Copy and Edit

CISM 2014 Questions - 3

Description

Certificate CISM Quiz on CISM 2014 Questions - 3, created by Eduardo Castella7911 on 17/02/2016.
Eduardo Castella7911
Quiz by Eduardo Castella7911, updated more than 1 year ago
Eduardo Castella7911
Created by Eduardo Castella7911 about 8 years ago
1966
3
0

Resource summary

Question 1

Question
Which of the following is MOST important to the successful promotion of good security management practices?
Answer
  • A. Security metrics
  • B. Security baselines
  • C. Management support
  • D. Periodic training

Question 2

Question
Which of the following security mechanisms is MOST effective in protecting classified data that have been encrypted to prevent disclosure and transmission outside the organization's network?
Answer
  • A. Configuration of firewalls
  • B. Strength of encryption algorithms
  • C. Authentication within application
  • D. Safeguards over keys

Question 3

Question
The PRIMARY objective of a vulnerability assessment is to:
Answer
  • A. reduce risk to the business.
  • B. ensure compliance with security policies.
  • C. provide assurance to management.
  • D. measure efficiency of services provided.

Question 4

Question
Which of the following is the GREATEST concern for an organization in which there is a widespread use of mobile devices?
Answer
  • A. There is an undue reliance on public networks.
  • B. Batteries require constant recharges.
  • C. There is a lack of operating system standardization.
  • D. Mobile devices can be easily lost or stolen.

Question 5

Question
The director of auditing has recommended a specific information security monitoring solution to the information security manager. What should the information security manager do FIRST?
Answer
  • A. Obtain comparative pricing bids and complete the transaction with the vendor offering the best deal.
  • B. Add the purchase to the budget during the next budget preparation cycle to account for costs.
  • C. Perform an assessment to determine correlation with business goals and objectives.
  • D. Form a project team to plan the implementation.

Question 6

Question
Which of the following is the PRIMARY reason to change policies during program development?
Answer
  • A. The policies must comply with new regulatory and legal mandates.
  • B. Appropriate security baselines are no longer set in the policies.
  • C. The policies no longer reflect management intent and direction.
  • D. Employees consistently ignore the policies.

Question 7

Question
Which of the following is the MOST effective way to ensure that noncompliance to information security standards is resolved?
Answer
  • A. Periodic audits of noncompliant areas
  • B. An ongoing vulnerability scanning program
  • C. Annual security awareness training
  • D. Regular reports to executive management

Question 8

Question
What is the PRIMARY purpose of installing an intrusion detection system (IDS)?
Answer
  • A. To identify weaknesses in network security
  • B. To identify patterns of suspicious access
  • C. To identify how an attack was launched on the network
  • D. To identify potential attacks on the internal network

Question 9

Question
Senior management commitment and support for information security can BEST be obtained through presentations that:
Answer
  • A. use illustrative examples of successful attacks.
  • B. explain the technical risks to the organization.
  • C. evaluate the organization against best security practices.
  • D. tie security risks to key business objectives.

Question 10

Question
The recovery time objective (RTO) is reached at which of the following milestones?
Answer
  • A. Disaster declaration
  • B. Recovery of the backups
  • C. Restoration of the system
  • D. Return to business as usual processing

Question 11

Question
Which of the following approaches would be BEST to address significant system vulnerabilities that were discovered during a network scan?
Answer
  • A. All significant vulnerabilities must be mitigated in a timely fashion.
  • B. Treatment should be based on threat, impact and cost considerations.
  • C. Compensatory controls must be implemented for major vulnerabilities.
  • D. Mitigation options should be proposed for management approval.

Question 12

Question
How does knowledge of risk appetite help to increase security control effectiveness?
Answer
  • A. It shows senior management that you understand their needs.
  • B. It provides a basis for redistributing resources to mitigate risk outside the risk tolerance.
  • C. It requires continuous monitoring because the entire risk environment is constantly changing.
  • D. It facilitates communication with management about the importance of security.

Question 13

Question
Which of the following is the MOST important prerequisite to undertaking asset classification?
Answer
  • A. Threat analysis
  • B. Impact assessment
  • C. Controls evaluation
  • D. Penetration testing

Question 14

Question
What is the PRIMARY objective of a risk management program?
Answer
  • A. Minimize inherent risk.
  • B. Eliminate business risk.
  • C. Implement effective controls.
  • D. Reduce residual risk to acceptable levels.

Question 15

Question
Where should resource requirements for information security initially be identified?
Answer
  • A. In policies
  • B. In the architecture
  • C. In the strategy
  • D. In procedures

Question 16

Question
Which of the following actions should take place immediately after a security breach is reported to an information security manager?
Answer
  • A. Confirm the incident
  • B. Determine impact
  • C. Notify affected stakeholders
  • D. Isolate the incident

Question 17

Question
Which of the following benefits that the enterprise receives from employing a systematic incident management program with a formal methodology is MOST important?
Answer
  • A. A formal methodology makes incident management more flexible.
  • B. A formal methodology is more reliant on business continuity activities.
  • C. Each incident responder is able to get broad-based experience.
  • D. Evidence of due diligence supports legal and liability claims.

