CISM practice questions 781–790

1. Question 781 · 1243 in bank

   Which of the following is the GREATEST risk of centralized information security administration within a multinational organization?

   • ASlower turnaround
   • BLess uniformity
   • CLess objectivity
   • DViolation of local law

   Show answer

   Answer: D

   Explanation

   The greatest risk of centralized information security administration within a multinational organization is the violation of local law, option D. When a multinational organization centralizes its information security administration, it may face challenges in ensuring compliance with the diverse laws and regulations of different countries where they operate. Laws related to data privacy, data transfer, and cybersecurity can vary significantly between countries. Failing to comply with local laws can result in legal consequences, financial penalties, and damage to the organization's reputation. Therefore, it is crucial for multinational organizations to have a thorough understanding of local laws and establish appropriate measures to comply with them when centralizing their information security administration.

   Source: Adapted from community discussion — koala_lay

   Next question

2. Question 782 · 1243 in bank

   Which of the following would BEST enable an organization to aggregate information from different systems to allow for centralized categorization of incidents?

   • AIntrusion detection system (IDS)
   • BApplication program interfaces (APIs)
   • CIntrusion prevention system (IPS)
   • DSecurity information and event management (SIEM)

   Show answer

   Answer: D

   Next question

3. Question 783 · 1243 in bank

   When preparing an information security policy for a global organization, how should an information security manager BEST address local legislation in multiple countries?

   • ARely on local interpretation of the global policy to comply with local legislation.
   • BCreate a policy exception process for each country.
   • CEnforce the same global policy in every country.
   • DEstablish local policies for each country that supplement the global policy.

   Show answer

   Answer: D

   Explanation

   Option D, establishing local policies for each country that supplement the global policy, is the most effective approach. This approach allows organizations to maintain a consistent global security framework while ensuring compliance with local legislation and addressing specific country requirements. It enables organizations to strike a balance between global standards and local needs, promoting effective information security management across the entire organization.

   Source: Adapted from community discussion — koala_lay

   Next question

4. Question 784 · 1243 in bank

   Which of the following is the MOST important control to implement when senior managers use smartphones to access sensitive company information?

   • ACentralized device administration
   • BRemote wipe capability
   • CAnti-malware on the devices
   • DStrong passwords

   Show answer

   Answer: B

   Explanation

   A states: Centralized device ADMINISTRATION, not management. If it was Centralized device management then this would cover remote wipe. But administration does not cover wipe capability.

   Source: Adapted from community discussion — rbg8

   Next question

5. Question 785 · 1243 in bank

   Which of the following is the MOST appropriate resource to determine whether or not a particular solution should utilize encryption based on its location and data classification?

   • AGuidelines
   • BProcedures
   • CStandards
   • DPolicies

   Show answer

   Answer: D

   Explanation

   D. Policies would be the most appropriate resource to determine whether or not a particular solution should utilize encryption based on its location and data classification. Policies are a set of rules and regulations that dictate how data should be handled and protected. They typically outline specific requirements for data encryption, and may take into account factors such as the location of the data and its classification level.

   Source: Adapted from community discussion — mohit05

   Next question

6. Question 786 · 1243 in bank

   An organization that conducts business globally is planning to utilize a third-party service provider to process payroll information. Which of the following issues poses the GREATEST risk to the organization?

   • AThe third party has not provided evidence of compliance with local regulations where data is generated.
   • BThe third party does not have an independent assessment of controls available for review.
   • CThe third party’s service level agreement (SLA) does not include guarantees of uptime.
   • DThe third-party contract does not include an indemnity clause for compensation in the event of a breach.

   Show answer

   Answer: A

   Explanation

   option A, where the third party has not provided evidence of compliance with local regulations where data is generated, poses the greatest risk to the organization. When conducting business globally, it is crucial to adhere to local regulations, especially when handling sensitive information such as payroll data. Failing to comply with these regulations could lead to legal consequences, financial penalties, and damage to the organization's reputation. Therefore, it is essential for the organization to ensure that the third-party service provider can demonstrate compliance with local regulations before entrusting them with sensitive payroll information.

   Source: Adapted from community discussion — koala_lay

   Next question

7. Question 787 · 1243 in bank

   The PRIMARY objective of timely declaration of a disaster is to:

   • Aensure the continuity of the organization’s essential services.
   • Bprotect critical physical assets from further loss.
   • Censure engagement of business management in the recovery process.
   • Dassess and correct disaster recovery process deficiencies.

   Show answer

   Answer: A

   Explanation

   A. ensure the continuity of the organization’s essential services. The primary objective of timely declaring a disaster is to ensure the continuity of the organization's essential services. This means that the organization is able to quickly activate its disaster recovery plan and take the necessary actions to minimize the disruption to its operations. This can include protecting critical physical assets, engaging business management in the recovery process, and assessing and correcting disaster recovery process deficiencies, but all of those are secondary objectives or outcomes.

   Source: Adapted from community discussion — Broesweelies

   Next question

8. Question 788 · 1243 in bank

   Which of the following BEST determines what information should be shared with different entities during incident response?

   • AEscalation procedures
   • BCommunication plan
   • CDisaster recovery policy
   • DBusiness continuity plan (BCP)

   Show answer

   Answer: B

   Next question

9. Question 789 · 1243 in bank

   Which of the following BEST enables the design of an effective incident escalation process?

   • AA well-defined organizational hierarchy
   • BEnforceable control baselines
   • CA comprehensive risk register
   • DControls designed for defense in depth

   Show answer

   Answer: A

   Explanation

   The best answer to this question is A. A well-defined organizational hierarchy. A well-defined organizational hierarchy helps to ensure clear lines of responsibility and accountability during an incident response. This can help ensure that incidents are escalated to the appropriate personnel in a timely manner and that decisions are made quickly and effectively. This is a key component of an effective incident escalation process, as it helps to ensure that incidents are properly managed and that the impact of a security breach is minimized.

   Source: Adapted from community discussion — Broesweelies

   Next question

10. Question 790 · 1243 in bank

    An information security manager has been notified that two senior executives have the ability to elevate their own privileges in the corporate accounting system, in violation of policy. What is the FIRST step to address this issue?

    • ANotify the CISO of the security policy violation.
    • BPerform a system access review.
    • CPerform a full review of all system transactions over the past 90 days.
    • DImmediately suspend the executives’ access privileges.

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 781. 1243 questions available.