Test
CISM - 3
Crea una cuenta gratis para terminar este test
Guarda tu progreso y consulta tu resultado final.
¿Ya tienes cuenta? Inicia sesión
Preguntas del test (100)
1After implementing an information security governance framework, which of the following would provide the BEST information to develop an information security project plan?
- ARisk heat map
- BRecent audit results
- CBalanced scorecard
- DGap analysis
2An information security manager's PRIMARY objective for presenting key risks to the board of directors is to:
- Ameet information security compliance requirements.
- Bensure appropriate information security governance.
- Cquantity reputational risks.
- Dre-evaluate the risk appetite.
3Which of the following is MOST helpful in integrating information security governance with corporate governance?
- AAssigning the implementation of information security governance to the steering committee.
- BIncluding information security processes within operational and management processes.
- CProviding independent reports of information security efficiency and effectiveness to the board.
- DAligning the information security governance to a globally accepted framework.
4Which of the following is the BEST way to align security and business strategies?
- AInclude security risk as part of corporate risk management.
- BDevelop a balanced scorecard for security.
- CEstablish key performance indicators (KPIs) for business through security processes.
- DIntegrate information security governance into corporate governance.
5When developing an information security governance framework, which of the following should be the FIRST activity?
- AIntegrate security within the system's development life-cycle process.
- BAlign the information security program with the organization's other risk and control activities.
- CDevelop policies and procedures to support the framework.
- DDevelop response measures to detect and ensure the closure of security breaches.
6Which of the following is the MOST effective way for senior management to support the integration of information security governance into corporate governance?
- ADevelop the information security strategy based on the enterprise strategy.
- BAppoint a business manager as heard of information security.
- CPromote organization-wide information security awareness campaigns.
- DEstablish a steering committee with representation from across the organization.
7Which of the following would BEST help to ensure the alignment between information security and business functions?
- ADeveloping information security polices
- BEstablishing an information security governance committee
- CEstablishing a security awareness program
- DProviding funding for information security efforts
8When establishing an information security governance framework, it is MOST important for an information security manager to understand:
- Athe regulatory environment.
- Binformation security best practices.
- Cthe corporate culture.
- Drisk management techniques.
9Which of the following is a PRIMARY responsibility of the information security governance function?
- ADefining security strategies to support organizational programs
- BEnsuring adequate support for solutions using emerging technologies
- CFostering a risk-aware culture to strengthen the information security program
- DAdvising senior management on optimal levels of risk appetite and tolerance
10Which of the following is the MOST important requirement for the successful implementation of security governance?
- AImplementing a security balanced scorecard
- BPerforming an enterprise-wide risk assessment
- CMapping to organizational strategies
- DAligning to an international security framework
11A large organization is in the process of developing its information security program that involves working with several complex organizational functions. Which of the following will BEST enable the successful implementation of this program?
- ASecurity governance
- BSecurity policy
- CSecurity metrics
- DSecurity guidelines
12Which of the following is a PRIMARY responsibility of an information security governance committee?
- AAnalyzing information security policy compliance reviews
- BApproving the purchase of information security technologies
- CReviewing the information security strategy
- DApproving the information security awareness training strategy
13An information security manager discovers that the organization's new information security policy is not being followed across all departments. Which of the following should be of GREATEST concern to the information security manager?
- ADifferent communication methods may be required for each business unit.
- BBusiness unit management has not emphasized the importance of the new policy.
- CThe corresponding controls are viewed as prohibitive to business operations.
- DThe wording of the policy is not tailored to the audience.
14An organization has detected potential risk emerging from noncompliance with new regulations in its industry.
Which of the following is the MOST important reason to report this situation to senior management?- AThe risk profile needs to be updated.
- BAn external review of the risk needs to be conducted.
- CSpecific monitoring controls need to be implemented.
- DA benchmark analysis needs to be performed.
15Which of the following is the BEST way for information security manager to identify compliance with information security policies within an organization?
- AAnalyze system logs.
- BConduct security awareness testing.
- CPerform vulnerability assessments.
- DConduct periodic audits.
16The BEST way to encourage good security practices is to:
- Aschedule periodic compliance audits.
- Bdiscipline those who fail to comply with the security policy.
- Crecognize appropriate security behavior by individuals.
- Dpublish the information security policy.
17Which of the following enables compliance with a nonrepudiation policy for electronic transactions?
