CISM Final Assessment 2

Which of the following is an information security manager’s MOST important consideration when exploring the use of a third-party provider to handle an IT function?

Which of the following MUST be defined in order for an information security manager to evaluate the appropriateness of controls currently in place?

When an organization decides to accept a risk, it should mean the cost to mitigate:

Which of the following is the MOST important reason to conduct interviews as part of the business impact analysis (BIA) process?

Due to changes in an organization’s environment, security controls may no longer be adequate. What is the information security manager’s BEST course of action?

What is the PRIMARY benefit to an organization when information security program requirements are aligned with employment and staffing processes?

When developing an asset classification program, which of the following steps should be completed FIRST?

Which of the following is the PRIMARY reason to monitor key risk indicators (KRIs) related to information security?

Which of the following is the BEST indicator of an emerging incident?

An organization has discovered a recurring problem with unsecure code being released into production. Which of the following is the information security manager action?

When developing a categorization method for security incidents, the categories MUST:

Which of the following is MOST likely to be impacted when emerging technologies are introduced to an organization?

An organization’s main product is a customer-facing application delivered using Software as a Service (SaaS). The lead security engineer has just identified a major security vulnerability at the primary cloud provider. Within the organization, who is PRIMARILY accountable for the associated risk?

Which of the following is the MOST important criterion when deciding whether to accept residual risk?

An information security manager finds that a soon-to-be deployed online application will increase risk beyond acceptable levels, and necessary controls have not been included. Which of the following is the BEST course of action for the information security manager?

When developing a business case to justify an information security investment, which of the following would BEST enable an informed decision by senior management?

A data-hosting organization’s data center houses servers, applications, and data for a large number of geographically dispersed customers. Which of the following strategies is the BEST approach for developing a physical access control policy for the organization?

Which of the following is a PRIMARY benefit of managed security solutions?

Which of the following is an example of risk mitigation?

Which of the following BEST enables an organization to provide ongoing assurance that legal and regulatory compliance requirements can be met?

Following a successful attack, an information security manager should be confident the malware has not continued to spread at the completion of which incident response phase?

Which of the following is the BEST method to align an information security strategic plan to the corporate strategy?

Which of the following would BEST ensure that security is integrated during application development?

Which of the following is MOST important in increasing the effectiveness of incident responders?

Which of the following should be the PRIMARY objective of the information security incident response process?

An incident response team has been assembled from a group of experienced individuals. Which type of exercise would be MOST beneficial for the team at the first drill?

In violation of a policy prohibiting the use of cameras at the office, employees have been issued smartphones and tablet computers with enabled web cameras. Which of the following should be the information security manager’s FIRST course of action?

When performing a business impact analysis (BIA), who should calculate the recovery time and cost estimates?

A PRIMARY purpose of creating security policies is to:

The MAIN benefit of implementing a data loss prevention (DLP) solution is to:

Which of the following is the MOST important detail to capture in an organization’s risk register?

Which of the following is the GREATEST benefit of information asset classification?

While classifying information assets, an information security manager notices that several production databases do not have owners assigned to them. What the information security manager address this situation?

An organization’s research department plans to apply machine learning algorithms on a large data set containing customer names and purchase history. The risk leakage is considered high impact. Which of the following is the BEST risk treatment option in this situation?

IT projects have gone over budget with too many security controls being added post-production. Which of the following would MOST help to ensure that relevant to a project?

Which of the following is the BEST approach to reduce unnecessary duplication of compliance activities?

Which of the following BEST helps to ensure a risk response plan will be developed and executed in a timely manner?

An information security manager learns that IT personnel are not adhering to the information security policy because it creates process inefficiencies. What should the information security manager do FIRST?

Which of the following is MOST important to include in a report to key stakeholders regarding the effectiveness of an information security program?

An organization is increasingly using Software as a Service (SaaS) to replace in-house hosting and support of IT applications. Which of the following would be the MOST effective way to help ensure procurement decisions consider information security concerns?

Which of the following should be the KEY consideration when creating an information security communication plan with industry peers?

Which of the following is MOST effective for communicating forward-looking trends within security reporting?

An organization recently purchased data loss prevention (DLP) software but soon discovered the software fails to detect or prevent data loss.

Which of the following should the information security manager do FIRST?

Network isolation techniques are immediately implemented after a security breach to.

Which of the following incident response phases involves actions to help safeguard critical systems while maintaining business operations?