Question 18

Question
Which of the following is the MOST important aspect of forensic investigations that will potentially involve legal action?
Answer
  • A. The independence of the investigator
  • B. Timely intervention
  • C. Identifying the perpetrator
  • D. Chain of custody

Question 19

Question
Value at risk (VAR) can be used:
Answer
  • A. as a qualitative approach to evaluating risk.
  • B. to determine maximum probable loss over a period of time.
  • C. for risk analysis applicable only to financial organizations.
  • D. as a useful tool to expedite the assessment process.

Question 20

Question
Which of the following is the MOST cost-effective approach to test the security of a legacy application?
Answer
  • A. Identify a similar application and refer to its security weaknesses.
  • B. Recompile the application using the latest library and review the error codes.
  • C. Employ reverse engineering techniques to derive functionalities.
  • D. Conduct a vulnerability assessment to detect application weaknesses.

Question 21

Question
As part of system development, how should an organization determine which element of the confidentiality, integrity and availability (CIA) triad requires the MOST protection?
Answer
  • A. It should be based on the threat to each of the elements.
  • B. Availability is most important.
  • C. It should be based on the risk to each of the elements.
  • D. All elements are equally important.

Question 22

Question
Tightly integrated IT systems are MOST likely to be affected by:
Answer
  • A. aggregated risk.
  • B. systemic risk.
  • C. operational risk.
  • D. cascading risk.

Question 23

Question
During which phase of development is it MOST appropriate to begin assessing the risk of a new application system?
Answer
  • A. Feasibility
  • B. Design
  • C. Development
  • D. Testing

Question 24

Question
Which of the following BEST mitigates a situation where an application programmer requires access to production data?
Answer
  • A. Create a separate account for the programmer as a power user.
  • B. Log all of the programmer's activity for review by their supervisor.
  • C. Have the programmer sign a letter accepting full responsibility.
  • D. Perform regular audits of the application.

Question 25

Question
What is the MOST important objective of a postincident review?
Answer
  • A. Capture lessons learned to improve the process.
  • B. Develop a process for continuous improvement.
  • C. Develop a business case for the security program budget.
  • D. Identify new incident management tools.

Question 26

Question
Which of the following is the BEST metric for evaluating the effectiveness of an intrusion detection mechanism?
Answer
  • A. Number of attacks detected
  • B. Number of successful attacks
  • C. Ratio of false positives to false negatives
  • D. Ratio of successful to unsuccessful attacks

Question 27

Question
In a business impact analysis, the value of an information system should be based on the overall:
Answer
  • A. cost of recovery.
  • B. cost to recreate.
  • C. opportunity cost.
  • D. cost of emergency operations.

Question 28

Question
An organization has consolidated global operations. The chief information officer (CIO) has asked the chief information security officer (CISO) to develop a new organization information security strategy. Which of the following actions should be taken FIRST?
Answer
  • A. Identify the assets.
  • B. Conduct a risk assessment.
  • C. Define the scope.
  • D. Perform a business impact analysis (BIA).

Question 29

Question
Under what circumstances is it MOST appropriate to reduce control strength?
Answer
  • A. Assessed risk is below acceptable levels.
  • B. Risk cannot be determined.
  • C. The control cost is high.
  • D. The control is not effective.

Question 30

Question
What is the BEST protocol to ensure confidentiality of transmissions in a business-to-customer (B2C) financial web application?
Answer
  • A. Secure Sockets Layer (SSL)
  • B. Secure Shell (SSH)
  • C. IP Security (IPSec)
  • D. Secure/Multipurpose Internet Mail Extensions (S/MIME)

Question 31

Question
What is the PRIMARY basis for the selection and implementation of products to protect the IT infrastructure?
Answer
  • A. Regulatory requirements
  • B. Technical expert advisories
  • C. State-of-the-art technology
  • D. A risk assessment

Question 32

Question
What is the PRIMARY basis for the selection of controls and countermeasures?
Answer
  • A. Eliminating IT risk
  • B. Cost-benefit balance
  • C. Resource management
  • D. The number of assets protected

Question 33

Question
Of the following, which is the MOST effective way to measure strategic alignment of an information security program?
Answer
  • A. Track audits over time.
  • B. Evaluate incident losses.
  • C. Analyze business cases.
  • D. Interview business owners.

Question 34

Question
Which of the following factors BEST helps determine the appropriate protection level for an information asset?
Answer
  • A. The cost of acquisition and implementation of the asset
  • B. Knowledge of vulnerabilities present in the asset
  • C. The degree of exposure to known threats
  • D. The criticality of the business function supported by the asset

Question 35

Question
How does a security information and event management (SIEM) solution MOST likely detect the existence of an advanced persistent threat (APT) in its infrastructure?
Answer
  • A. Through analysis of the network traffic history
  • B. Through stateful inspection of firewall packets
  • C. Through identification of zero-day attacks
  • D. Through vulnerability assessments

Question 36

Question
The organization has decided to outsource the majority of the IT department with a vendor that is hosting servers in a foreign country. Of the following, which is the MOST critical security consideration?
Answer
  • A. Laws and regulations of the country of origin may not be enforceable in the foreign country.
  • B. A security breach notification might get delayed due to the time difference.
  • C. Additional network intrusion detection sensors should be installed, resulting in an additional cost.
  • D. The company could lose physical control over the server and be unable to monitor the physical security posture of the servers.

