CISM practice questions 801–810

1. Question 801 · 1243 in bank

   A software vendor has announced a zero-day vulnerability that exposes an organization’s critical business systems. The vendor has released an emergency patch. Which of the following should be the information security manager’s PRIMARY concern?

   • AAbility to test the patch prior to deployment
   • BAdequacy of the incident response plan
   • CAvailability of resources to implement controls
   • DDocumentation of patching procedures

   Show answer

   Answer: A

   Next question

2. Question 802 · 1243 in bank

   What is the MOST important reason to regularly report information security risk to relevant stakeholders?

   • ATo enable risk-informed decision making
   • BTo reduce the impact of information security risk
   • CTo ensure information security controls are effective
   • DTo achieve compliance with regulatory requirements

   Show answer

   Answer: A

   Next question

3. Question 803 · 1243 in bank

   Which of the following is MOST important to ensure ongoing senior management commitment to an organization’s information security strategy?

   • AEffective and reliable security reporting
   • BA well-defined information security control framework
   • CA detailed and documented business impact analysis (BIA)
   • DStrategic alignment to an industry framework

   Show answer

   Answer: A

   Next question

4. Question 804 · 1243 in bank

   A penetration test of a new system has identified a number of critical vulnerabilities, jeopardizing the go-live date. The information security manager is asked by the system owner to approve an exception to allow the system to be implemented without fixing the vulnerabilities. Which of the following is the MOST appropriate course of action?

   • AImplement a log monitoring process.
   • BPerform a risk assessment.
   • CDevelop a set of compensating controls.
   • DApprove and document the exception.

   Show answer

   Answer: B

   Explanation

   Per CRISC manual pg. 53 - ISO/IEC Process steps, specifically Risk Assessment - Risk assessment determines the value of the info assets, identifies the applicable threats and vulns that exist, identifies the consequences and prioritizes the derived risk and ranks it against the risk evaluation criteria st in the context establishment. This process consists of risk identification, risk analysis and risk evaluation.

   Source: Adapted from community discussion — CarlLimps

   Next question

5. Question 805 · 1243 in bank

   Which of the following information security activities is MOST helpful to support compliance with information security policy?

   • AConducting information security awareness programs
   • BCreating monthly trend metrics
   • CPerforming periodic IT reviews on new system acquisitions
   • DObtaining management commitment

   Show answer

   Answer: A

   Explanation

   A. Conducting information security awareness programs. Obtaining management commitment is essential for overall security success, but it's awareness programs that have the most direct impact on ensuring employees follow security policies.

   Source: Adapted from community discussion — Raj91188

   Next question

6. Question 806 · 1243 in bank

   Which of the following is MOST important to determine following the discovery and eradication of a malware attack?

   • AThe creator of the malware
   • BThe malware entry path
   • CThe type of malware involved
   • DThe method of detecting the malware

   Show answer

   Answer: B

   Next question

7. Question 807 · 1243 in bank

   Which of the following is MOST helpful in ensuring an information security governance framework continues to support business objectives?

   • AA consistent risk assessment methodology
   • BA monitoring strategy
   • CAn effective organizational structure
   • DStakeholder buy-in

   Show answer

   Answer: D

   Explanation

   D. Stakeholder buy-in is the most helpful in ensuring an information security governance framework continues to support business objectives. For a framework to be effective, it must have the support and buy-in of all stakeholders, including executives, managers, employees, and customers. This involves communicating the importance of information security and ensuring that everyone understands their role in supporting the framework. When stakeholders are invested in the framework and understand its goals, they are more likely to follow policies and procedures, report incidents, and support continuous improvement.

   Source: Adapted from community discussion — Broesweelies

   Next question

8. Question 808 · 1243 in bank

   Reviewing which of the following would be MOST helpful when a new information security manager is developing an information security strategy for a non-regulated organization?

   • AManagement’s business goals and objectives
   • BStrategies of other non-regulated companies
   • CIndustry best practices and control recommendations
   • DRisk assessment results

   Show answer

   Answer: A

   Next question

9. Question 809 · 1243 in bank

   In order to understand an organization's security posture, it is MOST important for an organization's senior leadership to:

   • Areview the number of reported security incidents.
   • Bevaluate results of the most recent incident response test.
   • Censure established security metrics are reported.
   • Dassess progress of risk mitigation efforts.

   Show answer

   Answer: C

   Explanation

   ALL IN ONE CISM EXAM GUIDE, Mc Graw Hill Information Security Program Metrics A metric is a measurement of a periodic or ongoing activity intended to help management understand the activity within the context of overall business operations. In short, metrics are the means through which management can measure key processes and know whether their strategies are working. Metrics are used in many operational processes, but this section emphasizes metrics related to security governance. In other words, there is a distinction between tactical IT security metrics and those that reveal the state of the overall security program. The two are often related, however, as discussed in the sidebar “Return on Security Investment,” later in this chapter.

   Source: Adapted from community discussion — Thavee

   Next question

10. Question 810 · 1243 in bank

    Information security controls should be designed PRIMARILY based on:

    • Aregulatory requirements.
    • Ba vulnerability assessment.
    • Cbusiness risk scenarios.
    • Da business impact analysis (BIA).

    Show answer

    Answer: C

    Explanation

    Information security controls should be designed primarily based on business risk scenarios because they ensure that an organization's most important assets and processes are protected. A business risk scenario is a hypothetical situation that could potentially cause harm to the organization's assets or operations. By identifying and understanding these scenarios, an organization can prioritize its efforts and resources to mitigate the most significant risks to the business. Additionally, this approach allows the organization to align its security controls with its overall risk management strategy and business objectives.

    Source: Adapted from community discussion — Broesweelies

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 801. 1243 questions available.