CISM practice questions 761–770

1. Question 761 · 1243 in bank

   Which of the following is MOST important to consider when developing a business case to support the investment in an information security program?

   • ASenior management support
   • BResults of a risk assessment
   • CResults of a cost-benefit analysis
   • DImpact on the risk profile

   Show answer

   Answer: C

   Explanation

   he most important thing to consider when developing a business case to support the investment in an information security program is the results of a cost-benefit analysis. This is because a cost-benefit analysis will help to quantify the benefits of the investment and to compare them to the costs. This information is essential for convincing stakeholders to invest in the information security program.

   Source: Adapted from community discussion — paul1394

   Next question

2. Question 762 · 1243 in bank

   The PRIMARY reason for using metrics as part of an information security program is to help management:

   • Adetermine whether objectives are being met.
   • Bvisualize security trends.
   • Cdevelop an information security baseline.
   • Dtrack financial impact of the program.

   Show answer

   Answer: A

   Next question

3. Question 763 · 1243 in bank

   After an information security incident has been detected and its priority established, which of the following should be the NEXT course of action?

   • AGathering evidence
   • BEradicating the incident
   • CPerforming a risk assessment
   • DContaining the incident

   Show answer

   Answer: D

   Explanation

   Correct Answer D Gathering Evidence not required until any investigation requirement confirmed; Eradication is not initial steps; Risk Assessment not required as it is Incident. Hence D

   Source: Adapted from community discussion — karanvp

   Next question

4. Question 764 · 1243 in bank

   Which of the following is the MOST important input to the development of an effective information security strategy?

   • AWell-defined security policies and procedures
   • BCurrent and desired state of security
   • CBusiness processes and requirements
   • DRisk and business impact assessments

   Show answer

   Answer: C

   Explanation

   C. Business processes and requirements An effective information security strategy should align with the overall business objectives and support the organization's processes and requirements. Without understanding the business processes and requirements, it is difficult to develop a strategy that addresses the specific needs of the organization and aligns with its goals. A security strategy that does not align with the organization's objectives and processes is less likely to be effective in reducing risk and protecting the organization's assets.

   Source: Adapted from community discussion — mohit05

   Next question

5. Question 765 · 1243 in bank

   Which of the following is MOST important to review following a security incident?

   • AIncident response procedures
   • BResponse tools and techniques
   • CIncident response plan
   • DLessons learned

   Show answer

   Answer: D

   Next question

6. Question 766 · 1243 in bank

   Company A, a cloud service provider, is in the process of acquiring Company B to gain new benefits by incorporating their technologies within its cloud services. Which of the following should be the PRIMARY focus of Company A's information security manager?

   • AThe cost to align to Company A's security policies
   • BThe organizational structure of Company B
   • CCompany B's security policies
   • DCompany A's security architecture

   Show answer

   Answer: C

   Explanation

   When acquiring another company, understanding and assessing the security policies and practices of the acquired entity (Company B, in this case) is crucial. This ensures that the integration process takes into account any differences in security policies, controls, and practices between the two organizations. Harmonizing security policies and aligning security controls across both entities is essential for maintaining a consistent and effective security posture. While factors such as the cost to align with Company A's security policies (option A), the organizational structure of Company B (option B), and Company A's security architecture (option D) are important considerations, understanding and addressing the security policies of the acquired company is a key priority during the integration process.

   Source: Adapted from community discussion — Viperhunter

   Next question

7. Question 767 · 1243 in bank

   Which of the following is necessary to ensure consistent protection for an organization’s information assets?

   • AControl assessment
   • BData ownership
   • CRegulatory requirements
   • DClassification mode

   Show answer

   Answer: A

   Explanation

   I think Correct Answer is A and May not be D. Because, Classification may determine the protection level; but ensure that protection, Controls should be assessed periodically.

   Source: Adapted from community discussion — karanvp

   Next question

8. Question 768 · 1243 in bank

   A new law requires an organization to implement specific security controls. Which of the following should the information security manager do FIRST?

   • AIntegrate the new requirements into the security policy.
   • BPerform a gap analysis on the new requirements.
   • CDevelop a control implementation plan.
   • DAssess the risk of noncompliance with the new requirements.

   Show answer

   Answer: B

   Explanation

   The first thing the information security manager should do is perform a gap analysis on the new requirements. A gap analysis is a process of comparing the current state of the organization's security against the new legal requirements to identify any areas where the organization falls short of meeting the new requirements. This step is important to identify the specific areas where the organization needs to improve its security controls in order to comply with the new law. Once the gap analysis is complete, the organization can develop a control implementation plan, integrate the new requirements into the security policy, and assess the risk of noncompliance with the new requirements.

   Source: Adapted from community discussion — Broesweelies

   Next question

9. Question 769 · 1243 in bank

   Which of the following BEST demonstrates that security controls are effective?

   • AAudit report
   • BTabletop simulation
   • CRisk and control self-assessment
   • DBusiness impact analysis (BIA) results

   Show answer

   Answer: A

   Explanation

   • Internal and external audit results: Audit reports are generally seen as an in-depth view of the effectiveness of internal controls in the organization. Gregory, Peter H.; Gregory, Peter H.. CISM Certified Information Security Manager Bundle (p. 132). McGraw Hill LLC. Kindle Edition.

   Source: Adapted from community discussion — CarlPTY07

   Next question

10. Question 770 · 1243 in bank

    Which of the following activities provides the GREATEST insight into the level of threat exposure within an IT environment?

    • AExecuting an organization-wide security audit
    • BPerforming penetration testing
    • CPerforming technical vulnerability assessments
    • DConducting a red team exercise

    Show answer

    Answer: D

    Explanation

    D. Conducting a red team exercise: A red team exercise goes beyond vulnerability assessments and penetration testing. It simulates a realistic attack scenario, where a team of skilled professionals (the red team) tries to breach your organization's defenses using the same tactics and techniques that real-world attackers might employ. This approach provides a comprehensive assessment of an organization's threat exposure, including its ability to detect, respond to, and mitigate sophisticated attacks. It helps organizations understand their weaknesses in a more holistic and realistic manner, making it the most effective option for assessing threat exposure.

    Source: Adapted from community discussion — oluchecpoint

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 761. 1243 questions available.