Question 37

Question
Which of the following ensures that newly identified security weaknesses in an operating system are mitigated in a timely fashion?
Answer
  • A. Patch management
  • B. Change management
  • C. Security baselines
  • D. Acquisition management

Question 38

Question
The effectiveness of segregation of duties may be MOST seriously compromised when:
Answer
  • A. user IDs of terminated staff remain active in application systems.
  • B. access privileges are accumulated based on previous job functions.
  • C. application role-based access deviates from the organizational hierarchies.
  • D. role mining tools are used in the access privilege review.

Question 39

Question
Why should the analysis of risk include consideration of potential impact?
Answer
  • A. Potential impact is a central element of risk.
  • B. Potential impact is related to asset value.
  • C. Potential impact affects the extent of mitigation.
  • D. Potential impact helps determine the exposure.

Question 40

Question
A password hacking tool was used to capture detailed bank account information and personal identification numbers (PINs). Upon confirming the incident, the NEXT step is to:
Answer
  • A. notify law enforcement.
  • B. start containment.
  • C. make an image copy of the media.
  • D. isolate affected servers.

Question 41

Question
Which of the following BEST assists the information security manager in identifying new threats to information security?
Answer
  • A. Performing more frequent reviews of the organization's risk factors
  • B. Developing more realistic information security risk scenarios
  • C. Understanding the flow and classification of information used by the organization
  • D. A process to monitor postincident review reports prepared by IT staff

Question 42

Question
An employee has found a suspicious file on a server. The employee thinks the file is a virus and contacts the information security manager. What is the FIRST step to take?
Answer
  • A. Contain the file.
  • B. Delete the file.
  • C. Verify whether the file is malicious.
  • D. Report the suspicious file to management.

Question 43

Question
What is the MOST important action prior to having a third party perform an attack and penetration test against an organization?
Answer
  • A. Ensure that the third party provides a demonstration on a test system.
  • B. Ensure that goals and objectives are clearly defined.
  • C. Ensure that technical staff has been briefed on what to expect.
  • D. Ensure that special backups of production servers are taken.

Question 44

Question
Which of the following metrics would be the MOST useful in measuring how well information security is monitoring violation logs?
Answer
  • A. Penetration attempts investigated
  • B. Violation log reports produced
  • C. Violation log entries
  • D. Frequency of corrective actions taken

Question 45

Question
Which of the following is the MOST important prerequisite for establishing information security management within an organization?
Answer
  • A. Senior management commitment
  • B. Information security framework
  • C. Information security organizational structure
  • D. Information security policy

Question 46

Question
A newly-hired information security manager examines the 10-year old business continuity plan and notes that the maximum tolerable outage (MTO) is much shorter than the allowable interruption window (AIW). What action should be taken as a result of this information?
Answer
  • A. Reassess the maximum tolerable outage (MTO).
  • B. Conduct a business impact assessment (BIA) and update the plan.
  • C. Increase the service delivery objective (SDO).
  • D. Take no action; maximum tolerable outage (MTO) is not related to AIW.

Question 47

Question
Which of the following change management activities would be a clear indicator that normal operational procedures require examination?
Answer
  • A. A high percentage of similar change requests
  • B. A high percentage of change request postponements
  • C. A high percentage of canceled change requests
  • D. A high percentage of emergency change requests

Question 48

Question
Which of the following purposes is for developing a security architecture as a way of meeting business objectives?
Answer
  • A. To reduce the cost of system development
  • B. To aid in strategy and policy development
  • C. To effectively manage complexity
  • D. To determine areas that will be a problem

Question 49

Question
An organization's information security strategy should be based on:
Answer
  • A. managing risk relative to business objectives.
  • B. managing risk to a zero level and minimizing insurance premiums.
  • C. avoiding occurrence of risks so that insurance is not required.
  • D. transferring most risks to insurers and saving on control costs.

Question 50

Question
Information security managers should use risk assessment techniques to:
Answer
  • A. justify selection of risk mitigation strategies.
  • B. maximize the return on investment (ROI).
  • C. provide documentation for auditors and regulators.
  • D. quantify risks that would otherwise be subjective.

Question 51

Question
A business impact analysis (BIA) is the BEST tool for determining:
Answer
  • A. total cost of ownership.
  • B. priority of restoration.
  • C. annualized loss expectancy (ALE).
  • D. residual risk.

Question 52

Question
Who is in the BEST position to determine the level of information security needed for a specific business application?
Answer
  • A. The system developer
  • B. The information security manager
  • C. The system custodian
  • D. The data owner

Question 53

Question
Proximity factors must be considered when:
Answer
  • A. conducting a business impact assessment.
  • B. conducting a table-top business continuity test.
  • C. developing disaster recovery metrics.
  • D. selecting an alternate recovery site.

Question 54

Question
The PRIMARY objective of a security steering group is to:
Answer
  • A. ensure information security covers all business functions.
  • B. ensure information security aligns with business goals.
  • C. raise information security awareness across the organization.
  • D. implement all decisions on security management across the organization.

