CISM Final Assessment 1

A software vendor has announced a zero-day vulnerability that exposes an organization’s critical business systems. The vendor has released an emergency patch. Which of the following should be the information security manager’s PRIMARY concern?

What is the MOST important reason to regularly report information security risk to relevant stakeholders?

Which of the following is MOST important to ensure ongoing senior management commitment to an organization’s information security strategy?

A penetration test of a new system has identified a number of critical vulnerabilities, jeopardizing the go-live date. The information security manager is asked by the system owner to approve an exception to allow the system to be implemented without fixing the vulnerabilities. Which of the following is the MOST appropriate course of action?

Which of the following information security activities is MOST helpful to support compliance with information security policy?

Which of the following is MOST important to determine following the discovery and eradication of a malware attack?

Which of the following is MOST helpful in ensuring an information security governance framework continues to support business objectives?

Reviewing which of the following would be MOST helpful when a new information security manager is developing an information security strategy for a non-regulated organization?

In order to understand an organization’s security posture, it is MOST important for an organization’s senior leadership to:

Information security controls should be designed PRIMARILY based on:

An organization involved in e-commerce activities operating from its home country opened a new office in another country with stringent security laws. In this scenario, the overall security strategy should be based on:

An information security manager developing an incident response plan MUST ensure it includes:

Which of the following is the MOST effective way to help staff members understand their responsibilities for information security?

Security program development is PRIMARILY driven by which of the following?

An organization has identified a risk scenario that has low impact to the organization but is very costly to mitigate. Which risk treatment option is MOST appropriate in this situation?

Prior to conducting a forensic examination, an information security manager should:

The fundamental purpose of establishing security metrics is to:

Which of the following presents the GREATEST challenge to a security operations center’s timely identification of potential security breaches?

An organization plans to utilize Software as a Service (SaaS) and is in the process of selecting a vendor. What should the information security manager do FIRST to support this initiative?

An online bank identifies a successful network attack in progress. The bank should FIRST:

Which of the following provides an information security manager with the MOST accurate indication of the organization’s ability to respond to a cyber attack?

Which of the following would be MOST helpful to identify worst-case disruption scenarios?

Which of the following BEST enables an organization to appropriately prioritize information security-focused projects?

Which of the following should an information security manager do FIRST upon learning that some security hardening settings may negatively impact future business activity?

Which of the following activities MUST be performed by an information security manager for change requests?

The PRIMARY purpose for continuous monitoring of security controls is to ensure:

Which of the following is the MOST important factor of a successful information security program?

Which of the following messages would be MOST effective in obtaining senior management’s commitment to information security management?

When choosing the best controls to mitigate risk to acceptable levels, the information security manager s decision should be MAINLY driven by:

A high-risk issue is discovered during an information security risk assessment of a legacy application. The business is unwilling to allocate the resources to remediate the issue. Which of the following would be the information security manager’s BEST course of action?

The PRIMARY benefit of introducing a single point of administration in network monitoring is that it:

Which of the following is the MOST important reason to document information security incidents that are reported across the organization?

Which of the following is MOST important for building a robust information security culture within an organization?

Which of the following is the BEST way for an organization to ensure that incident response teams are properly prepared?

Which of the following metrics BEST measures the effectiveness of an organization’s information security program?

Which of the following is MOST important when conducting a forensic investigation?

Which of the following presents the GREATEST challenge to the recovery of critical systems and data following a ransomware incident?

An organization is aligning its incident response capability with a public cloud service provider. What should be the information security manager’s FIRST course of action?

An information security manager is reporting on open items from the risk register to senior management. Which of the following is MOST important to communicate with regard to these risks?

An information security team has discovered that users are sharing a login account to an application with sensitive information, in violation of the access policy. Business management indicates that the practice creates operational efficiencies. What is the information security manager’s BEST course of action?

Which of the following should be the FIRST step to gain approval for outsourcing to address a security gap?

Which of the following is MOST helpful for determining which information security policies should be implemented by an organization?

Which of the following BEST ensures timely and reliable access to services?

An organization is creating a risk mitigation plan that considers redundant power supplies to reduce the business risk associated with critical system outages. Which type of control is being considered?

Which of the following BEST enables an information security manager to determine the comprehensiveness of an organization’s information security strategy?

Which of the following is an information security manager’s BEST course of action when a threat intelligence report indicates a large number of ransomware attacks targeting the industry?

Of the following, whose input is of GREATEST importance in the development of an information security strategy?

Which risk is introduced when using only sanitized data for the testing of applications?