- ADigital certificates
- BDigital signatures
- CEncrypted passwords
- DOne-time passwords
18Which of the following is the BEST approach to identify noncompliance issues with legal, regulatory, and contractual requirements
- ARisk assessment
- BBusiness impact analysis (BIA)
- CVulnerability assessment
- DGap analysis
19A new version of an information security regulation is published that requires an organization's compliance. The information security manager should FIRST:
- Aperform an audit based on the new version of the regulation.
- Bconduct a risk assessment to determine the risk of noncompliance.
- Cconduct benchmarking against similar organizations.
- Dperform a gap analysis against the new regulation.
20When an organization and its IT-hosting service provider are establishing a contract with each other, it is MOST important that the contract includes:
- Adetails of expected security metrics.
- Beach party's security responsibilities.
- Cpenalties for noncompliance with security policy.
- Drecovery time objectives (RTOs).
21Which of the following would be MOST useful to help senior management understand the status of information security compliance?
- AIndustry benchmarks
- BRisk assessment results
- CBusiness impact analysis (BIA) results
- DKey performance indicators (KPIs)
22Which of the following is MOST likely to be included in an enterprise information security policy?
- ASecurity monitoring strategy
- BAudit trail review requirements
- CPassword composition requirements
- DConsequences of noncompliance
23A risk mitigation report would include recommendations for:
- Aassessment
- Bacceptance
- Cevaluation
- Dquantification
24A risk management program should reduce risk to:
- Azero.
- Ban acceptable level.
- Can acceptable percent of revenue.
- Dan acceptable probability of occurrence.
25The MOST important reason for conducting periodic risk assessments is because:
- Arisk assessments are not always precise.
- Bsecurity risks are subject to frequent change.
- Creviewers can optimize and reduce the cost of controls.
- Dit demonstrates to senior management that the security function can add value.
26Which of the following BEST indicates a successful risk management practice?
- AOverall risk is quantified
- BInherent risk is eliminated
- CResidual risk is minimized
- DControl risk is tied to business units
27Which of the following would generally have the GREATEST negative impact on an organization?
- ATheft of computer software
- BInterruption of utility services
- CLoss of customer confidence
- DInternal fraud resulting in monetary loss
28A successful information security management program should use which of the following to determine the amount of resources devoted to mitigating exposures?
- ARisk analysis results
- BAudit report findings
- CPenetration test results
- DAmount of IT budget available
29Which of the following will BEST protect an organization from internal security attacks?
- AStatic IP addressing
- BInternal address translation
- CProspective employee background checks
- DEmployee awareness certification program
30For risk management purposes, the value of an asset should be based on:
- Aoriginal cost.
- Bnet cash flow.
- Cnet present value.
- Dreplacement cost.
31In a business impact analysis, the value of an information system should be based on the overall cost:
- Aof recovery.
- Bto recreate.
- Cif unavailable.
- Dof emergency operations.
32Acceptable risk is achieved when:
- Aresidual risk is minimized.
- Btransferred risk is minimized.
- Ccontrol risk is minimized.
- Dinherent risk is minimized.
33The value of information assets is BEST determined by:
- Aindividual business managers.
- Bbusiness systems analysts.
- Cinformation security management.
- Dindustry averages benchmarking.
34During which phase of development is it MOST appropriate to begin assessing the risk of a new application system?
- AFeasibility
- BDesign
- CDevelopment
- DTesting
35The MOST effective way to incorporate risk management practices into existing production systems is through:
- Apolicy development.
- Bchange management.
- Cawareness training.
- Dregular monitoring.
36Which of the following would be MOST useful in developing a series of recovery time objectives (RTOs)?
- AGap analysis
- BRegression analysis
- CRisk analysis
- DBusiness impact analysis
37The recovery time objective (RTO) is reached at which of the following milestones?
- ADisaster declaration
- BRecovery of the backups
- CRestoration of the system
- DReturn to business as usual processing
38Which of the following results from the risk assessment process would BEST assist risk management decision making?
- AControl risk
- BInherent risk
- CRisk exposure
- DResidual risk
39The decision on whether new risks should fall under periodic or event-driven reporting should be based on which of the following?
- AMitigating controls
- BVisibility of impact
- CLikelihood of occurrence
- DIncident frequency
40Risk acceptance is a component of which of the following?
- AAssessment
- BMitigation
- CEvaluation
- DMonitoring
41Risk management programs are designed to reduce risk to:
- Aa level that is too small to be measurable.
