CISM Final Assessment 3

Which of the following should be done FIRST when developing an information security strategy?

A business impact analysis (BIA) should be periodically executed PRIMARILY to:

While responding to a high-profile security incident, an information security manager observed several deficiencies in the current incident response plan. When would be the BEST time to update the plan?

Which of the following BEST enables an information security manager to demonstrate the effectiveness of the information security and risk program to senior management?

Which of the following would BEST justify spending for a compensating control?

Which or the following is the BEST way to monitor for advanced persistent threats (APT) in an organization?

In response to recent ransomware threats, an organization deployed a new endpoint detection and response (EDR) solution in its employee laptops. Of the following, who should be accountable for reviewing the solution to verify it has been properly deployed and configured?

An organization’s quality process can BEST support security management by providing:

Which of the following is the MOST important consideration when defining an information security framework?

Which of the following is the MOST important consideration for reporting risk assessment results to senior management?

Which of the following is the BEST way to determine the effectiveness of an incident response plan?

Which of the following should be an information security manager’s MOST important consideration when determining the priority for implementing security controls?

Which of the following is the PRIMARY reason for an information security manager to periodically review existing controls?

Which of the following should be done FIRST when implementing a security program?

Of the following, who is MOST appropriate to own the risk associated with the failure of a privileged access control?

Which of the following is an example of a deterrent control?

An information security manager has completed a risk assessment and has determined the residual risk. Which of the following should be the NEXT step?

Which of the following BEST enables an organization to maintain an appropriate security control environment?

Which of the following is MOST important for responding effectively to security breaches?

Which of the following is the BEST method for assisting with incident containment in an Infrastructure as a Service (IaaS) cloud environment?

Which of the following should be performed FIRST in response to a new information security regulation?

To ensure the information security of outsourced IT services, which of the following is the MOST critical due diligence activity?

Which of the following is the MOST important reason to consider organizational culture when developing an information security program?

Which of the following processes BEST supports the evaluation of incident response effectiveness?

Which of the following should an information security manager do FIRST after learning through mass media of a data breach at the organization’s hosted payroll service provider?

Which of the following should an information security manager do FIRST after discovering that a business unit has implemented a newly purchased application and bypassed the change management process?

An organization is strategizing on how to improve security awareness. Which of the following is MOST important to consider when developing this strategy?

A penetration test against an organization’s external web application shows several vulnerabilities. Which of the following presents the GREATEST concern?

Which of the following is the GREATEST concern resulting from the lack of severity criteria in incident classification?

Which of the following would be the BEST way to maintain organization-wide support for an information security strategy?

Several critical systems have been compromised with malware. Which of the following is the BEST strategy to eradicate this incident?

Which of the following is the MOST important success factor for maintaining an organizational security-aware culture?

Senior management has expressed concern that the organization’s intrusion prevention system (IPS) may repeatedly disrupt business operations. Which of the following BEST indicates that the information security manager has tuned the system to address this concern?

Which of the following metrics would BEST monitor how well information security requirements are incorporated into the change management process?

Which of the following metrics is MOST appropriate for evaluating the incident notification process?

Meeting which of the following security objectives BEST ensures that information is protected against unauthorized disclosure?

Which of the following is MOST important for an information security manager to consider when developing a business continuity plan (BCP) for ransomware attacks?

Of the following, who should be assigned as the owner of a newly identified risk related to an organization’s new payroll system?

An organization has decided to outsource IT operations. Which of the following should be the PRIMARY focus of the information security manager?

Which of the following is MOST effective in gaining support for the information security strategy from senior management?

Management of a financial institution accepted an operational risk that consequently led to the temporary deactivation of a critical monitoring process. Which of the following should be the information security manager’s GREATEST concern with this situation?

An employee’s bring your own device (BYOD) smartphone has been lost. To reduce the risk associated with the loss of corporate sensitive data stored on the phone, the information security manager’s BEST course of action should have been to implement:

Which of the following is the BEST approach for an information security manager to develop an organization’s information security strategy?

