CISM practice questions 981–990

1. Question 981 · 1243 in bank

   Which of the following is the MOST important criterion when deciding whether to accept residual risk?

   • ACost of replacing the asset
   • BAnnual loss expectancy (ALE)
   • CCost of additional mitigation
   • DAnnual rate of occurrence

   Show answer

   Answer: C

   Explanation

   According to the Certified Information Security Manager (CISM) Review Manual: "Decisions to accept residual risk should be based on considerations such as the cost-effectiveness of additional mitigation, the criticality of the asset to the enterprise’s mission, the asset’s value and the impact of the asset’s loss." (CISM Review Manual 15th Edition, p. 124)

   Source: Adapted from community discussion — [Removed]

   Next question

2. Question 982 · 1243 in bank

   An information security manager finds that a soon-to-be deployed online application will increase risk beyond acceptable levels, and necessary controls have not been included. Which of the following is the BEST course of action for the information security manager?

   • ARecommend a different application.
   • BInstruct IT to deploy controls based on urgent business needs.
   • CSolicit bids for compensating control products.
   • DPresent a business case for additional controls to senior management.

   Show answer

   Answer: D

   Next question

3. Question 983 · 1243 in bank

   When developing a business case to justify an information security investment, which of the following would BEST enable an informed decision by senior management?

   • AThe information security strategy
   • BSecurity investment trends in the industry
   • CLosses due to security incidents
   • DThe results of a risk assessment

   Show answer

   Answer: D

   Explanation

   D. The results of a risk assessment When developing a business case to justify an information security investment, the most critical factor that enables an informed decision by senior management is the results of a risk assessment. A risk assessment provides a quantitative and qualitative analysis of the potential risks and threats to an organization's information security. It helps senior management understand the specific vulnerabilities and potential impacts that the organization faces.

   Source: Adapted from community discussion — oluchecpoint

   Next question

4. Question 984 · 1243 in bank

   A data-hosting organization's data center houses servers, applications, and data for a large number of geographically dispersed customers. Which of the following strategies is the BEST approach for developing a physical access control policy for the organization?

   • AReview customers’ security policies.
   • BDesign single sign-on (SSO) or federated access.
   • CDevelop access control requirements for each system and application.
   • DConduct a risk assessment to determine security risks and mitigating controls.

   Show answer

   Answer: D

   Explanation

   The BEST approach for developing a physical access control policy for a data-hosting organization's data center is to conduct a risk assessment to determine security risks and mitigating controls.

   Source: Adapted from community discussion — Souvik124

   Next question

5. Question 985 · 1243 in bank

   Which of the following is a PRIMARY benefit of managed security solutions?

   • AEasier implementation across an organization
   • BGreater ability to focus on core business operations
   • CWider range of capabilities
   • DLower cost of operations

   Show answer

   Answer: B

   Next question

6. Question 986 · 1243 in bank

   Which of the following is an example of risk mitigation?

   • AImproving security controls
   • BDiscontinuing the activity associated with the risk
   • CPerforming a cost-benefit analysis
   • DPurchasing insurance

   Show answer

   Answer: A

   Explanation

   While discontinuing the activity associated with the risk (B) can be an effective risk mitigation strategy in certain circumstances, it may not always be feasible or practical. For example, discontinuing a critical business activity may not be an option for many organizations. Improving security controls (A), on the other hand, is a more flexible and common approach to risk mitigation. By enhancing the security measures in place, organizations can reduce the likelihood or impact of a potential security incident. This approach allows organizations to continue their operations while reducing the risk of a security breach or loss of sensitive information.

   Source: Adapted from community discussion — Broesweelies

   Next question

7. Question 987 · 1243 in bank

   Which of the following BEST enables an organization to provide ongoing assurance that legal and regulatory compliance requirements can be met?

   • AEngaging external experts to provide guidance on changes in compliance requirements
   • BAssigning the operations manager accountability for meeting compliance requirements
   • CEmbedding compliance requirements within operational processes
   • DPerforming periodic audits for compliance with legal and regulatory requirements

   Show answer

   Answer: D

   Explanation

   Performing periodic audits for compliance with legal and regulatory requirements (D) is an effective way to provide ongoing assurance that an organization is meeting its obligations. Audits help organizations identify any areas where they may be non-compliant and provide an opportunity to address those issues before they become more serious. Regular audits also help organizations understand how well their processes and controls are working and identify any gaps that need to be addressed. This allows organizations to continuously improve their compliance posture and maintain ongoing confidence in their ability to meet legal and regulatory requirements.

   Source: Adapted from community discussion — Broesweelies

   Next question

8. Question 988 · 1243 in bank

   Which of the following is the MAIN benefit of performing an assessment of existing incident response processes?

   • AValidation of current capabilities
   • BBenchmarking against industry peers
   • CPrioritization of action plans
   • DIdentification of threats and vulnerabilities

   Show answer

   Answer: A

   Explanation

   This option is correct because the primary purpose of assessing existing incident response processes is to evaluate how well the organization can detect, respond to, and recover from security incidents. It helps identify any gaps, weaknesses, or inefficiencies in the current processes, validating the organization's preparedness and capabilities in handling security incidents effectively.

   Source: Adapted from community discussion — Vishalgupta26

   Next question

9. Question 989 · 1243 in bank

   Following a successful attack, an information security manager should be confident the malware has not continued to spread at the completion of which incident response phase?

   • ARecovery
   • BEradication
   • CIdentification
   • DContainment

   Show answer

   Answer: D

   Explanation

   The containment phase of incident response is focused on stopping the spread of malware or other malicious code. This is done by isolating the affected systems and preventing them from communicating with other systems. Once the malware has been contained, the incident response team can move on to the eradication phase, which is focused on removing the malware from the affected systems. Therefore, the information security manager should be confident that the malware has not continued to spread at the completion of the containment phase. This is because the containment phase is focused on stopping the spread of malware, which is the first step in recovering from an incident.

   Source: Adapted from community discussion — afc1019

   Next question

10. Question 990 · 1243 in bank

    Which of the following is the BEST method to align an information security strategic plan to the corporate strategy?

    • AEnsuring the plan complies with business unit expectations
    • BInvolving industry experts in the development of the plan
    • CInvolving senior management in the development of the plan
    • DObtaining adequate funds from senior management

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 981. 1243 questions available.