CISM Quiz

Question 1 of 30

Medal-premium 1

A security strategy is important for an organization PRIMARILY because it provides

Select one of the following:

  • basis for determining the best logical security architecture for the organization

  • management intent and direction for security activities

  • provides users guidance on how to operate securely in everyday tasks

  • helps IT auditors ensure compliance

Question 2 of 30

Medal-premium 1

The MOST important reason to make sure there is good communication about security throughout the organization is:

Select one of the following:

  • to make security more palatable to resistant employees

  • because people are the biggest security risk

  • to inform business units about security strategy

  • to conform to regulations requiring all employees are informed about security

Question 3 of 30

Medal-premium 1

The regulatory environment for most organizations mandates a variety of security-related activities. It is MOST important that the information security manager:

Select one of the following:

  • rely on corporate counsel to advise which regulations are relevant

  • stay current with all relevant regulations and request legal interpretation

  • involve all impacted departments and treat regulations as just another risk

  • ignore many of the regulations that have no teeth

Question 4 of 30

Medal-premium 1

The MOST important consideration in developing security policies is that:

Select one of the following:

  • they are based on a threat profile

  • they are complete and no detail is let out

  • management signs off on them

  • all employees read and understand them

Question 5 of 30

Medal-premium 1

The PRIMARY security objective in creating good procedures is

Select one of the following:

  • to make sure they work as intended

  • that they are unambiguous and meet the standards

  • that they be written in plain language

  • that compliance can be monitored

Question 6 of 30

Medal-premium 1

The assignment of roles and responsibilities will be MOST effective if:

Select one of the following:

  • there is senior management support

  • the assignments are consistent with proficiencies

  • roles are mapped to required competencies

  • responsibilities are undertaken on a voluntary basis

Question 7 of 30

Medal-premium 1

The PRIMARY benefit organizations derive from effective information security governance is:

Select one of the following:

  • ensuring appropriate regulatory compliance

  • ensuring acceptable levels of disruption

  • prioritizing allocation of remedial resources

  • maximizing return on security investments

Question 8 of 30

Medal-premium 1

From an information security manager’s perspective, the MOST important factors regarding data retention are:

Select one of the following:

  • business and regulatory requirements

  • document integrity and destruction

  • media availability and storage

  • data confidentiality and encryption

Question 9 of 30

Medal-premium 1

Which role is in the BEST position to review and confirm the appropriateness of a user access list?

Select one of the following:

  • data owner

  • information security manager

  • domain administrator

  • business manager

Question 10 of 30

Medal-premium 1

In implementing information security governance, the information security manager is PRIMARILY responsible for:

Select one of the following:

  • developing the security strategy

  • reviewing the security strategy

  • communicating the security strategy

  • approving the security strategy

Question 11 of 30

Medal-premium 1

The overall objective of risk management is to:

Select one of the following:

  • eliminate all vulnerabilities, if possible

  • determine the best way to transfer risk

  • reduce risks to an acceptable level

  • implement effective countermeasures

Question 12 of 30

Medal-premium 1

The statement „risk = value x vulnerability x threat“ indicates that:

Select one of the following:

  • risk can be quantified using annual loss expectancy (ALE)

  • approximate risk can be estimated, provided probability is computed

  • the level of risk is greater when more threats meet more vulnerabilities

  • without knowing value, risk cannot be calculated

Question 13 of 30

Medal-premium 1

To address changes in risk, an effective risk management program should:

Select one of the following:

  • ensure that continuous monitoring processes are in place

  • establish proper security baselines for all information resources

  • implement a complete data classification process

  • change security policies on a timely basis to address changing risks

Question 14 of 30

Medal-premium 1

Information classification is important to properly manage risk PRIMARILY because:

Select one of the following:

  • it ensures accountability for information resources as required by roles and responsibilities

  • it is legal requirement under various regulations

  • there is no other way to meet the requirements for availability, integrity and auditability

  • it is used to identify the sensitivity and criticality of information to the organization

Question 15 of 30

Medal-premium 1

Vulnerabilities discovered during an assessment should be:

Select one of the following:

