Certified Information Security Manager1,243 questions across 125 pages are complete and free, with no account or card.
1243 questions in this bank
Free access · progress saved on this device
In an organization with a rapidly changing environment, business management has accepted an information security risk. It is MOST important for the information security manager to ensure:
Answer: C
Correct Answer is C: Bcas, rapidly changing environment; hence the risk should be reassessed periodically and approval also require to re-revisit periodically.
Source: Adapted from community discussion — karanvp
Which of the following is the BEST course of action for an information security manager to align security and business goals?
Answer: C
What should be the information security manager’s FIRST step when updating an information security program?
Answer: D
C and D is more relevant here. To Identify gap i.e. program components that do not align with business expectation and objectives, first need to re-evaluate current business expectations and objectives. Hence D is correct.
Source: Adapted from community discussion — karanvp
Which of the following defines the triggers within a business continuity plan (BCP)?
Answer: B
The answer is B. Needs of the organization as this is the only answer that is flexible enough account for any type of event. Rationale A. Disaster recovery plan (DRP) is incorrect cause DRP is a subset of BCP. Saying that DRP will trigger a BCP is recursive logic. C. Information security policy is incorrect cause a policy states a broad-level objective, but doesn't provide prescriptive guidance only descriptive. D. Gap analysis - this is the difference between a current and future state which is not relevant for this question.
Source: Adapted from community discussion — dark_3k03r
A cloud application used by an organization is found to have a serious vulnerability. After assessing the risk, which of the following would be the information security manager's BEST course of action?
Answer: D
I would go with D. The cloud application used by the org sounds like a third party off the shelf app. You wouldn't initiate your orgs IR process for a third party cloud solution
Source: Adapted from community discussion — ddharia94
Which of the following is the BEST indication of a successful information security culture?
Answer: B
Which of the following plans should be invoked by an organization in an effort to remain operational during a disaster?
Answer: D
Which of the following sources is MOST useful when planning a business-aligned information security program?
Answer: D
Enterprise architecture provides a comprehensive view of the organization's strategy, business processes, information flows, technologies, and infrastructure. Aligning the information security program with the enterprise architecture ensures that security initiatives are in sync with the organization's overall objectives and infrastructure, thus ensuring both efficiency and effectiveness. While the other options are important components of a security program, the EA provides a broader view that encompasses all these elements and aligns them with business goals.
Source: Adapted from community discussion — Kunzle
For an organization that provides web-based services, which of the following security events would MOST likely initiate an incident response plan and be escalated to management?
Answer: D
D. Suspicious network traffic originating from the demilitarized zone (DMZ) would MOST likely initiate an incident response plan and be escalated to management. The DMZ is a network segment that is typically used to host public-facing servers, such as web servers, and it is considered a high-risk area. Suspicious network traffic originating from the DMZ could indicate that an attacker has breached the perimeter and is attempting to move laterally through the network, or it could be a sign of a compromise of one of the organization's web-based services. This type of event would be considered a high-priority incident and would require a rapid response and escalation to management.
Source: Adapted from community discussion — Broesweelies
Which of the following is the BEST technical defense against unauthorized access to a corporate network through social engineering?
Answer: A
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISM practice, question 891. 1243 questions available.
Version 1.0.0. How we source questions