An organization has received complaints from users that some of their files have been encrypted. These users are receiving demands for money to decrypt the files. Which of the following would be the BEST course of action?

Which of the following has the GREATEST positive impact on the ability to execute a disaster recovery plan (DRP)?

Which of the following is MOST important to include in monthly information security reports to the board?

Which of the following activities is designed to handle a control failure that leads to a breach?

Which of the following is MOST important to consider when aligning a security awareness program with the organization’s business strategy?

Which of the following BEST indicates that information assets are classified accurately?

Reevaluation of risk is MOST critical when there is:

Which of the following BEST supports investments in an information security program?

Which of the following is MOST important to ensure when developing escalation procedures for an incident response plan?

Which of the following is the PRIMARY benefit of implementing a vulnerability assessment process?

An organization is implementing an information security governance framework. To communicate the program’s effectiveness to stakeholders, it is MOST important to establish:

Which of the following would be the MOST effective way to present quarterly reports to the board on the status of the information security program?

Which of the following is the BEST way to obtain support for a new organization-wide information security program?

To confirm that a third-party provider complies with an organization’s information security requirements, it is MOST important to ensure:

Which of the following BEST enables an organization to transform its culture to support information security?

An organization is close to going live with the implementation of a cloud-based application. Independent penetration test results have been received that show a high-rated vulnerability. Which of the following would be the BEST way to proceed?

Which of the following is the BEST way to achieve compliance with new global regulations related to the protection of personal information?

Which of the following should be given the HIGHEST priority during an information security post-incident review?

Which of the following is the BEST course of action when an online company discovers a network attack in progress?

Which of the following is the BEST reason for an organization to use Disaster Recovery as a Service (DRaaS)?

When properly implemented, secure transmission protocols protect transactions:

An organization is in the process of acquiring a new company. Which of the following would be the BEST approach to determine how to protect newly acquired data assets prior to integration?

The PRIMARY objective of a post-incident review of an information security incident is to:

The MOST appropriate time to conduct a disaster recovery test would be after:

Which of the following methods is the BEST way to demonstrate that an information security program provides appropriate coverage?

Which of the following is an information security manager’s MOST important course of action when responding to a major security incident that could disrupt the business?

An information security manager determines there are a significant number of exceptions to a newly released industry-required security standard. Which of the following should be done NEXT?

Which of the following BEST facilitates effective incident response testing?

Which of the following is the BEST indication of effective information security governance?

The information security manager has been notified of a new vulnerability that affects key data processing systems within the organization. Which of the following should be done FIRST?

Which of the following is the BEST way to assess the risk associated with using a Software as a Service (SaaS) vendor?

Security administration efforts will be greatly reduced following the deployment of which of the following techniques?

Which of the following would be the BEST way for an information security manager to improve the effectiveness of an organization’s information security program?

Which of the following should an information security manager do FIRST upon learning of noncompliance with an impending information security regulatory change?

Which of the following is MOST critical when creating an incident response plan?

Which of the following would BEST help to ensure appropriate security controls are built into software?

Which of the following will BEST facilitate the integration of information security governance into enterprise governance?

Which of the following should an information security manager do FIRST when noncompliance with security standards is identified?

Which of the following should be considered FIRST when recovering a compromised system that needs a complete rebuild?

When deciding to move to a cloud-based model, the FIRST consideration should be:

Which of the following is the PRIMARY objective of incident triage?

Who is accountable for ensuring risk mitigation is effective?

Which of the following BEST enables an information security manager to obtain organizational support for the implementation of security controls?

To support effective risk decision making, which of the following is MOST important to have in place?

Which of the following parties should be responsible for determining access levels to an application that processes client information?

What should be an information security manager’s MOST important consideration when developing a multi-year plan?

When performing a business impact analysis (BIA), who should be responsible for determining the initial recovery time objective (RTO)?

Which of the following will ensure confidentiality of content when accessing an email system over the Internet?

Who is BEST suited to determine how the information in a database should be classified?

Which of the following is an incident containment method?

A CISO learns that a third-party service provider did not notify the organization of a data breach that affected the service provider’s data center. Which of the following should the CISO do FIRST?

Which of the following is MOST important to include in an incident response plan to ensure incidents are responded to by the appropriate individuals?

Which of the following is the PRIMARY role of an information security manager in a software development project?

Which of the following MOST effectively identifies issues related to noncompliance with legal, regulatory, and contractual requirements?