Which of the following is the BEST way to monitor the effectiveness of security controls?

An organization experienced a data breach that affected many of its clients. Legal counsel found out about this event only after a press release was issued. Which of the following would have been MOST helpful in preventing this situation?

Which of the following would MOST effectively ensure that a new server is appropriately secured?

Spoofing should be prevented because it may be used to:

Which of the following is MOST important to have in place for an organization’s information security program to be effective?

When assigning a risk owner, the MOST important consideration is to ensure the owner has:

After a ransomware incident, an organization’s systems were restored. Which of the following should be of MOST concern to the information security manager?

To improve the efficiency of the development of a new software application, security requirements should be defined:

Which of the following would provide the MOST effective security outcome in an organization’s contract management process?

Which of the following is the BEST way to contain an SQL injection attack that has been detected by a web application firewall?

Who is accountable for approving an information security governance framework?

Which of the following is the PRIMARY benefit achieved when an information security governance framework is aligned with corporate governance?

Which of the following is the BEST method to protect the confidentiality of data transmitted over the Internet?

Which of the following is the FIRST step when conducting a post-incident review?

Which of the following BEST facilitates the effectiveness of cybersecurity incident response?

A business requires a legacy version of an application to operate, but the application cannot be patched. To limit the risk exposure to the business, a firewall is implemented in front of the legacy application. Which risk treatment option has been applied?

An information security manager has recently been notified of potential security risks associated with a third-party service provider. What should be done NEXT to address this concern?

An email digital signature will:

An information security manager learns that business unit leaders are encouraging increased use of social media platforms to reach customers. Which of the following should be done FIRST to help mitigate the risk of confidential information being disclosed by employees on social media?

Which of the following BEST facilitates effective strategic alignment of security initiatives?

Which of the following is MOST important to maintain integration among the incident response plan, business continuity plan (BCP), and disaster recovery plan (DRP)?

An information security program is BEST positioned for success when it is closely aligned with:

Which of the following should an information security manager do FIRST after identifying suspicious activity on a PC that is not in the organization’s IT asset inventory?

Which of the following is the MOST important consideration when briefing executives about the current state of the information security program?

An organization has multiple data repositories across different departments. The information security manager has been tasked with creating an enterprise strategy for protecting data. Which of the following information security initiatives should be the HIGHEST priority for the organization?

Which of the following is ESSENTIAL to ensuring effective incident response?

Which of the following is the BEST indicator of an organization’s information security status?

Which of the following practices is MOST effective for determining the adequacy of incident management operations?

Which of the following MUST happen immediately following the identification of a malware incident?

Which of the following is MOST effective in monitoring an organization’s existing risk?

Which of the following BEST indicates that information security governance and corporate governance are integrated?

Which of the following should be the PRIMARY basis for determining the value of assets?

Which of the following is MOST helpful to identify whether information security policies have been followed?

Which of the following is the MOST important reason to classify an incident after detection?

Which of the following principles BEST addresses the protection of data from unauthorized modification?

The MAIN reason for continuous monitoring of the security program is to:

Which of the following would BEST enable the help desk to recognize an information security incident?

Which of the following would be the GREATEST concern with the implementation of key risk indicators (KRIs)?

When an organization lacks internal expertise to conduct highly technical forensics investigations, what is the BEST way to ensure effective and timely investigations following an information security incident?

Which of the following is MOST important for the effective implementation of an information security governance program?

Which of the following is the BEST way to maintain ongoing senior management support for the implementation of a security monitoring toot?

Which of the following would BEST support a business case to implement an anti-ransomware solution?

When responding to an incident involving malware on a server, which of the following should be done FIRST?

Which of the following BEST reduces the likelihood of leakage of private information via email?

Which of the following BEST determines the data retention strategy and subsequent policy for an organization?