- Bthe point at which the benefit exceeds the expense.
- Ca level that the organization is willing to accept.
- Da rate of return that equals the current cost of capital.
42A risk assessment should be conducted:
- Aonce a year for each business process and subprocess.
- Bevery three to six months for critical business processes.
- Cby external parties to maintain objectivity.
- Dannually or whenever there is a significant change.
43The MOST important function of a risk management program is to:
- Aquantify overall risk.
- Bminimize residual risk.
- Celiminate inherent risk.
- Dmaximize the sum of all annualized loss expectancies (ALEs).
44Which of the following risks would BEST be assessed using qualitative risk assessment techniques?
- ATheft of purchased software
- BPower outage lasting 24 hours
- CPermanent decline in customer confidence
- DTemporary loss of e-mail due to a virus attack
45Which of the following will BEST prevent external security attacks?
- AStatic IP addressing
- BNetwork address translation
- CBackground checks for temporary employees
- DSecuring and analyzing system access logs
46In performing a risk assessment on the impact of losing a server, the value of the server should be calculated using the:
- Aoriginal cost to acquire.
- Bcost of the software stored.
- Cannualized loss expectancy (ALE).
- Dcost to obtain a replacement.
47A business impact analysis (BIA) is the BEST tool for calculating:
- Atotal cost of ownership.
- Bpriority of restoration.
- Cannualized loss expectancy (ALE).
- Dresidual risk.
48When residual risk is minimized:
- Aacceptable risk is probable.
- Btransferred risk is acceptable.
- Ccontrol risk is reduced.
- Drisk is transferable.
49Quantitative risk analysis is MOST appropriate when assessment data:
- Ainclude customer perceptions.
- Bcontain percentage estimates.
- Cdo not contain specific details.
- Dcontain subjective information.
50Which of the following is the MOST appropriate use of gap analysis?
- AEvaluating a business impact analysis (BIA)
- BDeveloping a balanced business scorecard
- CDemonstrating the relationship between controls
- DMeasuring current state vs. desired future state
51Identification and prioritization of business risk enables project managers to:
- Aestablish implementation milestones.
- Breduce the overall amount of slack time.
- Caddress areas with most significance.
- Daccelerate completion of critical paths.
52A risk analysis should:
- Ainclude a benchmark of similar companies in its scope.
- Bassume an equal degree of protection for all assets.
- Caddress the potential size and likelihood of loss.
- Dgive more weight to the likelihood vs. the size of the loss.
53The recovery point objective (RPO) requires which of the following?
- ADisaster declaration
- BBefore-image restoration
- CSystem restoration
- DAfter-image processing
54Based on the information provided, which of the following situations presents the GREATEST information security risk for an organization with multiple, but small, domestic processing locations?
- ASystems operation procedures are not enforced
- BChange management procedures are poor
- CSystems development is outsourced
- DSystems capacity management is not performed
55Which of the following BEST describes the scope of risk analysis?
- AKey financial systems
- BOrganizational activities
- CKey systems and infrastructure
- DSystems subject to regulatory compliance
56The decision as to whether a risk has been reduced to an acceptable level should be determined by:
- Aorganizational requirements.
- Binformation systems requirements.
- Cinformation security requirements.
- Dinternational standards.
57Which of the following is the PRIMARY reason for implementing a risk management program?
- AAllows the organization to eliminate risk
- BIs a necessary part of management's due diligence
- CSatisfies audit and regulatory requirements
- DAssists in incrementing the return on investment (ROD
58Which of the following groups would be in the BEST position to perform a risk analysis for a business?
- AExternal auditors
- BA peer group within a similar business
- CProcess owners
- DA specialized management consultant
59A successful risk management program should lead to:
- Aoptimization of risk reduction efforts against cost.
- Bcontainment of losses to an annual budgeted amount.
- Cidentification and removal of all man-made threats.
- Delimination or transference of all organizational risks.
60Which of the following risks would BEST be assessed using quantitative risk assessment techniques?
- ACustomer data stolen
- BAn electrical power outage
- CA web site defaced by hackers
- DLoss of the software development team
61The impact of losing frame relay network connectivity for 18-24 hours should be calculated using the:
- Ahourly billing rate charged by the carrier.
- Bvalue of the data transmitted over the network.
- Caggregate compensation of all affected business users.
- Dfinancial losses incurred by affected business units.
62Which of the following is the MOST usable deliverable of an information security risk analysis?