  • handled as a risk, even though there is no threat

  • prioritized for remediation solely based on impact

  • a basis for analyzing the effectiveness of controls

  • evaluated for threat and impact in addition to cost of mitigation

Question 16 of 30

Medal-premium 1

Indemnity (Schadensersatz) agreements can be used to:

Select one of the following:

  • ensure an agreed-upon level of service

  • reduce impacts on critical resources

  • transfer responsibility to a third party

  • provide an effective countermeasure to threats

Question 17 of 30

Medal-premium 1

Residual risks can be determined by:

Select one of the following:

  • determining remaining vulnerabilities after countermeasures are in place

  • a threat analysis

  • a risk assessment

  • transferring all risks

Question 18 of 30

Medal-premium 1

Data owners are PRIMARILY responsible for creating risk mitigation strategies to address which of the following areas?

Select one of the following:

  • platform security

  • entitlement changes

  • intrusion detection

  • antivirus controls

Question 19 of 30

Medal-premium 1

A risk analysis should:

Select one of the following:

  • limit the scope to a benchmark of similar companies

  • assume an equal degree of protection for all assets

  • address the potential size and likelihood of loss

  • give more weight to the likelihood vs. the size of the loss

Question 20 of 30

Medal-premium 1

Which of the following is BEST for preventing an external attack?

Select one of the following:

  • static IP addresses

  • network address translation

  • background checks for temporary employees

  • writing computer logs to removable media

Question 21 of 30

Medal-premium 1

Who is in the BEST position to develop the priorities and identify what risks and impacts would occur if there were a loss or corruption of the organization‘s information resources?

Select one of the following:

  • internal auditors

  • security management

  • business process owners

  • external regulatory agencies

Question 22 of 30

Medal-premium 1

The MOST important single concept for an information security architect to keep in mind is:

Select one of the following:

  • plan do check act

  • confidentiality, integrity, availablility

  • prevention, detection, correction

  • tone at the top

Question 23 of 30

Medal-premium 1

Which of the following is the BEST method of limiting the impact of vulnerabilities inherent to wireless networks?

Select one of the following:

  • require private, key based encryption to connect to the wireless network

  • enable auditing on every host that connects to a wireless network

  • require that every host that connects to this network is have a well tested recovery plan

  • enable auditing on every connection to the wireless network

Question 24 of 30

Medal-premium 1

In an environment that practises defense in depth, an Internet application that requires a login for a user to access it would also require which of the following additional controls?

Select one of the following:

  • user authentication

  • user audit trails

  • network load balancing

  • network authentication

Question 25 of 30

Medal-premium 1

If an information security manager has responsibility for application security review, which of the following additional responsibilities present a conflict of interest in performing the review?

Select one of the following:

  • operation system recovery

  • application administration

  • network change control

  • host based intrusion detection

Question 26 of 30

Medal-premium 1

Which of the following BEST promotes accountability?

Select one of the following:

  • compliance monitoring

  • awareness training

  • secure implementation

  • documented policy

Question 27 of 30

Medal-premium 1

Which of the following conclusions render the sentence MOST accurate? Vulnerabilities combined with threats:

Select one of the following:

  • always results in damage

  • require controls to avoid damage

  • allow exploits that may cause damage

  • always results in exploits

Question 28 of 30

Medal-premium 1

In which state of the systems development life cycle (SDLC) should the information security manager create a list of security issues presented by the functional description of a newly planned system?

Select one of the following:

  • feasibility

  • requirements

  • design

  • development

Question 29 of 30

Medal-premium 1

What is the FIRST step in designing a secure client server environment?

Select one of the following:

  • identify all data access points

  • establish operating system security on all platforms

  • require hard passwords

  • place a firewall between the server and clients

Question 30 of 30

Medal-premium 1

What BEST represents the hierarchy of access control strength, from weakest to strongest?

Select one of the following:

  • what you have, what you are, what you know

  • what you know, what you have, what you are

  • what you are, what you have, what you know

  • what you are, what you know, what you have information Security Program

Icon_fullscreen
Martin Covill
Quiz by , created about 1 year ago

CISM Quiz

Eye 17
Pin 0
Balloon-left 0
Tags
chrisshaller
Created by chrisshaller about 1 year ago
Martin Covill
Copied by Martin Covill about 1 year ago
Close