CISM practice questions 931–940

1. Question 931 · 1243 in bank

   Which of the following is the MOST important consideration when establishing an organization's information security governance committee?

   • AMembers represent functions across the organization
   • BMembers have knowledge of information security controls
   • CMembers are rotated periodically
   • DMembers are business risk owners

   Show answer

   Answer: D

   Explanation

   D. Members are business risk owners: Information security is not just an IT issue; it's a business issue. Business leaders who are also risk owners have a deep understanding of the organization's overall objectives, priorities, and risk appetite. When these leaders are involved in the information security governance committee, decisions related to security measures are more likely to align with the broader business strategy, and there is a better chance of achieving a balance between security and business objectives.

   Source: Adapted from community discussion — TamerBeSafe

   Next question

2. Question 932 · 1243 in bank

   An incident management team is alerted to a suspected security event. Before classifying the suspected event as a security incident it is MOST important for the security manager to:

   • Afollow the incident response plan
   • Bfollow the business continuity plan (BCP)
   • Cconduct an incident forensic analysis
   • Dnotify the business process owner

   Show answer

   Answer: A

   Explanation

   I like A as well here. Why would you reach out to the process owner if you aren't 100% sure it's a security incident? Verifying that it is an incident would be part of the incident response plan. Also the incident could be minor OR nothing, so NOT D.

   Source: Adapted from community discussion — CarlLimps

   Next question

3. Question 933 · 1243 in bank

   Which of the following is the MOST effective way for an information security manager to ensure that security is incorporated into an organization's project development processes?

   • ADevelop good communications with the project management office (PMO).
   • BParticipate in project initiation, approval, and funding.
   • CConduct security reviews during design, testing, and implementation.
   • DIntegrate organization's security requirements into project management.

   Show answer

   Answer: D

   Explanation

   By integrating security requirements into the overall project management processes, the organization ensures that security considerations are woven into every stage of the project lifecycle. This includes project initiation, planning, execution, monitoring, and closure. It involves embedding security into project requirements, design, testing, implementation, and ongoing maintenance. This approach promotes a proactive and holistic approach to security within the project development processes. While developing good communications with the project management office (PMO) (option A), participating in project initiation, approval, and funding (option B), and conducting security reviews during design, testing, and implementation (option C) are important activities, integrating security requirements directly into project management processes is the overarching strategy that influences and guides these activities.

   Source: Adapted from community discussion — Viperhunter

   Next question

4. Question 934 · 1243 in bank

   Which of the following is the BEST way to ensure the capability to restore clean data after a ransomware attack?

   • APurchase cyber insurance
   • BEncrypt sensitive production data
   • CMaintain multiple offline backups
   • DPerform integrity checks on backups

   Show answer

   Answer: C

   Explanation

   The BEST answer is D. The question asks "BEST way to ensure the capability to restore clean data". Storing offline backups while a good practice to prevent ransomware attacks does not ENSURE or ASSURE you that you have to capability to perform a restore with CLEAN data. It simply means you have the availability to do so, and just because you have offline backups doesn't mean they are clean, depending on when the backups were taken they could be compromised. If you perform integrity checks on backups you are verifying they are clean, that the data has not been changed or corrupted. Using backups to recover from a ransomware attack can only take you so far if you aren't verifying the backup itself is 100% clean and ready to use.

   Source: Adapted from community discussion — Seasondream

   Next question

5. Question 935 · 1243 in bank

   Which of the following risk scenarios is MOST likely to emerge from a supply chain attack?

   • AUnreliable delivery of hardware and software resources by a supplier
   • BUnavailability of services provided by a supplier
   • CLoss of customers due to unavailability of products
   • DCompromise of critical assets via third-party resources

   Show answer

   Answer: D

   Explanation

   A supply chain attack is a type of cyber attack in which the attacker targets an organization by compromising its suppliers or third-party resources that are part of the organization's supply chain. By infiltrating these third-party resources, an attacker can gain access to sensitive information, install malware, or compromise critical assets that would otherwise be secure. This type of attack can result in significant consequences for an organization, including data breaches, reputational damage, legal liability, and business disruption. As such, the most likely risk scenario to emerge from a supply chain attack is the compromise of critical assets, which can have a significant impact on an organization's operations, security, and reputation.

   Source: Adapted from community discussion — Broesweelies

   Next question

6. Question 936 · 1243 in bank

   An information security manager learns through a threat intelligence service that the organization may be targeted for a major emerging threat. Which of the following is the information security manager's FIRST course of action?

   • AConduct an information security audit
   • BPerform a gap analysis
   • CValidate the relevance of the information
   • DInform senior management

   Show answer

   Answer: C

   Next question

7. Question 937 · 1243 in bank

   Which of the following BEST indicates that an organization has effectively tested its business continuity and disaster recovery plans within the stated recovery time objectives (RTOs)?

   • AInternal compliance requirements are being met
   • BRegulatory requirements are being met
   • CRisk management objectives are being met
   • DBusiness needs are being met

   Show answer

   Answer: D

   Next question

8. Question 938 · 1243 in bank

   The MOST important attribute of a security control is that it is:

   • Aauditable
   • Bmeasurable
   • Cscalable
   • Dreliable

   Show answer

   Answer: D

   Explanation

   I agree that the answer is D. Just want to chime in and state how important it is to highlight key words in the questions. If the question had mentioned metrics the question would have quickly fliped to measurable.

   Source: Adapted from community discussion — POWNED

   Next question

9. Question 939 · 1243 in bank

   Which of the following will BEST enable an effective information asset classification process?

   • AReviewing the recovery time objective (RTO) requirements of the asset
   • BAssigning ownership
   • CIncluding security requirements in the classification process
   • DAnalyzing audit findings

   Show answer

   Answer: B

   Explanation

   the one that would BEST enable an effective information asset classification process is option C, "Including security requirements in the classification process."

   Source: Adapted from community discussion — Souvik124

   Next question

10. Question 940 · 1243 in bank

    An information security manager has been notified about a compromised endpoint device. Which of the following is the BEST course of action to prevent further damage?

    • ARun a virus scan on the endpoint device
    • BWipe and reset the endpoint device
    • CPower off the endpoint device
    • DIsolate the endpoint device

    Show answer

    Answer: D

    Explanation

    The BEST course of action to prevent further damage in this scenario is "D. Isolate the endpoint device." When a compromised endpoint device is detected, it is essential to isolate the device as soon as possible to prevent further damage and to minimize the risk of data loss or theft. This can involve disconnecting the device from the network, disabling any active connections, and removing the device from the production environment.

    Source: Adapted from community discussion — Broesweelies

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 931. 1243 questions available.