- ABusiness impact analysis (BIA) report
- BList of action items to mitigate risk
- CAssignment of risks to process owners
- DQuantification of organizational risk
63Ongoing tracking of remediation efforts to mitigate identified risks can BEST be accomplished through the use of which of the following?
- ATree diagrams
- BVenn diagrams
- CHeat charts
- DBar charts
64Who would be in the BEST position to determine the recovery point objective (RPO) for business applications?
- ABusiness continuity coordinator
- BChief operations officer (COO)
- CInformation security manager
- DInternal audit
65Which two components PRIMARILY must be assessed in an effective risk analysis?
- AVisibility and duration
- BLikelihood and impact
- CProbability and frequency
- DFinancial impact and duration
66Information security managers should use risk assessment techniques to:
- Ajustify selection of risk mitigation strategies.
- Bmaximize the return on investment (ROD.
- Cprovide documentation for auditors and regulators.
- Dquantify risks that would otherwise be subjective.
67In assessing risk, it is MOST essential to:
- Aprovide equal coverage for all asset types.
- Buse benchmarking data from similar organizations.
- Cconsider both monetary value and likelihood of loss.
- Dfocus primarily on threats and recent business losses.
68When the computer incident response team (CIRT) finds clear evidence that a hacker has penetrated the corporate network and modified customer information, an information security manager should FIRST notify?
- Athe information security steering committee.
- Bcustomers who may be impacted.
- Cdata owners who may be impacted.
- Dregulatory- agencies overseeing privacy.
69Data owners are PRIMARILY responsible for establishing risk mitigation methods to address which of the following areas?
- APlatform security
- BEntitlement changes
- CIntrusion detection
- DAntivirus controls
70The PRIMARY goal of a corporate risk management program is to ensure that an organization's:
- AIT assets in key business functions are protected.
- Bbusiness risks are addressed by preventive controls.
- Cstated objectives are achievable.
- DIT facilities and systems are always available.
71It is important to classify and determine relative sensitivity of assets to ensure that:
- Acost of protection is in proportion to sensitivity.
- Bhighly sensitive assets are protected.
- Ccost of controls is minimized.
- Dcountermeasures are proportional to risk.
72The service level agreement (SLA) for an outsourced IT function does not reflect an adequate level of protection. In this situation an information security manager should:
- Aensure the provider is made liable for losses.
- Brecommend not renewing the contract upon expiration.
- Crecommend the immediate termination of the contract.
- Ddetermine the current level of security.
73An information security manager has been assigned to implement more restrictive preventive controls. By doing so, the net effect will be to PRIMARILY reduce the:
- Athreat
- Bloss
- Cvulnerability
- Dprobability
74When performing a quantitative risk analysis, which of the following is MOST important to estimate the potential loss?
- AEvaluate productivity losses
- BAssess the impact of confidential data disclosure
- CCalculate the value of the information or asset
- DMeasure the probability of occurrence of each threat
75Before conducting a formal risk assessment of an organization's information resources, an information security manager should FIRST:
- Amap the major threats to business objectives.
- Breview available sources of risk information.
- Cidentify the value of the critical assets.
- Ddetermine the financial impact if threats materialize.
76The valuation of IT assets should be performed by:
- Aan IT security manager.
- Ban independent security consultant.
- Cthe chief financial officer (CFO).
- Dthe information owner.
77The PRIMARY objective of a risk management program is to:
- Aminimize inherent risk.
- Beliminate business risk.
- Cimplement effective controls.
- Dminimize residual risk.
78After completing a full IT risk assessment, who can BEST decide which mitigating controls should be implemented?
- ASenior management
- BBusiness manager
- CIT audit manager
- DInformation security officer (ISO)
79When performing an information risk analysis, an information security manager should FIRST:
- Aestablish the ownership of assets.
- Bevaluate the risks to the assets.
- Ctake an asset inventory.
- Dcategorize the assets.
80The PRIMARY benefit of performing an information asset classification is to:
- Alink security requirements to business objectives.
- Bidentify controls commensurate to risk.
- Cdefine access rights.
- Destablish ownership.
81Which of the following is MOST essential for a risk management program to be effective?
- AFlexible security budget
- BSound risk baseline
- CNew risks detection
- DAccurate risk reporting
82Which of the following attacks is BEST mitigated by utilizing strong passwords?
- AMan-in-the-middle attack
- BBrute force attack
- CRemote buffer overflow
- DRoot kit
83Phishing is BEST mitigated by which of the following?