Which of the following is the MOST important consideration when defining a recovery strategy in a business continuity plan (BCP)?

Which of the following should be done FIRST when developing an information security program?

The BEST way to identify the risk associated with a social engineering attack is to:

Which of the following is MOST important to have in place to help ensure an organization’s cybersecurity program meets the needs of the business?

Which of the following is the GREATEST benefit of including incident classification criteria within an incident response plan?

A recovery point objective (RPO) is required in which of the following?

Which of the following provides the BEST assurance that security policies are applied across business operations?

Which of the following should an information security manager do FIRST when a mandatory security standard hinders the achievement of an identified business objective?

A business unit is not complying with a control implemented to mitigate risk because doing so impacts the ability to achieve business goals. When reporting the noncompliance to senior management, what would be the information security manager’s BEST recommendation?

Which of the following is MOST helpful for protecting an enterprise from advanced persistent threats (APTs)?

Which of the following should be the PRIMARY consideration when developing an incident response plan?

A strict new regulation is being finalized to address global concerns regarding cybersecurity. Which of the following should the information security manager do FIRST?

A post-incident review identified that user error resulted in a major breach. Which of the following is MOST important to determine during the review?

The BEST way to ensure that frequently encountered incidents are reflected in the user security awareness training program is to include:

A risk assessment exercise has identified the threat of a denial of service (DoS) attack. Executive management has decided to take no further action related to this risk. The MOST likely reason for this decision is:

Which of the following is the BEST indication of an effective information security awareness training program?

Penetration testing is MOST appropriate when a:

Which of the following will result in the MOST accurate controls assessment?

The MOST important reason for having an information security manager serve on the change management committee is to:

Of the following, who is in the BEST position to evaluate business impacts?

Which of the following should be done FIRST when establishing a new data protection program that must comply with applicable data privacy regulations?

Which of the following is the BEST approach to incident response for an organization migrating to a cloud-based solution?

Which of the following is the BEST way to help ensure an organization’s risk appetite will be considered as part of the risk treatment process?

Which of the following is MOST important to include in a post-incident review following a data breach?

An organization plans to leverage popular social network platforms to promote its products and services. Which of the following is the BEST course of action for the information security manager to support this initiative?

Which of the following BEST supports information security management in the event of organizational changes in security personnel?

Which of the following is the BEST tool to monitor the effectiveness of information security governance?

Management decisions concerning information security investments will be MOST effective when they are based on:

An organization is going through a digital transformation process, which places the IT organization in an unfamiliar risk landscape. The information security manager has been tasked with leading the IT risk management process. Which of the following should be given the HIGHEST priority?

Which of the following change management procedures is MOST likely to cause concern to the information security manager?

Which is the BEST method to evaluate the effectiveness of an alternate processing site when continuous uptime is required?

Which of the following should be the MOST important consideration when establishing information security policies for an organization?

If civil litigation is a goal for an organizational response to a security incident, the PRIMARY step should be to:

An organization’s marketing department wants to use an online collaboration service, which is not in compliance with the information security policy. A risk assessment is performed, and risk acceptance is being pursued. Approval of risk acceptance should be provided by:

In an organization with a rapidly changing environment, business management has accepted an information security risk. It is MOST important for the information security manager to ensure:

Which of the following is the BEST course of action for an information security manager to align security and business goals?

What should be the information security manager’s FIRST step when updating an information security program?

Which of the following defines the triggers within a business continuity plan (BCP)?

A cloud application used by an organization is found to have a serious vulnerability. After assessing the risk, which of the following would be the information security manager’s BEST course of action?

Which of the following is the BEST indication of a successful information security culture?

Which of the following plans should be invoked by an organization in an effort to remain operational during a disaster?

Which of the following sources is MOST useful when planning a business-aligned information security program?

Which of the following is the BEST technical defense against unauthorized access to a corporate network through social engineering?

What is the BEST way to reduce the impact of a successful ransomware attack?

Which of the following is the BEST approach for governing noncompliance with security requirements?

Which of the following is MOST important to ensuring information stored by an organization is protected appropriately?

In which cloud model does the cloud service buyer assume the MOST security responsibility?

Which of the following is the GREATEST benefit of conducting an organization-wide security awareness program?

Which of the following is the FIRST step to establishing an effective information security program?

An information security manager believes that information has been classified inappropriately, increasing the risk of a breach. Which of the following is the information security manager’s BEST action?

Which of the following BEST supports the incident management process for attacks on an organization’s supply chain?

Which of the following is MOST useful to an information security manager when conducting a post-incident review of an attack?

