CISM practice questions 921–930

1. Question 921 · 1243 in bank

   Which of the following service offerings in a typical Infrastructure as a Service (IaaS) model will BEST enable a cloud service provider to assist customers when recovering from a security incident?

   • ACapability to take a snapshot of virtual machines
   • BCapability of online virtual machine analysis
   • CAvailability of web application firewall logs
   • DAvailability of current infrastructure documentation

   Show answer

   Answer: A

   Explanation

   In a typical Infrastructure as a Service (IaaS) model, the service offering that will BEST enable a cloud service provider to assist customers when recovering from a security incident is A. Capability to take a snapshot of virtual machines. Taking a snapshot of virtual machines is a valuable feature in an IaaS model that allows for the creation of a point-in-time copy of a virtual machine's disk, memory, and configuration. This snapshot serves as a backup or recovery point that can be used to restore the virtual machine to a previous known good state. In the event of a security incident, having the capability to take snapshots enables customers to roll back to a secure state before the incident occurred.

   Source: Adapted from community discussion — sundersam23

   Next question

2. Question 922 · 1243 in bank

   When monitoring the security of a web-based application, which of the following is MOST frequently reviewed?

   • AAudit reports
   • BAccess logs
   • CAccess lists
   • DThreat metrics

   Show answer

   Answer: B

   Next question

3. Question 923 · 1243 in bank

   Which of the following roles is BEST able to influence the security culture within an organization?

   • AChief information security officer (CISO)
   • BChief information officer (CIO)
   • CChief operating officer (COO)
   • DChief executive officer (CEO)

   Show answer

   Answer: D

   Next question

4. Question 924 · 1243 in bank

   Which of the following BEST indicates the effectiveness of a recent information security awareness campaign delivered across the organization?

   • AIncrease in the frequency of security incident escalations
   • BReduction in the impact of security incidents
   • CDecrease in the number of security incidents
   • DIncrease in the number of reported security incidents

   Show answer

   Answer: D

   Explanation

   According to ISACA, more incidents being reported could be an indicator that the staff is paying more attention to security.

   Source: Adapted from community discussion — ad_27

   Next question

5. Question 925 · 1243 in bank

   Which of the following is the BEST evidence of alignment between corporate and information security governance?

   • ASecurity key performance indicators (KPIs)
   • BSenior management sponsorship
   • CRegular security policy reviews
   • DProject resource optimization

   Show answer

   Answer: B

   Explanation

   The BEST evidence of alignment between corporate and information security governance is "B. Senior management sponsorship." Senior management sponsorship refers to the active involvement and support of senior management in the development and implementation of the information security program. This is a clear sign that the organization's leadership recognizes the importance of information security and is committed to ensuring its integration into the overall governance structure.

   Source: Adapted from community discussion — Broesweelies

   Next question

6. Question 926 · 1243 in bank

   When designing a disaster recovery plan (DRP), which of the following MUST be available in order to prioritize system restoration?

   • AKey performance indicators (KPIs)
   • BSystems inventory
   • CRecovery procedures
   • DBusiness impact analysis (BIA) results

   Show answer

   Answer: D

   Explanation

   I would have answered B - Systems Inventory, as one cannot do a business impact analysis without a systems inventory. However, assuming that each answer also includes the prerequisites, then I can see why D - Business Impact Analysis (implicitly including the prerequisite systems inventory) would be MOST correct.

   Source: Adapted from community discussion — cybervds

   Next question

7. Question 927 · 1243 in bank

   Which of the following factors has the GREATEST influence on the successful implementation of information security strategy goals?

   • ARegulatory requirements
   • BCompliance acceptance
   • CManagement support
   • DBudgetary approval

   Show answer

   Answer: C

   Next question

8. Question 928 · 1243 in bank

   Which of the following is the BEST approach for managing user access permissions to ensure alignment with data classification?

   • ADelegate the management of access permissions to an independent third party
   • BReview access permissions annually or whenever job responsibilities change
   • CLock out accounts after a set number of unsuccessful login attempts
   • DEnable multi-factor authentication on user and admin accounts

   Show answer

   Answer: B

   Explanation

   C and D can be eliminated because this is an authorization question not an authentication question. A can be eliminated because outsourcing authorization management would only be appropriate in specific contexts. This leaves B as the only possible correct answer.

   Source: Adapted from community discussion — cybervds

   Next question

9. Question 929 · 1243 in bank

   Which of the following is the MOST critical factor for information security program success?

   • AA comprehensive risk assessment program for information security
   • BThe information security manager's knowledge of the business
   • COngoing audits and addressing open items
   • DSecurity staff with appropriate training and adequate resources

   Show answer

   Answer: B

   Explanation

   The MOST critical factor for information security program success is "B. The information security manager's knowledge of the business." The success of an information security program depends on a number of factors, but a strong understanding of the business by the information security manager is critical. This requires the information security manager to have a good understanding of the organization's goals, objectives, operations, and risk profile, and to be able to align the information security program accordingly.

   Source: Adapted from community discussion — Broesweelies

   Next question

10. Question 930 · 1243 in bank

    Which of the following events would MOST likely require a revision to the information security program?

    • AA change in IT management
    • BA merger with another organization
    • CA significant increase in reported incidents
    • DAn increase in industry threat level

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 921. 1243 questions available.