Quiz
CISM Quiz
Questions in this quiz (30)
1A security strategy is important for an organization PRIMARILY because it provides
- Abasis for determining the best logical security architecture for the organization
- Bmanagement intent and direction for security activities
- Cprovides users guidance on how to operate securely in everyday tasks
- Dhelps IT auditors ensure compliance
2The MOST important reason to make sure there is good communication about security throughout the organization is:
- Ato make security more palatable to resistant employees
- Bbecause people are the biggest security risk
- Cto inform business units about security strategy
- Dto conform to regulations requiring all employees are informed about security
3The regulatory environment for most organizations mandates a variety of security-related activities. It is MOST important that the information security manager:
- Arely on corporate counsel to advise which regulations are relevant
- Bstay current with all relevant regulations and request legal interpretation
- Cinvolve all impacted departments and treat regulations as just another risk
- Dignore many of the regulations that have no teeth
4The MOST important consideration in developing security policies is that:
- Athey are based on a threat profile
- Bthey are complete and no detail is let out
- Cmanagement signs off on them
- Dall employees read and understand them
5The PRIMARY security objective in creating good procedures is
- Ato make sure they work as intended
- Bthat they are unambiguous and meet the standards
- Cthat they be written in plain language
- Dthat compliance can be monitored
6The assignment of roles and responsibilities will be MOST effective if:
- Athere is senior management support
- Bthe assignments are consistent with proficiencies
- Croles are mapped to required competencies
- Dresponsibilities are undertaken on a voluntary basis
7The PRIMARY benefit organizations derive from effective information security governance is:
- Aensuring appropriate regulatory compliance
- Bensuring acceptable levels of disruption
- Cprioritizing allocation of remedial resources
- Dmaximizing return on security investments
8From an information security manager’s perspective, the MOST important factors regarding data retention are:
- Abusiness and regulatory requirements
- Bdocument integrity and destruction
- Cmedia availability and storage
- Ddata confidentiality and encryption
9Which role is in the BEST position to review and confirm the appropriateness of a user access list?
- Adata owner
- Binformation security manager
- Cdomain administrator
- Dbusiness manager
10In implementing information security governance, the information security manager is PRIMARILY responsible for:
- Adeveloping the security strategy
- Breviewing the security strategy
- Ccommunicating the security strategy
- Dapproving the security strategy
11The overall objective of risk management is to:
- Aeliminate all vulnerabilities, if possible
- Bdetermine the best way to transfer risk
- Creduce risks to an acceptable level
- Dimplement effective countermeasures
12The statement „risk = value x vulnerability x threat“ indicates that:
- Arisk can be quantified using annual loss expectancy (ALE)
- Bapproximate risk can be estimated, provided probability is computed
- Cthe level of risk is greater when more threats meet more vulnerabilities
- Dwithout knowing value, risk cannot be calculated
13To address changes in risk, an effective risk management program should:
- Aensure that continuous monitoring processes are in place
- Bestablish proper security baselines for all information resources
- Cimplement a complete data classification process
- Dchange security policies on a timely basis to address changing risks
14Information classification is important to properly manage risk PRIMARILY because:
- Ait ensures accountability for information resources as required by roles and responsibilities
- Bit is legal requirement under various regulations
- Cthere is no other way to meet the requirements for availability, integrity and auditability
- Dit is used to identify the sensitivity and criticality of information to the organization
15Vulnerabilities discovered during an assessment should be:
- Ahandled as a risk, even though there is no threat
- Bprioritized for remediation solely based on impact
- Ca basis for analyzing the effectiveness of controls
- Devaluated for threat and impact in addition to cost of mitigation
16Indemnity (Schadensersatz) agreements can be used to:
- Aensure an agreed-upon level of service
- Breduce impacts on critical resources
- Ctransfer responsibility to a third party
- Dprovide an effective countermeasure to threats
17Residual risks can be determined by:
- Adetermining remaining vulnerabilities after countermeasures are in place
- Ba threat analysis
- Ca risk assessment
- Dtransferring all risks
18Data owners are PRIMARILY responsible for creating risk mitigation strategies to address which of the following areas?
- Aplatform security
- Bentitlement changes
- Cintrusion detection
- Dantivirus controls
19A risk analysis should:
- Alimit the scope to a benchmark of similar companies
- Bassume an equal degree of protection for all assets
- Caddress the potential size and likelihood of loss
- Dgive more weight to the likelihood vs. the size of the loss
20Which of the following is BEST for preventing an external attack?
- Astatic IP addresses
- Bnetwork address translation
- Cbackground checks for temporary employees
- Dwriting computer logs to removable media
21Who is in the BEST position to develop the priorities and identify what risks and impacts would occur if there were a loss or corruption of the organization‘s information resources?
- Ainternal auditors
- Bsecurity management
- Cbusiness process owners
- Dexternal regulatory agencies
22The MOST important single concept for an information security architect to keep in mind is:
- Aplan do check act
- Bconfidentiality, integrity, availablility
- Cprevention, detection, correction
- Dtone at the top
23Which of the following is the BEST method of limiting the impact of vulnerabilities inherent to wireless networks?
- Arequire private, key based encryption to connect to the wireless network
- Benable auditing on every host that connects to a wireless network
- Crequire that every host that connects to this network is have a well tested recovery plan
- Denable auditing on every connection to the wireless network
24In an environment that practises defense in depth, an Internet application that requires a login for a user to access it would also require which of the following additional controls?
- Auser authentication
- Buser audit trails
- Cnetwork load balancing
- Dnetwork authentication
25If an information security manager has responsibility for application security review, which of the following additional responsibilities present a conflict of interest in performing the review?
- Aoperation system recovery
- Bapplication administration
- Cnetwork change control
- Dhost based intrusion detection
26Which of the following BEST promotes accountability?
- Acompliance monitoring
- Bawareness training
- C secure implementation
- Ddocumented policy
27Which of the following conclusions render the sentence MOST accurate? Vulnerabilities combined with threats:
- Aalways results in damage
- Brequire controls to avoid damage
- Callow exploits that may cause damage
- Dalways results in exploits
28In which state of the systems development life cycle (SDLC) should the information security manager create a list of security issues presented by the functional description of a newly planned system?
- Afeasibility
- Brequirements
- Cdesign
- Ddevelopment
29What is the FIRST step in designing a secure client server environment?
- Aidentify all data access points
- Bestablish operating system security on all platforms
- Crequire hard passwords
- Dplace a firewall between the server and clients
30What BEST represents the hierarchy of access control strength, from weakest to strongest?
- Awhat you have, what you are, what you know
- Bwhat you know, what you have, what you are
- Cwhat you are, what you have, what you know
- Dwhat you are, what you know, what you have information Security Program
Information
- Description
- Quiz on CISM Quiz, created by Christian Haller on 21/06/2014.
- Author
- Christian Haller
- Language
- Deutsch
- Views
- 2,566
- Tags
- Rating
- No ratings yet Rate this quiz