Certified Information Security Manager1,243 questions across 125 pages are complete and free, with no account or card.
1243 questions in this bank
Free access · progress saved on this device
Penetration testing is MOST appropriate when a:
Answer: A
I don't like any of the answers, but if I had to pick one, I'd pick A. Option D is not correct because you cannot pentest a design.
Source: Adapted from community discussion — AlexJacobson
Which of the following will result in the MOST accurate controls assessment?
Answer: B
"Unannounced testing," is likely to result in the MOST accurate controls assessment because it directly evaluates the effectiveness of controls in real-time situations without prior knowledge.
Source: Adapted from community discussion — oluchecpoint
The MOST important reason for having an information security manager serve on the change management committee is to:
Answer: B
IT Security Manager is included to advice on change related IT Security risks if any arises or if any that can be foreseen.
Source: Adapted from community discussion — yottabyte
Of the following, who is in the BEST position to evaluate business impacts?
Answer: A
A. Senior management is in the BEST position to evaluate business impacts, as they are responsible for the overall strategy and direction of the organization, and have the authority and access to resources to make decisions that affect the entire organization.
Source: Adapted from community discussion — Broesweelies
Which of the following should be done FIRST when establishing a new data protection program that must comply with applicable data privacy regulations?
Answer: C
Which of the following is the BEST approach to incident response for an organization migrating to a cloud-based solution?
Answer: C
An attacker was able to gain access to an organization's perimeter firewall and made changes to allow wider external access and to steal data. Which of the following would have BEST provided timely identification of this incident?
Answer: C
C. Deploying a security information and event management system (SIEM) would have BEST provided timely identification of this incident. SIEM systems collect and analyze log data from various security devices, such as firewalls, intrusion detection systems, and servers, and can identify and alert on suspicious or anomalous activity. In this scenario, a SIEM would have been able to detect the changes to the firewall and potentially the data exfiltration, and alert the security team in real-time or near real-time.
Source: Adapted from community discussion — Broesweelies
Which of the following is the BEST way to help ensure an organization's risk appetite will be considered as part of the risk treatment process?
Answer: C
Requiring steering committee approval of risk treatment plans is the BEST way to help ensure an organization's risk appetite will be considered as part of the risk treatment process, so the correct answer is C.
Source: Adapted from community discussion — bambs
Which of the following is MOST important to include in a post-incident review following a data breach?
Answer: D
The MOST important aspect to include in a post-incident review following a data breach is D. Evaluations of the adequacy of existing controls. It is important to assess and evaluate the effectiveness of the existing controls in place to prevent such incidents from happening in the future. This will help identify any gaps or weaknesses in the current security measures and guide the organization in implementing improvements and making necessary changes to prevent similar incidents from happening again.
Source: Adapted from community discussion — Broesweelies
An organization plans to leverage popular social network platforms to promote its products and services. Which of the following is the BEST course of action for the information security manager to support this initiative?
Answer: B
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISM practice, question 871. 1243 questions available.
Version 1.0.0. How we source questions