processing to a cloud service provider?

    • ALocal laws and regulations
    • BBackup and restoration of data
    • CVendor service level agreements (SLAs)
    • DIndependent review of the vendor

    Show answer

    Answer: A

    Explanation

    A. Local laws and regulations While all the options mentioned (A, B, C, and D) are important considerations when outsourcing data processing to a cloud service provider, ensuring compliance with local laws and regulations is often the top priority. This is because legal and regulatory requirements can vary significantly from one location to another, and non-compliance can result in severe legal and financial consequences for the organization. Therefore, understanding and addressing the legal and regulatory implications of data processing in the cloud should be the primary concern to mitigate risks associated with outsourcing.

    Source: Adapted from community discussion — oluchecpoint

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 741. 1243 questions available.