CISM practice questions 951–960

1. Question 951 · 1243 in bank

   Which of the following BEST facilitates an information security manager’s efforts to obtain senior management commitment for an information security program?

   • APresenting evidence of inherent risk
   • BReporting the security maturity level
   • CPresenting compliance requirements
   • DCommunicating the residual risk

   Show answer

   Answer: A

   Explanation

   I like A. Interesting word choices here, you are looking for commitment by senior management for an information security program. Meaning you don't have one. So providing evidence of inherent risk (risk of the control environment WITHOUT ANY controls) would be the best answer, IMO. So showing residual risk would be wrong because this would demonstrate risk AFTER you've already applied controls, the risk "LEFTOVER".

   Source: Adapted from community discussion — CarlLimps

   Next question

2. Question 952 · 1243 in bank

   Which of the following is PRIMARILY determined by asset classification?

   • APriority for asset replacement
   • BLevel of protection required for assets
   • CReplacement cost of assets
   • DInsurance coverage required for assets

   Show answer

   Answer: B

   Next question

3. Question 953 · 1243 in bank

   Which of the following is MOST helpful for aligning security operations with the IT governance framework?

   • ABusiness impact analysis (BIA)
   • BSecurity operations program
   • CInformation security policy
   • DSecurity risk assessment

   Show answer

   Answer: C

   Explanation

   An information security policy is a document that outlines an organization's approach to managing and protecting sensitive information. It defines the roles, responsibilities, and expectations for individuals within the organization with regards to security, and provides a framework for how security should be integrated into the day-to-day operations of the organization. The information security policy is critical for aligning security operations with the IT governance framework as it provides a clear set of guidelines and expectations for everyone in the organization. It helps ensure that security is integrated into the overall strategy and decision-making processes of the organization, and that security is considered in all aspects of the business. By providing a common understanding of security goals, principles, and procedures, the information security policy helps ensure that security is integrated into the organization's governance structure and that security operations are aligned with the broader objectives of the organization.

   Source: Adapted from community discussion — Broesweelies

   Next question

4. Question 954 · 1243 in bank

   An information security manager has been made aware of a new data protection regulation that will soon go into effect. Which of the following is the BEST way to manage the risk of noncompliance?

   • APerform a gap analysis.
   • BConsult with senior management on the best course of action.
   • CImplement a program of work to comply with the new legislation.
   • DUnderstand the cost of noncompliance.

   Show answer

   Answer: A

   Explanation

   A gap analysis is a systematic process of evaluating the current state of an organization's data protection measures against the requirements of the new regulation. This allows the information security manager to identify areas where the organization may be noncompliant, assess the potential risk and impact of noncompliance, and develop a plan to address any gaps and achieve compliance. Performing a gap analysis is the best way to manage the risk of noncompliance because it provides a comprehensive assessment of the organization's current state, helps identify areas of noncompliance and risk, and provides a roadmap for achieving compliance. This, in turn, can help reduce the risk of noncompliance, minimize the potential impact of noncompliance, and ensure that the organization is in compliance with the new regulation.

   Source: Adapted from community discussion — Broesweelies

   Next question

5. Question 955 · 1243 in bank

   An organization finds unauthorized software has been installed on a number of workstations. The software was found to contain a Trojan, which had been uploading data to an unknown external party. Which of the following would have BEST prevented the installation of the unauthorized software?

   • ABanning executable file downloads at the Internet firewall
   • BImplementing an intrusion detection system (IDS)
   • CImplementing application blacklisting
   • DRemoving local administrator rights

   Show answer

   Answer: D

   Explanation

   D. Removing local administrator rights would have BEST prevented the installation of the unauthorized software. This would have limited the ability of the Trojan to install itself on the workstations by limiting the user's ability to install software without proper approval.

   Source: Adapted from community discussion — Broesweelies

   Next question

6. Question 956 · 1243 in bank

   An information security manager learns of a new standard related to an emerging technology the organization wants to implement. Which of the following should the information security manager recommend be done FIRST?

   • APerform a risk assessment on the new technology.
   • BObtain legal counsel’s opinion on the standard's applicability to regulations.
   • CDetermine whether the organization can benefit from adopting the new standard.
   • DReview industry specialists’ analyses of the new standard.

   Show answer

   Answer: A

   Next question

7. Question 957 · 1243 in bank

   Which of the following will provide the MOST guidance when deciding the level of protection for an information asset?

   • AImpact on information security program
   • BCost of controls
   • CImpact to business function
   • DCost to replace

   Show answer

   Answer: C

   Next question

8. Question 958 · 1243 in bank

   Which of the following BEST demonstrates return on investment (ROI) for an information security initiative?

   • ARisk heat map
   • BBusiness impact analysis (BIA)
   • CBusiness case
   • DInformation security program roadmap

   Show answer

   Answer: C

   Explanation

   The correct answer is C. Business case. A business case is the best way to demonstrate the return on investment (ROI) for an information security initiative. A business case typically includes a cost-benefit analysis that compares the costs of implementing a security initiative with the benefits that are expected to be gained, such as reduced risk, improved compliance, or increased operational efficiency. This type of analysis helps to justify the investment in the security initiative by demonstrating the financial and strategic benefits that are expected to be achieved. A business case can be used to convince decision-makers to invest in the initiative, based on a clear and compelling argument for the expected return on investment.

   Source: Adapted from community discussion — Broesweelies

   Next question

9. Question 959 · 1243 in bank

   Which of the following is BEST suited to provide regular reporting to the board regarding the status of compliance to a global security standard?

   • ALegal counsel
   • BQuality assurance (QA)
   • CInformation security
   • DInternal audit

   Show answer

   Answer: D

   Explanation

   D. Internal audit. Internal audit functions are typically responsible for providing independent and objective assessments of an organization's operations, including compliance with standards and regulations. They are well-positioned to assess and report on the organization's compliance to a global security standard. Internal auditors have the expertise and knowledge to evaluate controls, processes, and activities related to information security and compliance. They can provide an unbiased and comprehensive assessment of the organization's adherence to the security standard and report their findings to the board.

   Source: Adapted from community discussion — mad68

   Next question

10. Question 960 · 1243 in bank

    Which of the following would be MOST effective in gaining senior management approval of security investments in network infrastructure?

    • APerforming penetration tests against the network to demonstrate business vulnerability
    • BHighlighting competitor performance regarding network best security practices
    • CPresenting comparable security implementation estimates from several vendors
    • DDemonstrating that targeted security controls tie to business objectives

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 951. 1243 questions available.