Question 971 · 1243 in bank
Due to changes in an organization’s environment, security controls may no longer be adequate. What is the information security manager’s BEST course of action?
Show answer
Answer: A
Certified Information Security Manager1,243 questions across 125 pages are complete and free, with no account or card.
1243 questions in this bank
Free access · progress saved on this device
Due to changes in an organization’s environment, security controls may no longer be adequate. What is the information security manager’s BEST course of action?
Answer: A
What is the PRIMARY benefit to an organization when information security program requirements are aligned with employment and staffing processes?
Answer: A
Answer should be A. C is talking about only security staff. Access is a big security program area to handle. The employment and Hiring process is a good venue to provide birthright access to new hires.
Source: Adapted from community discussion — Boomers
When developing an asset classification program, which of the following steps should be completed FIRST?
Answer: D
Completing the step of creating an inventory first when developing an asset classification program. Creating an inventory involves identifying and documenting all the assets within an organization. This step is essential because it provides a comprehensive overview of the assets that need to be classified. Once you have a clear understanding of what assets you have, you can move forward with categorizing each asset, implementing a data loss prevention system, and creating a business case for a digital rights management tool.
Source: Adapted from community discussion — koala_lay
Which of the following is the PRIMARY reason to monitor key risk indicators (KRIs) related to information security?
Answer: A
A. To alert on unacceptable risk Monitoring key risk indicators (KRIs) related to information security primarily serves the purpose of alerting on unacceptable risks. KRIs are specific metrics or indicators that are used to assess the level of risk in an organization. When these indicators show that the risk has reached an unacceptable level, it triggers alerts and action should be taken to mitigate or address the risk.
Source: Adapted from community discussion — oluchecpoint
Which of the following is the BEST indicator of an emerging incident?
Answer: C
An organization has discovered a recurring problem with unsecure code being released into production. Which of the following is the information security manager action?
Answer: D
Which of the following is MOST important for an information security manager to consider when identifying information security resource requirements?
Answer: D
D. Information security strategy is the MOST important for an information security manager to consider when identifying information security resource requirements, according to ISACA. The information security strategy outlines the organization's goals and objectives for protecting its information assets and provides a framework for identifying and prioritizing resource needs.
Source: Adapted from community discussion — Broesweelies
When developing a categorization method for security incidents, the categories MUST:
Answer: C
Which of the following is MOST likely to be impacted when emerging technologies are introduced to an organization?
Answer: A
The correct answer is A. Risk profile. Emerging technologies have the potential to significantly impact an organization's risk profile. New technologies can introduce new security threats and risks, as well as change the ways in which existing risks manifest themselves. For example, the adoption of cloud computing technologies can introduce new security risks associated with the management of sensitive data in a shared environment, while the adoption of mobile technologies can introduce new risks associated with the theft or loss of mobile devices.
Source: Adapted from community discussion — Broesweelies
An organization's main product is a customer-facing application delivered using Software as a Service (SaaS). The lead security engineer has just identified a major security vulnerability at the primary cloud provider. Within the organization, who is PRIMARILY accountable for the associated risk?
Answer: D
D. The application owner. The application owner is responsible for overseeing the development, maintenance, and security of the customer-facing application. As the primary owner of the application, they have a direct stake in ensuring its security and mitigating any risks associated with it. The application owner is accountable for identifying and addressing vulnerabilities in the application, including those arising from the cloud provider's infrastructure or services. They must work closely with the security engineer and the information security manager to assess and manage the risk effectively. The application owner has the authority and responsibility to make decisions and take action to address the security vulnerability and protect the organization's customers and their data.
Source: Adapted from community discussion — mad68
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISM practice, question 971. 1243 questions available.
Version 1.0.0. How we source questions