Question 55

Question
Which of the following is the MOST important factor when designing information security architecture?
Answer
  • A. Technical platform interfaces
  • B. Scalability of the network
  • C. Development methodologies
  • D. Stakeholder requirements

Question 56

Question
Which of the following factors is MOST important for the successful implementation of an organization's information security program?
Answer
  • A. Senior management support
  • B. Budget for security activities
  • C. Regular vulnerability assessments
  • D. Knowledgeable security administrators

Question 57

Question
Where should an intranet server generally be placed?
Answer
  • A. On the internal network
  • B. On the firewall server
  • C. On the external router
  • D. On the primary domain controller

Question 58

Question
What action should be taken in regards to data classification requirements before engaging outsourced providers?
Answer
  • A. Ensure the data classification requirements are compatible with the provider's own classification.
  • B. Ensure the data classification requirements are communicated to the provider.
  • C. Ensure the data classification requirements exceed those of the outsourcer.
  • D. Ensure the data classification requirements are stated in the contract.

Question 59

Question
What does a network vulnerability assessment intend to identify?
Answer
  • A. 0-day vulnerabilities
  • B. Malicious software and spyware
  • C. Security design flaws
  • D. Misconfiguration and missing updates

Question 60

Question
What is the MOST important reason for formally documenting security procedures?
Answer
  • A. Ensure processes are repeatable and sustainable.
  • B. Ensure alignment with business objectives.
  • C. Ensure auditability by regulatory agencies.
  • D. Ensure objective criteria for the application of metrics.

Question 61

Question
Which of the following authentication methods prevents authentication replay?
Answer
  • A. Password hash implementation
  • B. Challenge/response mechanism
  • C. Wired Equivalent Privacy (WEP) encryption usage
  • D. HTTP Basic Authentication

Question 62

Question
What is the PRIMARY objective of a post-event review in incident response?
Answer
  • A. Adjust budget provisioning
  • B. Preserve forensic data
  • C. Improve the response process
  • D. Ensure the incident is fully documented

Question 63

Question
Which of the following choices BEST justifies an information security program?
Answer
  • A. The impact on critical IT assets
  • B. A detailed business case
  • C. Steering committee approval
  • D. User acceptance

Question 64

Question
The MOST important basis for developing a business case is the:
Answer
  • A. risk that will be addressed.
  • B. financial analysis of benefits.
  • C. alignment with organizational objectives.
  • D. feasibility and value proposition.

Question 65

Question
Which of the following is the MOST important item to consider when evaluating products to monitor security across the enterprise?
Answer
  • A. Ease of installation
  • B. Product documentation
  • C. Available support
  • D. System overhead

Question 66

Question
Which of the following is the MOST important element to ensure the success of a disaster recovery test at a vendor-provided hot site?
Answer
  • A. Tests are scheduled on weekends
  • B. Network IP addresses are predefined
  • C. Equipment at the hot site is identical
  • D. Business management actively participates

Question 67

Question
Which of the following is the MOST appropriate individual to ensure that new exposures have not been introduced into an existing application during the change management process?
Answer
  • A. System analyst
  • B. System user
  • C. Operations manager
  • D. Data security officer

Question 68

Question
The MOST timely and effective approach to detecting nontechnical security violations in an organization is:
Answer
  • A. the development of organizationwide communication channels.
  • B. periodic third-party auditing of incident reporting logs.
  • C. an automated policy compliance monitoring system.
  • D. deployment of suggestion boxes throughout the organization.

Question 69

Question
Laws and regulations should be addressed by the information security manager:
Answer
  • A. to the extent that they impact the enterprise.
  • B. by implementing international standards.
  • C. by developing policies that address the requirements.
  • D. to ensure that guidelines meet the requirements.

Question 70

Question
Which of the following is the MOST likely to change an organization's culture to one that is more security conscious?
Answer
  • A. Adequate security policies and procedures
  • B. Periodic compliance reviews
  • C. Security steering committees
  • D. Security awareness campaigns

Question 71

Question
When an organization is using an automated tool to manage and house its business continuity plans, which of the following is the PRIMARY concern?
Answer
  • A. Ensuring accessibility should a disaster occur
  • B. Versioning control as plans are modified
  • C. Broken hyperlinks to resources stored elsewhere
  • D. Tracking changes in personnel and plan assets

Question 72

Question
During an audit, an information security manager discovered that sales representatives are sending sensitive customer information through email messages. Which of the following is the BEST course of action to address the issue?
Answer
  • A. Review the finding with the sales manager to evaluate the risk and impact.
  • B. Report the issue to senior management immediately.
  • C. Request that the sales representatives stop emailing sensitive information.
  • D. Provide security awareness training to the sales representatives.

Question 73

Question
An organization has verified that its customer information was recently exposed. Which of the following is the FIRST step a security manager should take in this situation?
Answer
  • A. Inform senior management.
  • B. Determine the extent of the compromise.
  • C. Report the incident to the authorities.
  • D. Communicate with the affected customers.

Question 74

Question
After a risk assessment, it is determined that the cost to mitigate the risk is much greater than the benefit to be derived. The information security manager should recommend to business management that the risk be:
Answer
  • A. transferred.
  • B. treated.
  • C. accepted.
  • D. terminated.

Question 75

Question
Security risk assessments are MOST cost-effective to a software development organization when they are performed:
Answer
  • A. before system development begins.
  • B. at system deployment.
  • C. before developing a business case.
  • D. at each stage of the software development life cycle (SDLC).

