Question 851 · 1243 in bank
Of the following, whose input is of GREATEST importance in the development of an information security strategy?
Show answer
Answer: D
Certified Information Security Manager1,243 questions across 125 pages are complete and free, with no account or card.
1243 questions in this bank
Free access · progress saved on this device
Of the following, whose input is of GREATEST importance in the development of an information security strategy?
Answer: D
Which risk is introduced when using only sanitized data for the testing of applications?
Answer: A
A. Unexpected outcomes may arise in production. Sanitized data used in testing may not accurately represent the real-world data and scenarios that the application will encounter in production. As a result, unexpected outcomes or issues may arise when the application is deployed in a production environment where it interacts with actual, un-sanitized data. This is why it's essential to use realistic and representative data during testing to minimize the risk of unexpected problems in the production environment.
Source: Adapted from community discussion — oluchecpoint
Which of the following is the MOST important consideration when defining a recovery strategy in a business continuity plan (BCP)?
Answer: C
Which of the following should be done FIRST when developing an information security program?
Answer: B
An information security manager MUST have an understanding of the organization's business goals to:
Answer: B
B. develop an information security strategy. An information security manager MUST have an understanding of the organization's business goals to develop an information security strategy. The security strategy should align with the overall business objectives and support the organization's mission and goals. Without understanding the business goals, it would be difficult for the information security manager to determine the appropriate level of security and prioritize the allocation of resources to protect the organization's most critical assets and data. An understanding of the business goals can also help in relating information security to change management, developing operational procedures and defining key performance indicators (KPIs) but it's crucial for developing an information security strategy.
Source: Adapted from community discussion — Broesweelies
The BEST way to identify the risk associated with a social engineering attack is to:
Answer: D
Conducting regular security awareness training and testing can help organizations gauge their employees' susceptibility to social engineering attacks and provide an opportunity to reinforce best practices and correct any weaknesses in their security posture. Monitoring IDS, reviewing SSO authentication logs, and performing business risk assessments are important components of overall security, but they may not directly assess user susceptibility to social engineering, which is the primary concern in this context.
Source: Adapted from community discussion — oluchecpoint
Which of the following is MOST important to have in place to help ensure an organization's cybersecurity program meets the needs of the business?
Answer: C
C. Information security governance Information security governance is the most important factor to have in place to ensure an organization's cybersecurity program meets the needs of the business. Information security governance encompasses the policies, processes, and framework that guide and oversee an organization's overall information security program. It provides the foundation for making strategic decisions regarding cybersecurity, aligning security efforts with business objectives, and ensuring that security measures are effectively implemented and maintained.
Source: Adapted from community discussion — oluchecpoint
Which of the following is the GREATEST benefit of including incident classification criteria within an incident response plan?
Answer: D
A recovery point objective (RPO) is required in which of the following?
Answer: D
I chose D, but I agree that the question itself is flawed, because both A and D are correct. Below are 2 quotes to proof (quote from the CISM All-in-one Exam guide): "Components of a Business Continuity Plan: [...] Analysis documents [...] Documents defining recovery targets such as RTO, RPO, RCO, and RCapO" (p. 452). Hence RPO is needed in BCP. "The outputs from these activities are the key inputs for DRP [...] Key recovery targets specify how quickly specific IT applications are to be recovered" (p. 455). Hence, RPO is needed in DRP AS WELL. Still, from a gut-feel, I think they want option D to be the right answer, because the RPO is "more needed" in the DRP than in BCP (if that's a valid reason to defend...).
Source: Adapted from community discussion — Josef4CISM
Which of the following provides the BEST assurance that security policies are applied across business operations?
Answer: A
The Correct answer is (A) Organizational standards are enforced by technical controls. This is because the keyword is "applies" and technical control applies them. Rationale (B) Organizational standards are included in awareness training is incorrect cause awareness bring attention, but not enforcement. (C) Organizational standards are required to be formally accepted is incorrect because just cause something is accepted doesn't mean it is acted upon. (D) Organizational standards are documented in operational procedures is incorrect because just cause something is written down doesn't mean it has been acted upon.
Source: Adapted from community discussion — dark_3k03r
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISM practice, question 851. 1243 questions available.
Version 1.0.0. How we source questions