CISM practice questions 861–870

1. Question 861 · 1243 in bank

   Which of the following should an information security manager do FIRST when a mandatory security standard hinders the achievement of an identified business objective?

   • ARecommend risk acceptance.
   • BPerform a cost-benefit analysis.
   • CEscalate to senior management.
   • DRevisit the business objective.

   Show answer

   Answer: C

   Explanation

   C. Escalate to senior management. Escalating the issue to senior management allows for a higher-level decision-making process. Senior management can evaluate the situation, consider the potential risks, and make an informed decision regarding whether to adjust the business objective, allocate additional resources, seek exceptions or waivers from the security standard, or take other appropriate actions. After senior management is aware of the issue and involved in the decision-making process, they may then decide to perform a cost-benefit analysis, revisit the business objective, or recommend risk acceptance if necessary.

   Source: Adapted from community discussion — oluchecpoint

   Next question

2. Question 862 · 1243 in bank

   A business unit is not complying with a control implemented to mitigate risk because doing so impacts the ability to achieve business goals. When reporting the noncompliance to senior management, what would be the information security manager's BEST recommendation?

   • AAccept the noncompliance.
   • BConduct a control assessment.
   • CImplement compensating controls.
   • DEducate the noncompliant users.

   Show answer

   Answer: C

   Explanation

   The correct answer is (C) Implement compensating controls. The reason is that if the main controls don't work then we need a set of alternative controls. These would be the compensating controls by definition. Rationale: A. Accept the noncompliance is incorrect cause some action should be taken to reduce the risk as in option (C) B. Conduct a control assessment is incorrect cause the answer has stated what the outcome would be. D. Educate the noncompliant users is incorrect cause educating the user does nothing to address the risk like (C) would.

   Source: Adapted from community discussion — dark_3k03r

   Next question

3. Question 863 · 1243 in bank

   Which of the following is MOST helpful for protecting an enterprise from advanced persistent threats (APTs)?

   • AUpdated security policies
   • BRegular antivirus updates
   • CDefined security standards
   • DThreat intelligence

   Show answer

   Answer: D

   Next question

4. Question 864 · 1243 in bank

   Which of the following should be the PRIMARY consideration when developing an incident response plan?

   • APreviously reported incidents
   • BManagement support
   • CCompliance with regulations
   • DThe definition of an incident

   Show answer

   Answer: D

   Explanation

   Which of the following should be the PRIMARY consideration when DEVELOPING an incident response plan? The operative word is developing (and not implementing). For developing, it is critical to make a clear distinction between event, incident, problem and disaster. This is required to establish the roles and responsibilities, severity and escalation procedures. If the question were about implementation, then management support would have been a precursor to execution of the IRP.

   Source: Adapted from community discussion — CISSPST

   Next question

5. Question 865 · 1243 in bank

   A strict new regulation is being finalized to address global concerns regarding cybersecurity. Which of the following should the information security manager do FIRST?

   • AMonitor industry response to the regulation.
   • BSeek legal counsel on the new regulation.
   • CValidate the applicability of the regulation.
   • DEscalate compliance risk to senior management

   Show answer

   Answer: C

   Next question

6. Question 866 · 1243 in bank

   An information security manager MUST have an understanding of an information security program?

   • AUnderstanding current and emerging technologies
   • BEstablishing key performance indicators (KPIs)
   • CConducting periodic risk assessments
   • DObtaining stakeholder input

   Show answer

   Answer: D

   Explanation

   An information security manager must have an understanding of an information security program, and obtaining stakeholder input is a crucial aspect of this understanding. Stakeholder input helps in identifying the needs, expectations, and priorities of different stakeholders within the organization, which, in turn, contributes to the development and implementation of an effective information security program.

   Source: Adapted from community discussion — Viperhunter

   Next question

7. Question 867 · 1243 in bank

   A post-incident review identified that user error resulted in a major breach. Which of the following is MOST important to determine during the review?

   • AThe underlying reason for the user error
   • BThe time and location that the breach occurred
   • CAppropriate disciplinary procedures for user error
   • DEvidence of previous incidents caused by the user

   Show answer

   Answer: A

   Next question

8. Question 868 · 1243 in bank

   The BEST way to ensure that frequently encountered incidents are reflected in the user security awareness training program is to include:

   • Aresponses to security questionnaires.
   • Bprevious training sessions.
   • Cexamples of help desk requests.
   • Dresults of exit interviews.

   Show answer

   Answer: C

   Explanation

   The BEST way to ensure that frequently encountered incidents are reflected in the user security awareness training program is to include examples of help desk requests.

   Source: Adapted from community discussion — Souvik124

   Next question

9. Question 869 · 1243 in bank

   A risk assessment exercise has identified the threat of a denial of service (DoS) attack. Executive management has decided to take no further action related to this risk. The MOST likely reason for this decision is:

   • Athe cost of implementing controls exceeds the potential financial losses.
   • Bthe risk assessment has not defined the likelihood of occurrence.
   • Cexecutive management is not aware of the impact potential.
   • Dthe reported vulnerability has not been validated.

   Show answer

   Answer: A

   Explanation

   The MOST likely reason for executive management to take no further action related to the identified threat of a denial of service (DoS) attack would be option A: the cost of implementing controls exceeds the potential financial losses. It is quite common for organizations to conduct a cost-benefit analysis when addressing potential risks. If the cost of implementing controls to mitigate the risk of a DoS attack is deemed to be higher than the potential financial losses that might occur, executive management may decide to accept the risk and not take any further action. This decision is often driven by the organization's risk appetite and the financial resources available to invest in cybersecurity measures.

   Source: Adapted from community discussion — koala_lay

   Next question

10. Question 870 · 1243 in bank

    Which of the following is the BEST indication of an effective information security awareness training program?

    • AAn increase in the identification rate during phishing simulations
    • BAn increase in the speed of incident resolution
    • CAn increase in positive user feedback
    • DAn increase in the frequency of phishing tests

    Show answer

    Answer: A

    Explanation

    I think answer is A. Test results are more credible than user opinion (option C). Increase in the frequency of phishing tests doesn't ensure effectiveness of training. Increase in the speed of incident resolution is not strictly related to awareness: it depends above all on the effectiveness of the incident resolution process.

    Source: Adapted from community discussion — Salilgen

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 861. 1243 questions available.