Question 76

Question
What is the MOST effective way to ensure network users are aware of their responsibilities to comply with an organization's security requirements?
Answer
  • A. Logon banners displayed at every logon
  • B. Periodic security-related email messages
  • C. An intranet web site for information security
  • D. Circulating the information security policy

Question 77

Question
An information security manager has implemented procedures for monitoring specific activities on the network. The system administrator has been trained to analyze the network events, take appropriate action and provide reports to the information security manager. What additional monitoring should be implemented to give a more accurate, risk-based view of network activity?
Answer
  • A. The system administrator should be monitored by a separate reviewer.
  • B. All activity on the network should be monitored.
  • C. No additional monitoring is needed in this situation.
  • D. Monitoring should be done only by the information security manager.

Question 78

Question
Which of the following will BEST protect an organization from internal security attacks?
Answer
  • A. Static IP addressing
  • B. Internal address translation
  • C. Prospective employee background checks
  • D. Employee awareness certification program

Question 79

Question
Which of the following is in the BEST position to provide information on regulatory and legal compliance requirements that have an effect on information security?
Answer
  • A. Corporate legal officer
  • B. Enterprise risk manager
  • C. Compliance officer
  • D. Affected departments

Question 80

Question
Which of the following terms and conditions represent a significant deficiency if included in a commercial hot site contract?
Answer
  • A. A hot site facility will be shared in multiple disaster declarations
  • B. All equipment is provided "at time of disaster, not on floor"
  • C. The facility is subject to a "first-come, first-served" policy
  • D. Equipment may be substituted with equivalent models

Question 81

Question
Which of the following situations would be the MOST concern to a security manager?
Answer
  • A. Audit logs are not enabled on a production server
  • B. The logon ID for a terminated systems analyst still exists on the system
  • C. The help desk has received numerous results of users receiving phishing emails
  • D. A Trojan was found to be installed on a system administrator's laptop

Question 82

Question
Which of the following criteria is the MOST essential for operational metrics?
Answer
  • A. Timeliness of the reporting
  • B. Relevance to the recipient
  • C. Accuracy of the measurement
  • D. The cost of obtaining the metrics

Question 83

Question
Which of the following should be included in a good privacy statement?
Answer
  • A. A notification of liability on accuracy of information
  • B. A notification that information will be encrypted
  • C. A statement of what the company will do with information it collects
  • D. A description of the information classification process

Question 84

Question
Which of the following is a preventive measure?
Answer
  • A. A warning banner
  • B. Audit trails
  • C. An access control
  • D. An alarm system

Question 85

Question
Which of the following is MOST essential for a risk management program to be effective?
Answer
  • A. Flexible security budget
  • B. Sound risk baseline
  • C. Detection of new risk
  • D. Accurate risk reporting

Question 86

Question
When designing information security standards for an enterprise, the information security manager should require that an extranet server be placed:
Answer
  • A. outside the firewall.
  • B. on the firewall server.
  • C. on a screened subnet.
  • D. on the external router.

Question 87

Question
Assuming that the value of information assets is known, which of the following gives the information security manager the MOST objective basis for determining that the information security program is delivering value?
Answer
  • A. Number of controls
  • B. Cost of achieving control objectives
  • C. Effectiveness of controls
  • D. Test results of controls

Question 88

Question
Which of the following is PRIMARILY related to the emergence of governance, risk and compliance (GRC)?
Answer
  • A. The increasing need for controls
  • B. The policy development process
  • C. The integration of assurance-related activities
  • D. A model for information security program development

Question 89

Question
What is the BEST way to determine if an anomaly-based intrusion detection system (IDS) is properly installed?
Answer
  • A. Simulate an attack and review IDS performance.
  • B. Use a honeypot to check for unusual activity.
  • C. Audit the configuration of the IDS.
  • D. Benchmark the IDS against a peer site.

Question 90

Question
What responsibility do data owners normally have?
Answer
  • A. Applying emergency changes to application data
  • B. Administering security over database records
  • C. Migrating application code changes to production
  • D. Determining the level of application security required

Question 91

Question
Which of the following would be the MOST relevant factor when defining the information classification policy?
Answer
  • A. Quantity of information
  • B. Available IT infrastructure
  • C. Benchmarking
  • D. Requirements of data owners

Question 92

Question
When creating a forensic image of a hard drive, which of the following should be the FIRST step?
Answer
  • A. Identify a recognized forensics software tool to create the image.
  • B. Establish a chain of custody log.
  • C. Connect the hard drive to a write blocker.
  • D. Generate a cryptographic hash of the hard drive contents.

Question 93

Question
Which of the following actions is MOST important when a server is infected with a virus?
Answer
  • A. Isolate the infected server(s) from the network.
  • B. Identify all potential damage caused by the infection.
  • C. Ensure that the virus database files are current.
  • D. Establish security weaknesses in the firewall.

Question 94

Question
An organization's information security manager is planning the structure of the Information Security Steering Committee. Which of the following groups should the manager invite?
Answer
  • A. External audit and network penetration testers
  • B. Board of directors and the organization's regulators
  • C. External trade union representatives and key security vendors
  • D. Leadership from IT, human resources and the sales department

Question 95

Question
Which of the following will the data backup policy contain?
Answer
  • A. Criteria for data backup
  • B. Personnel responsible for backup
  • C. A data backup schedule
  • D. A list of systems to be backed up

Question 96

Question
In following up on a security incident, the system administrator is to copy data from one hard disk to another. From a forensic perspective, which of the following tasks must be ensured?
Answer
  • A. Copy to the same disk model as the original.
  • B. Make a dual backup of the original disk.
  • C. Keep the digital hash from both hard disks.
  • D. Perform a restoration test after replication.

