Quiz
CISM Quiz
Create a free account to finish this quiz
Save your progress and see your final score.
Already have an account? Sign in
Questions in this quiz (30)
1A security strategy is important for an organization PRIMARILY because it provides
- Abasis for determining the best logical security architecture for the organization
- Bmanagement intent and direction for security activities
- Cprovides users guidance on how to operate securely in everyday tasks
- Dhelps IT auditors ensure compliance
2The MOST important reason to make sure there is good communication about security throughout the organization is:
- Ato make security more palatable to resistant employees
- Bbecause people are the biggest security risk
- Cto inform business units about security strategy
- Dto conform to regulations requiring all employees are informed about security
3The regulatory environment for most organizations mandates a variety of security-related activities. It is MOST important that the information security manager:
- Arely on corporate counsel to advise which regulations are relevant
- Bstay current with all relevant regulations and request legal interpretation
- Cinvolve all impacted departments and treat regulations as just another risk
- Dignore many of the regulations that have no teeth
4The MOST important consideration in developing security policies is that:
- Athey are based on a threat profile
- Bthey are complete and no detail is let out
- Cmanagement signs off on them
- Dall employees read and understand them
5The PRIMARY security objective in creating good procedures is
- Ato make sure they work as intended
- Bthat they are unambiguous and meet the standards
- Cthat they be written in plain language
- Dthat compliance can be monitored
6The assignment of roles and responsibilities will be MOST effective if:
- Athere is senior management support
- Bthe assignments are consistent with proficiencies
- Croles are mapped to required competencies
- Dresponsibilities are undertaken on a voluntary basis
7The PRIMARY benefit organizations derive from effective information security governance is:
- Aensuring appropriate regulatory compliance
- Bensuring acceptable levels of disruption
- Cprioritizing allocation of remedial resources
- Dmaximizing return on security investments
8From an information security manager’s perspective, the MOST important factors regarding data retention are:
- Abusiness and regulatory requirements
- Bdocument integrity and destruction
- Cmedia availability and storage
- Ddata confidentiality and encryption
9Which role is in the BEST position to review and confirm the appropriateness of a user access list?
- Adata owner
- Binformation security manager
- Cdomain administrator
- Dbusiness manager
10In implementing information security governance, the information security manager is PRIMARILY responsible for:
- Adeveloping the security strategy
- Breviewing the security strategy
- Ccommunicating the security strategy
- Dapproving the security strategy
11The overall objective of risk management is to:
- Aeliminate all vulnerabilities, if possible
- Bdetermine the best way to transfer risk
- Creduce risks to an acceptable level
- Dimplement effective countermeasures
12The statement „risk = value x vulnerability x threat“ indicates that:
- Arisk can be quantified using annual loss expectancy (ALE)
- Bapproximate risk can be estimated, provided probability is computed
- Cthe level of risk is greater when more threats meet more vulnerabilities
- Dwithout knowing value, risk cannot be calculated
13To address changes in risk, an effective risk management program should:
- Aensure that continuous monitoring processes are in place
- Bestablish proper security baselines for all information resources
- Cimplement a complete data classification process
- Dchange security policies on a timely basis to address changing risks
14Information classification is important to properly manage risk PRIMARILY because:
- Ait ensures accountability for information resources as required by roles and responsibilities
- Bit is legal requirement under various regulations
- Cthere is no other way to meet the requirements for availability, integrity and auditability
- Dit is used to identify the sensitivity and criticality of information to the organization
15Vulnerabilities discovered during an assessment should be:
- Ahandled as a risk, even though there is no threat
- Bprioritized for remediation solely based on impact
- Ca basis for analyzing the effectiveness of controls
- Devaluated for threat and impact in addition to cost of mitigation
16Indemnity (Schadensersatz) agreements can be used to:
- Aensure an agreed-upon level of service
- Breduce impacts on critical resources
- Ctransfer responsibility to a third party
- Dprovide an effective countermeasure to threats
17Residual risks can be determined by:
- Adetermining remaining vulnerabilities after countermeasures are in place
- Ba threat analysis
- Ca risk assessment
- Dtransferring all risks
18Data owners are PRIMARILY responsible for creating risk mitigation strategies to address which of the following areas?
- Aplatform security
- Bentitlement changes
- Cintrusion detection
- Dantivirus controls
19A risk analysis should:
- Alimit the scope to a benchmark of similar companies
- Bassume an equal degree of protection for all assets
- Caddress the potential size and likelihood of loss
- Dgive more weight to the likelihood vs. the size of the loss
20Which of the following is BEST for preventing an external attack?
- Astatic IP addresses
- Bnetwork address translation
- Cbackground checks for temporary employees
- Dwriting computer logs to removable media
21Who is in the BEST position to develop the priorities and identify what risks and impacts would occur if there were a loss or corruption of the organization‘s information resources?
- Ainternal auditors
- Bsecurity management
- Cbusiness process owners
- Dexternal regulatory agencies
22The MOST important single concept for an information security architect to keep in mind is:
- Aplan do check act
- Bconfidentiality, integrity, availablility
- Cprevention, detection, correction
- Dtone at the top
23Which of the following is the BEST method of limiting the impact of vulnerabilities inherent to wireless networks?
- Arequire private, key based encryption to connect to the wireless network
- Benable auditing on every host that connects to a wireless network
- Crequire that every host that connects to this network is have a well tested recovery plan
- Denable auditing on every connection to the wireless network
24In an environment that practises defense in depth, an Internet application that requires a login for a user to access it would also require which of the following additional controls?
- Auser authentication
- Buser audit trails
- Cnetwork load balancing
- Dnetwork authentication
25If an information security manager has responsibility for application security review, which of the following additional responsibilities present a conflict of interest in performing the review?
- Aoperation system recovery
- Bapplication administration
- Cnetwork change control
- Dhost based intrusion detection
26Which of the following BEST promotes accountability?
- Acompliance monitoring
- Bawareness training
- C secure implementation
- Ddocumented policy
27Which of the following conclusions render the sentence MOST accurate? Vulnerabilities combined with threats:
- Aalways results in damage
- Brequire controls to avoid damage
- Callow exploits that may cause damage
- Dalways results in exploits
28In which state of the systems development life cycle (SDLC) should the information security manager create a list of security issues presented by the functional description of a newly planned system?
- Afeasibility
- Brequirements
- Cdesign
- Ddevelopment
29What is the FIRST step in designing a secure client server environment?
- Aidentify all data access points
- Bestablish operating system security on all platforms
- Crequire hard passwords
- Dplace a firewall between the server and clients
30What BEST represents the hierarchy of access control strength, from weakest to strongest?
- Awhat you have, what you are, what you know
- Bwhat you know, what you have, what you are
- Cwhat you are, what you have, what you know
- Dwhat you are, what you know, what you have information Security Program
Information
- Description
- Quiz on CISM Quiz, created by Christian Haller on 21/06/2014.
- Author
- Christian Haller
- Language
- Deutsch
- Views
- 2,566
- Tags
- Rating
- No ratings yet Rate this quiz