Which of the following is MOST helpful for fostering an effective information security culture?

Which of the following is MOST important to convey to employees in building a security risk-aware culture?

Which of the following is the PRIMARY objective of integrating information security governance into corporate governance?

Which of the following is an information security manager’s MOST important action to mitigate the risk associated with malicious software?

Which of the following is the PRIMARY reason for granting a security exception?

Which of the following is MOST effective in preventing the introduction of vulnerabilities that may disrupt the availability of a critical business application?

An organization is planning to outsource the execution of its disaster recovery activities. Which of the following would be MOST important to include in the outsourcing agreement?

Which type of plan is PRIMARILY intended to reduce the potential impact of security events that may occur?

Which of the following is the MOST important outcome of strategic alignment of corporate and information security governance?

Which of the following is MOST important to have in place as a basis for developing an effective information security program that supports the organization’s business goals?

Which of the following BEST enables the integration of information security governance into corporate governance?

Which of the following contributes MOST to the effectiveness of information security governance?

Which of the following is the BEST approach for addressing noncompliance with security standards?

Which of the following is the BEST method for managing information security compliance of third-party suppliers?

An organization is in the process of creating an agreement with a cloud provider. Who should determine the third party’s destruction schedule for the organization’s information?

Which of the following is the BEST course of action when an organization’s incident response team does not have expertise in forensic analysis?

What should be the FIRST step when investigating an employee suspected of inappropriately downloading proprietary information?

Which of the following is MOST critical to ensure that information security incidents are managed properly?

The GREATEST challenge when attempting data recovery of a specific file during forensic analysis is when:

Which of the following is MOST helpful in determining the criticality of an organization’s business functions?

The contribution of recovery point objective (RPO) to disaster recovery is to:

An information security manager is MOST likely to obtain approval for a new security project when the business case provides evidence of:

Which of the following should be established FIRST when implementing an Information security governance framework?

An information security team is planning a security assessment of an existing vendor. Which of the following approaches is MOST helpful for properly scoping the assessment?

A third-party audit of an organization’s network security has identified several critical risks. Which of the following should the information security manager do NEXT?

Which of the following provides the BEST evidence that a recently established information security program is effective?

An investigation of a recent security incident determined that the root cause was negligent handling of incident alerts by system administrators. What is the BEST way for the information security manager to address this issue?

An organization is the victim or a targeted attack and is unaware of the compromise until a security analyst notices an additional user account on the firewall. The implementation of which of the following would have detected the incident?

Of the following, who is accountable for data loss in the event of an information security incident at a third-party provider?

Which of the following BEST minimizes information security risk in deploying applications to the production environment?

Which of the following would BEST guide the development and maintenance of an information security program?

Which of the following BEST indicates effective information security governance?

The MOST useful technique for maintaining management support for the information security program is:

When remote access is granted to a company’s internal network, the MOST important consideration should be that access is provided:

Which of the following should be triggered FIRST when unknown malware has infected an organization’s critical system?

Which of the following is the FIRST step in developing a business impact analysis (BIA)?

Which of the following is MOST important when defining how an information security budget should be allocated?

A forensic examination of a PC is required, but the PC has been switched off. Which of the following should be done FIRST?

Which of the following should an organization do FIRST when confronted with the transfer of personal data across borders?

Which of the following BEST enables an organization to measure the total time that operations can be sustained at an alternative site designated in the business continuity plan (BCP)?

Which of the following has the GREATEST influence on the successful integration of information security within the business?

Which of the following is the MOST important consideration to support potential legal action when responding to a security incident?

An incident response team has established that an application has been breached. Which of the following should be done NEXT?

A daily monitoring report reveals that an IT employee made a change to a firewall rule outside of the change control process. The information security manager’s FIRST step in addressing the issue should be to:

Which of the following BEST facilitates the reporting of useful information about the effectiveness of the information security program?

Which of the following BEST mitigates the risk or information loss caused by a cloud service provider becoming insolvent?

An information security team has been tasked with identifying confidential data within the organization to formalize its asset classification scheme. The MOST relevant input would be provided by:

Which of the following is the PRIMARY reason to conduct a post-incident review?

Which of the following is the BEST way to protect against unauthorized access to an encrypted file sent via email?

The PRIMARY purpose of implementing information security governance metrics is to:

Which of the following roles is PRIMARILY responsible for developing an information classification framework based on business needs?