Question 97

Question
What is the BEST way to ensure users comply with organizational security requirements for password complexity?
Answer
  • A. Include password construction requirements in the security standards
  • B. Require each user to acknowledge the password requirements
  • C. Implement strict penalties for user noncompliance
  • D. Enable system-enforced password configuration

Question 98

Question
Which of the following is the MOST important step when an employee is transferred to a different function?
Answer
  • A. Reviewing and modifying access rights
  • B. Assigning new security responsibilities
  • C. Conducting specific training for the new role
  • D. Knowledge of security weaknesses in last department

Question 99

Question
What is the BEST approach to implement adequate segregation of duties in business critical applications, where shared access to elevated privileges by a small group is necessary?
Answer
  • A. Ensure access to individual functions can be granted to individual users only.
  • B. Implement role-based access control in the application.
  • C. Enforce manual procedures ensuring separation of conflicting duties.
  • D. Create service accounts that can only be used by authorized team members.

Question 100

Question
Which of the following would BEST prepare an information security manager for regulatory reviews?
Answer
  • A. Assign an information security administrator as regulatory liaison.
  • B. Perform self-assessments using regulatory guidelines and reports.
  • C. Assess previous regulatory reports with process owners input.
  • D. Ensure all regulatory inquiries are sanctioned by the legal department.

Question 101

Question
When electronically stored information is requested during a fraud investigation, which of the following should be the FIRST priority?
Answer
  • A. Assigning responsibility for acquiring the data
  • B. Locating the data and preserving the integrity of the data
  • C. Creating a forensically sound image
  • D. Issuing a litigation hold to all affected parties

Question 102

Question
Which of the following should a successful information security management program use to determine the amount of resources devoted to mitigating exposures?
Answer
  • A. Risk analysis results
  • B. Audit report findings
  • C. Penetration test results
  • D. Amount of IT budget available

Question 103

Question
Which of the following is the MOST usable deliverable of an information security risk analysis?
Answer
  • A. Business impact analysis (BIA) report
  • B. List of action items to mitigate risk
  • C. Assignment of risks to process owners
  • D. Quantification of organizational risk

Question 104

Question
Which of the following is the GREATEST success factor for effectively managing information security?
Answer
  • A. An adequate budget
  • B. Senior level authority
  • C. A robust technology
  • D. Effective business relationships

Question 105

Question
Simple Network Management Protocol v2 (SNMP v2) is used frequently to monitor networks. Which of the following vulnerabilities does it always introduce?
Answer
  • A. Remote buffer overflow
  • B. Cross site scripting
  • C. Clear text authentication
  • D. Man-in-the-middle attack

Question 106

Question
Which of the following BEST accomplishes secure customer use of an e-commerce application?
Answer
  • A. Data encryption
  • B. Digital signatures
  • C. Strong passwords
  • D. Two-factor authentication

Question 107

Question
The MOST effective approach to address issues that arise between IT management, business units and security management when implementing a new security strategy is for the information security manager to:
Answer
  • A. escalate issues to an external third party for resolution.
  • B. ensure that senior management provide authority for security to address the issues.
  • C. insist that managers or units not in agreement with the security solution accept the risk.
  • D. refer the issues to senior management along with any security recommendations.

Question 108

Question
Which of the following provides the BEST confirmation that the business continuity/disaster recovery plan objectives have been achieved?
Answer
  • A. The recovery time objective (RTO) was not exceeded during testing
  • B. Objective testing of the business continuity/disaster recovery plan has been carried out consistently
  • C. The recovery point objective (RPO) was proved inadequate by disaster recovery plan testing
  • D. Information assets have been valued and assigned to owners per the business continuity plan/disaster recovery plan

Question 109

Question
Why should an incident management team conduct a postincident review?
Answer
  • A. To identify relevant electronic evidence
  • B. To identify lessons learned
  • C. To identify the hacker's identity
  • D. To identify affected areas

Question 110

Question
The BEST approach to secure approval for information security expenditures is to:
Answer
  • A. conduct a cost-benefit analysis.
  • B. develop a business case.
  • C. calculate return on investment (ROI).
  • D. evaluate loss history.

Question 111

Question
Which of the following attacks is BEST mitigated by utilizing strong passwords?
Answer
  • A. Man-in-the-middle attack
  • B. Brute force attack
  • C. Remote buffer overflow
  • D. Root kit

Question 112

Question
The requirement for due diligence is MOST closely associated with which of the following?
Answer
  • A. The right to audit
  • B. Service level agreements (SLAs)
  • C. Appropriate standard of care
  • D. Periodic security reviews

Question 113

Question
Which of the following is the MOST important element of an information security strategy?
Answer
  • A. Defined objectives
  • B. Time frames for delivery
  • C. Adoption of a control framework
  • D. Complete policies

Question 114

Question
Which of the following is the MOST important action to take when engaging third-party consultants to conduct an attack and penetration test?
Answer
  • A. Request a list of the software to be used
  • B. Provide clear directions to IT staff
  • C. Monitor intrusion detection system (IDS) and firewall logs closely
  • D. Establish clear rules of engagement

Question 115

Question
Who in an organization has the responsibility for classifying information?
Answer
  • A. Data custodian
  • B. Database administrator
  • C. Information security officer
  • D. Data owner

Question 116

Question
The information security manager should treat regulatory compliance requirements as:
Answer
  • A. an organizational mandate.
  • B. a risk management priority.
  • C. a purely operational issue.
  • D. just another risk.