Which of the following is MOST important for an information security manager to verify when selecting a third-party forensics provider?

Which of the following security processes will BEST prevent the exploitation of system vulnerabilities?

Which of the following is the BEST method to protect against emerging advanced persistent threat (APT) actors?

Measuring which of the following is the MOST accurate way to determine the alignment of an information security strategy with organizational goals?

An organization recently outsourced the development of a mission-critical business application. Which of the following would be the BEST way to test for the existence of backdoors?

When remote access to confidential information is granted to a vendor for analytic purposes, which of the following is the MOST important security consideration?

When investigating an information security incident details of the incident should be shared:

The PRIMARY advantage of involving end users in continuity planning is that they:

In a business proposal, a potential vendor promotes being certified for international security standards as a measure of its security capability. Before relying on this certification, it is MOST important that the information security manager confirms that the:

Which of the following service offerings in a typical Infrastructure as a Service (IaaS) model will BEST enable a cloud service provider to assist customers when recovering from a security incident?

Which of the following roles is BEST able to influence the security culture within an organization?

Which of the following BEST indicates the effectiveness of a recent information security awareness campaign delivered across the organization?

Which of the following is the BEST evidence of alignment between corporate and information security governance?

When designing a disaster recovery plan (DRP), which of the following MUST be available in order to prioritize system restoration?

Which of the following factors has the GREATEST influence on the successful implementation of information security strategy goals?

Which of the following is the BEST approach for managing user access permissions to ensure alignment with data classification?

Which of the following is the MOST critical factor for information security program success?

Which of the following events would MOST likely require a revision to the information security program?

Which of the following is the MOST important consideration when establishing an organization’s information security governance committee?

An incident management team is alerted to a suspected security event. Before classifying the suspected event as a security incident it is MOST important for the security manager to:

Which of the following is the BEST way to ensure the capability to restore clean data after a ransomware attack?

Which of the following risk scenarios is MOST likely to emerge from a supply chain attack?

An information security manager learns through a threat intelligence service that the organization may be targeted for a major emerging threat. Which of the following is the information security manager’s FIRST course of action?

Which of the following BEST indicates that an organization has effectively tested its business continuity and disaster recovery plans within the stated recovery time objectives (RTOs)?

The MOST important attribute of a security control is that it is:

Which of the following will BEST enable an effective information asset classification process?

An information security manager has been notified about a compromised endpoint device. Which of the following is the BEST course of action to prevent further damage?

During which of the following phases should an incident response team document actions required to remove the threat that caused the incident?

A user reports a stolen personal mobile device that stores sensitive corporate data. Which of the following will BEST minimize the risk of data exposure?

An organization has acquired a company in a foreign country to gain an advantage in a new market. Which of the following is the FIRST step the information security manager should take?

An organization’s disaster recovery plan (DRP) is documented and kept at a disaster recovery site. Which of the following is the BEST way to ensure the plan can be carried out in an emergency?

Which of the following is a desired outcome of information security governance?

When designing an information security risk monitoring framework, it is MOST important to ensure:

Which of the following BEST enables staff acceptance of information security policies?

Which of the following is the BEST way to rigorously test a disaster recovery plan (DRP) for a mission-critical system without disrupting business operations?

An information security manager is concerned with continued security policy violations in a particular business unit despite recent efforts to rectify the situation. What is the BEST course of action?

Which of the following BEST facilitates an information security manager’s efforts to obtain senior management commitment for an information security program?

Which of the following is PRIMARILY determined by asset classification?

Which of the following is MOST helpful for aligning security operations with the IT governance framework?

An information security manager has been made aware of a new data protection regulation that will soon go into effect. Which of the following is the BEST way to manage the risk of noncompliance?

An information security manager learns of a new standard related to an emerging technology the organization wants to implement. Which of the following should the information security manager recommend be done FIRST?

Which of the following will provide the MOST guidance when deciding the level of protection for an information asset?

Which of the following BEST demonstrates return on investment (ROI) for an information security initiative?

Which of the following is BEST suited to provide regular reporting to the board regarding the status of compliance to a global security standard?

Which of the following would be MOST effective in gaining senior management approval of security investments in network infrastructure?

Which of the following is the MOST important reason to implement information security governance?

Which of the following is a PRIMARY objective of an information security governance framework?

Which of the following is the BEST way to reduce the risk associated with a bring your own device (BYOD) program?

An information security manager has contracted with a company to design security architecture for an application. Which of the following is accountable for identification associated with this initiative?

Which of the following desired outcomes BEST supports a decision to invest in a new security initiative?