CISM practice questions 71–80

1. Question 71 · 1243 in bank

   Which of the following is the BEST reason for senior management to support a business case for developing a monitoring system for a critical application?

   • AThe system can be replicated for additional use cases.
   • BAn industry peer experienced a recent breach with a similar application.
   • CThe cost of implementing the system is less than the impact of downtime.
   • DThe solution is within the organization's risk tolerance.

   Show answer

   Answer: C

   Explanation

   c all the way, d is more of a risk assessment , just because you can tolerate a solution, dont mean its free. it costs money, no company will spend money on a solution because they can "tolerate" it. C on the other hands is telling you hey, this app would cost us 10 dollars if breached, but it only costs 2 dollars to mitigate it. just my two cents

   Source: Adapted from community discussion — david124

   Next question

2. Question 72 · 1243 in bank

   Which of the following is MOST important when developing an information security governance framework?

   • AEnsuring alignment with the organization's risk management framework
   • BIntegrating security within the system development life cycle (SDLC) process
   • CDeveloping policies and procedures to support the framework
   • DDeveloping security incident response measures

   Show answer

   Answer: A

   Next question

3. Question 73 · 1243 in bank

   What should be an information security manager's GREATEST concern when an HR department outsources data processing to a cloud service provider?

   • ASecurity posture of the provider
   • BData loss protection insurance
   • CRequired provider service levels
   • DThe scope of the data

   Show answer

   Answer: D

   Next question

4. Question 74 · 1243 in bank

   Which of the following BEST enables the capability of an organization to sustain the delivery of products and services within acceptable time frames and at predefined capacity during a disruption?

   • ABusiness continuity plan (BCP)
   • BDisaster recovery plan (DRP)
   • CBusiness impact analysis (BIA)
   • DService level agreement (SLA)

   Show answer

   Answer: A

   Next question

5. Question 75 · 1243 in bank

   Which of the following BEST determines an information asset's classification?

   • ACriticality to a business process
   • BValue of the information asset in the marketplace
   • CRisk assessment from the data owner
   • DCost of producing the information asset

   Show answer

   Answer: A

   Next question

6. Question 76 · 1243 in bank

   Which of the following is the PRIMARY objective of a cyber resilience strategy?

   • ABusiness continuity
   • BEmployee awareness
   • CExecutive support
   • DRegulatory compliance

   Show answer

   Answer: A

   Next question

7. Question 77 · 1243 in bank

   Which of the following is the MOST important reason for an organization to communicate to affected parties that a security incident has occurred?

   • ATo improve awareness of information security
   • BTo disclose the root cause of the incident
   • CTo comply with regulations regarding notification
   • DTo increase goodwill toward the organization

   Show answer

   Answer: C

   Next question

8. Question 78 · 1243 in bank

   Which of the following is the BEST indication that an information security control is no longer relevant?

   • AThe control is not cost efficient.
   • BThe control does not support a specific business function.
   • CIT management does not support the control.
   • DThe technology related to the control is obsolete.

   Show answer

   Answer: B

   Next question

9. Question 79 · 1243 in bank

   Which of the following is the PRIMARY advantage of an organization using Disaster Recovery as a Service (DRaaS) to help manage its disaster recovery program?

   • AIt offers the organization flexible deployment options using cloud infrastructure.
   • BIt allows the organization to prioritize its core operations.
   • CIt is more secure than traditional data backup architecture.
   • DIt allows the use of a professional response team at a lower cost.

   Show answer

   Answer: B

   Explanation

   Leaning towards B as this similar questions appear in CISM Q&A. It refer to DR as a service which involve more than cloud operation but recovery services. Organisations with limited resources or experience technical usually opt for this so they can focus on other core operations.

   Source: Adapted from community discussion — afoo1314

   Next question

10. Question 80 · 1243 in bank

    An organization wants to enable digital forensics for a business-critical application. Which of the following will BEST help to support this objective?

    • AInstall biometric access control.
    • BDevelop an incident response plan.
    • CDefine data retention criteria.
    • DEnable activity logging.

    Show answer

    Answer: D

    Explanation

    Enabling activity logging would be the BEST option to support digital forensics for a business-critical application. Activity logging allows for detailed tracking of user actions within the application, which can be invaluable for forensic analysis in the event of an incident or security breach. The other options may be important for overall security and incident response, but are not specifically focused on supporting digital forensics.

    Source: Adapted from community discussion — mad68

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 71. 1243 questions available.