Question 117

Question
After obtaining commitment from senior management, which of the following should be completed NEXT when establishing an information security program?
Answer
  • A. Define security metrics
  • B. Conduct a risk assessment
  • C. Perform a gap analysis
  • D. Procure security tools

Question 118

Question
When considering outsourcing services, at what point should information security become involved in the vendor management process?
Answer
  • A. During contract negotiation
  • B. Upon request for assistance from the business unit
  • C. When requirements are being established
  • D. When a security incident occurs

Question 119

Question
Which of the following is an example of a corrective control?
Answer
  • A. Diverting incoming traffic as a response to a denial of service (DoS) attack
  • B. Filtering network traffic
  • C. Examining inbound network traffic for viruses
  • D. Logging inbound network traffic

Question 120

Question
Which of the following actions should be taken when an information security manager discovers that a hacker is footprinting the network perimeter?
Answer
  • A. Reboot the border router connected to the firewall
  • B. Check IDS logs and monitor for any active attacks
  • C. Update IDS software to the latest available version
  • D. Enable server trace logging on the DMZ segment

Question 121

Question
Which of the following steps should be performed FIRST in the risk assessment process?
Answer
  • A. Staff interviews
  • B. Threat identification
  • C. Asset identification and valuation
  • D. Determination of the likelihood of identified risks

Question 122

Question
Which of the following is the BEST basis for determining the criticality and sensitivity of information assets?
Answer
  • A. A threat assessment
  • B. A vulnerability assessment
  • C. A resource dependency assessment
  • D. An impact assessment

Question 123

Question
In which of the following system development life cycle (SDLC) phases are access control and encryption algorithms chosen?
Answer
  • A. Procedural design
  • B. Architectural design
  • C. System design specifications
  • D. Software development

Question 124

Question
An IS manager has decided to implement a security system to monitor access to the Internet and prevent access to numerous sites. Immediately upon installation, employees flood the IT helpdesk with complaints of being unable to perform business functions on Internet sites. This is an example of:
Answer
  • A. conflicting security controls with organizational needs.
  • B. strong protection of information resources.
  • C. implementing appropriate controls to reduce risk.
  • D. proving information security's protective abilities.

Question 125

Question
Which of the following is the BEST indicator that security awareness training has been effective?
Answer
  • A. Employees sign to acknowledge the security policy
  • B. More incidents are being reported
  • C. A majority of employees have completed training
  • D. No incidents have been reported in three months

Question 126

Question
Which of the following BEST supports the principle of security proportionality?
Answer
  • A. Release management
  • B. Ownership schema
  • C. Resource dependency analysis
  • D. Asset classification

Question 127

Question
Which of the following types of information would the information security manager expect to have the LOWEST level of security protection in a publicly traded, multinational enterprise?
Answer
  • A. Strategic business plan
  • B. Upcoming financial results
  • C. Customer personal information
  • D. Previous financial results

Question 128

Question
Alignment of an information security program to business objectives is BEST achieved through:
Answer
  • A. senior management directing the information security program.
  • B. periodic risk analysis and treatment.
  • C. a security steering committee with representatives from all business functions.
  • D. regular security audits and ongoing monitoring.

Question 129

Question
What activity should the information security manager perform FIRST after finding that compliance with a set of standards is weak?
Answer
  • A. Initiate the exception process.
  • B. Modify policy to address the risk.
  • C. Increase compliance enforcement.
  • D. Perform a risk assessment.

Question 130

Question
What activity needs to be performed for previously accepted risk?
Answer
  • A. Risk should be reassessed periodically because risk changes over time.
  • B. Accepted risk should be flagged to avoid future reassessment efforts.
  • C. Risk should be avoided next time to optimize the risk profile.
  • D. Risk should be removed from the risk log after it is accepted.

Question 131

Question
Inherent control strength is PRIMARILY a function of which of the following?
Answer
  • A. Implementation
  • B. Design
  • C. Testing
  • D. Policy

Question 132

Question
Which of the following is MOST effective in preventing weaknesses from being introduced into existing production systems?
Answer
  • A. Patch management
  • B. Change management
  • C. Security baselines
  • D. Virus detection

Question 133

Question
Which of the following actions should the information security manager take FIRST on finding that current controls are not sufficient to prevent a serious compromise?
Answer
  • A. Strengthen existing controls.
  • B. Reassess the risk.
  • C. Set new control objectives.
  • D. Modify security baselines.