- ASecurity monitoring software
- BEncryption
- CTwo-factor authentication
- DUser awareness
84The security responsibility of data custodians in an organization will include:
- Aassuming overall protection of information assets.
- Bdetermining data classification levels.
- Cimplementing security controls in products they install.
- Densuring security measures are consistent with policy.
85A security risk assessment exercise should be repeated at regular intervals because:
- Abusiness threats are constantly changing.
- Bomissions in earlier assessments can be addressed.
- Crepetitive assessments allow various methodologies.
- Dthey help raise awareness on security in the business.
86Which of the following steps in conducting a risk assessment should be performed FIRST?
- AIdentity business assets
- BIdentify business risks
- CAssess vulnerabilities
- DEvaluate key controls
87The systems administrator did not immediately notify the security officer about a malicious attack. An information security manager could prevent this situation by:
- Aperiodically testing the incident response plans.
- Bregularly testing the intrusion detection system (IDS).
- Cestablishing mandatory training of all personnel.
- Dperiodically reviewing incident response procedures.
88Which of the following risks is represented in the risk appetite of an organization?
- AControl
- BInherent
- CResidual
- DAudit
89Which of the following would a security manager establish to determine the target for restoration of normal processing?
- ARecover time objective (RTO)
- BMaximum tolerable outage (MTO)
- CRecovery point objectives (RPOs)
- DServices delivery objectives (SDOs)
90A risk management program would be expected to:
- Aremove all inherent risk.
- Bmaintain residual risk at an acceptable level.
- Cimplement preventive controls for every threat.
- Dreduce control risk to zero.
91Risk assessment should be built into which of the following systems development phases to ensure that risks are addressed in a development project?
- AProgramming
- BSpecification
- CUser testing
- DFeasibility
92Which of the following would help management determine the resources needed to mitigate a risk to the organization?
- ARisk analysis process
- BBusiness impact analysis (BIA)
- CRisk management balanced scorecard
- DRisk-based audit program
93A global financial institution has decided not to take any further action on a denial of service (DoS) risk found by the risk assessment team. The MOST likely reason they made this decision is that:
- Athere are sufficient safeguards in place to prevent this risk from happening.
- Bthe needed countermeasure is too complicated to deploy.
- Cthe cost of countermeasure outweighs the value of the asset and potential loss.
- DThe likelihood of the risk occurring is unknown.
94Which would be one of the BEST metrics an information security manager can employ to effectively evaluate the results of a security program?
- ANumber of controls implemented
- BPercent of control objectives accomplished
- CPercent of compliance with the security policy
- DReduction in the number of reported security incidents
95Which of the following types of information would the information security manager expect to have the LOWEST level of security protection in a large, multinational enterprise?
- AStrategic business plan
- BUpcoming financial results
- CCustomer personal information
- DPrevious financial results
96The PRIMARY purpose of using risk analysis within a security program is to:
- Ajustify the security expenditure.
- Bhelp businesses prioritize the assets to be protected.
- Cinform executive management of residual risk value.
- Dassess exposures and plan remediation.
97Which of the following is the PRIMARY prerequisite to implementing data classification within an organization?
- ADefining job roles
- BPerforming a risk assessment
- CIdentifying data owners
- DEstablishing data retention policies
98An online banking institution is concerned that the breach of customer personal information will have a significant financial impact due to the need to notify and compensate customers whose personal information may have been compromised. The institution determines that residual risk will always be too high and decides to:
- Amitigate the impact by purchasing insurance.
- Bimplement a circuit-level firewall to protect the network.
- Cincrease the resiliency of security measures in place.
- Dimplement a real-time intrusion detection system.
99What mechanisms are used to identify deficiencies that would provide attackers with an opportunity to compromise a computer system?
- ABusiness impact analyses
- BSecurity gap analyses
- CSystem performance metrics
- DIncident response processes
100A common concern with poorly written web applications is that they can allow an attacker to:
- Again control through a buffer overflow.
- Bconduct a distributed denial of service (DoS) attack.
- Cabuse a race condition.
- Dinject structured query language (SQL) statements.
Información
- Descripción
- TICs Test sobre CISM - 3, creado por Javier Cortes el 03/12/2019.
- Autor
- Javier Cortes
- Idioma
- Español
- Visitas
- 5
- Etiquetas
- Valoración
- Aún sin valoraciones Valora este test