Question 134

Question
To reduce the possibility of service interruptions, an entity enters into contracts with multiple Internet service providers (ISPs). Which of the following would be the MOST important item to include?
Answer
  • A. Service level agreements (SLAs)
  • B. Right-to-audit clause
  • C. Intrusion detection system (IDS) services
  • D. Spam filtering services

Question 135

Question
Which of the following would be the GREATEST challenge when developing a standard awareness training program for a global organization?
Answer
  • A. Technical input requirements for IT security staff
  • B. Evaluating training program effectiveness
  • C. A diverse culture and varied technical abilities of end users
  • D. Availability of users either on weekends or after office hours

Question 136

Question
Which of the following is the MOST appropriate method of ensuring password strength in a large organization?
Answer
  • A. Attempt to reset several passwords to weaker values
  • B. Install code to capture passwords for periodic audit
  • C. Sample a subset of users and request their passwords for review
  • D. Install strong password settings on each platform

Question 137

Question
Which of the following is the BEST approach to dealing with inadequate funding of the security program?
Answer
  • A. Eliminate low-priority security services.
  • B. Require management to accept the increased risk.
  • C. Prioritize risk mitigation and educate management.
  • D. Reduce monitoring and compliance enforcement activities.

Question 138

Question
Which of the following is the MOST critical success factor of an information security program?
Answer
  • A. Developing information security policies and procedures
  • B. Senior management commitment
  • C. Conducting security training and awareness for all users
  • D. Establishing an information security management system

Question 139

Question
Phishing is BEST mitigated by which of the following?
Answer
  • A. Security monitoring software
  • B. Encryption
  • C. Two-factor authentication
  • D. User awareness

Question 140

Question
Which of the following is the BEST way to ensure that a corporate network is adequately secured against external attack?
Answer
  • A. Utilize an intrusion detection system.
  • B. Establish minimum security baselines.
  • C. Implement vendor recommended settings.
  • D. Perform periodic penetration testing.

Question 141

Question
Which of the following should be included in an annual information security budget that is submitted for management approval?
Answer
  • A. A cost-benefit analysis of budgeted resources
  • B. All of the resources that are recommended by the business
  • C. Total cost of ownership (TCO)
  • D. Baseline comparisons

Question 142

Question
The MOST important outcome of aligning information security governance with corporate governance is to:
Answer
  • A. show that information security understands the rules.
  • B. provide regulatory compliance.
  • C. maximize the cost-effectiveness of controls.
  • D. minimize the number of rules and regulations required.

Question 143

Question
Which of the following defines minimum standards for securing the technical infrastructure?
Answer
  • A. Information security strategy
  • B. Information security guidelines
  • C. Information security model
  • D. Information security architecture

Question 144

Question
Which of the following would be MOST relevant to include in a cost-benefit analysis of a two-factor authentication system?
Answer
  • A. Annual loss expectancy (ALE) of incidents
  • B. Frequency of incidents
  • C. Total cost of ownership (TCO)
  • D. Approved budget for the project

Question 145

Question
In what circumstances should mandatory access controls (MAC) be used?
Answer
  • A. When the organization has a high risk tolerance
  • B. When delegation of rights is contrary to policy
  • C. When the control policy specifies continuous oversight
  • D. When access is permitted, unless explicitly denied

Question 146

Question
Which one of the following network protocols is secure?
Answer
  • A. Simple Mail Transfer Protocol (SMTP)
  • B. File Transfer Protocol (FTP)
  • C. Post Office Protocol (POP3)
  • D. Simple Network Management Protocol (SNMP v3)

Question 147

Question
Which of the following choices should be assessed after the likelihood of a loss event has been determined?
Answer
  • A. The magnitude of impact
  • B. Risk tolerance
  • C. The replacement cost of assets
  • D. The book value of assets

Question 148

Question
An outsource service provider must handle sensitive customer information. Which of the following is MOST important for an information security manager to know?
Answer
  • A. Security in storage and transmission of sensitive data
  • B. Provider's level of compliance with industry standards
  • C. Security technologies in place at the facility
  • D. Results of the latest independent security review

Question 149

Question
What is the result of segmenting a highly sensitive database?
Answer
  • A. It reduces threat.
  • B. It reduces criticality.
  • C. It reduces sensitivity.
  • D. It reduces exposure.

Question 150

Question
When establishing a new incident management team whose members will serve on a part-time basis, which of the following means of training is MOST effective?
Answer
  • A. Formal training
  • B. Mentoring
  • C. On-the-job training
  • D. Induction

Question 151

Question
Three employees reported the theft or loss of their laptops while on business trips. The FIRST course of action for the security manager is to:
Answer
  • A. assess the impact of the loss and determine mitigating steps.
  • B. communicate the best practices in protecting laptops to all laptop users.
  • C. instruct the erring employees to pay a penalty for the lost laptops.
  • D. recommend that management report the incident to the police and file for insurance.
Show full summary Hide full summary

Want to create your own Quizzes for free with GoConqr? Learn more.

Similar

CISM 2014 Questions - 1
Eduardo Castella7911
CISM 2014 Questions - 2
Eduardo Castella7911
CISM 2014 Questions - With duplicates.
Eduardo Castella7911
CISM Quiz
Martin Covill
CISM 2014 Questions - 1
Rob van der Heijden
CISM 2014 Questions - 2
Rob van der Heijden
Causes of the Cold War Quiz
Fro Ninja
Present Simple vs. Present Continuous
Marek Mazur
Psychology A1
Ellie Hughes
Strength and Limitations of research methods
Isobel Wagner
Physics 1
Peter Hoskins
Browse Library