Which of the following MUST be established to maintain an effective information security governance framework?

Which of the following is the BEST defense-in-depth implementation for protecting high value assets or for handling environments that have trust concerns?

When responding to a security incident, information security management and the affected business unit management cannot agree whether to escalate the incident to senior management. Which of the following would MOST effectively prevent this situation from recurring?

Which of the following should be done FIRST to ensure information security is integrated in system development projects?

For which of the following is it MOST important that system administrators be restricted to read-only access?

Which of the following business units should own the data that populates an identity management system?

Which of the following BEST indicates senior management support for an information security program?

When selecting metrics to monitor the effectiveness of an information security program, it is MOST important for an information security manager to:

A business continuity plan (BCP) should contain:

A finance department director has decided to outsource the organization’s budget application and has identified potential providers. Which of the following actions should be initiated FIRST by the information security manager?

What type of control is being implemented when a security information and event management (SIEM) system is installed?

Which of the following should be done FIRST when developing an information asset classification policy?

Which of the following is the BEST option to lower the cost to implement application security controls?

Which of the following is the GREATEST benefit of effective information security governance?

The ability to integrate information security governance into corporate governance is PRIMARILY driven by:

Which of the following presents the GREATEST challenge for protecting Internet of Things (IoT) devices?

Which of the following parameters is MOST helpful when designing a disaster recovery strategy?

An IT service desk was not adequately prepared for a recent ransomware attack on user workstations. Which of the following should be given HIGHEST priority by the information security team when creating an action plan to improve service desk readiness?

After a risk has been identified, analyzed, and evaluated, which of the following should be done NEXT?

Which of the following will BEST facilitate timely and effective incident response?

Which of the following MOST effectively communicates the current risk profile to senior management after controls are applied?

Which of the following processes should be done NEXT after completing a business impact analysis (BIA)?

Which of the following is MOST important to include in an information security policy?

Which of the following should an information security manager do FIRST when creating an organization’s disaster recovery plan (DRP)?

Which of the following would be the MOST effective use of findings from a post-incident review?

During a post-incident review, it was determined that a known vulnerability was exploited in order to gain access to a system. The vulnerability was patched as part of the remediation on the offending system. Which of the following should be done NEXT?

Which of the following is MOST helpful in determining the realization of benefits from an information security program?

During an internal compliance review, the review team discovers that a critical legacy application is unable to meet the organization’s mandatory security requirements. Which of the following should be done FIRST?

Which of the following is the BEST way to improve an organization’s ability to detect and respond to incidents?

Of the following, who would provide the MOST relevant input when aligning the information security strategy with organizational goals?

Which of the following is the PRIMARY role of the information security manager in application development?

Which of the following actions by senior management would BEST enable a successful implementation of an information security governance framework?

Which of the following is the BEST way to reduce the risk of security incidents from targeted email attacks?

Which of the following is the PRIMARY benefit of an information security awareness training program?

Which of the following MOST effectively supports an organization’s security culture?

A new type of ransomware has infected an organization’s network. Which of the following would have BEST enabled the organization to detect this situation?

Which of the following should an information security manager do FIRST upon notification of a potential security risk associated with a third-party service provider?

A security incident has been reported within an organization. When should an information security manager contact the information owner?

An incident management team leader sends out a notification that the organization has successfully recovered from a cyberattack. Which of the following should be done NEXT?

Which of the following defines the MOST comprehensive set of security requirements for a newly developed information system?

Which of the following information security practices would BEST prevent a SQL injection attack?

Which of the following is a viable containment strategy for a distributed denial of service (DDoS) attack?

A data discovery project uncovers an unclassified process document. Of the following, who is BEST suited to determine the classification?

Which of the following is MOST important to include in a post-incident report?

When creating an incident response plan, the triggers for the business continuity plan (BCP) MUST be based on:

An organization’s information security strategy should be the PRIMARY input to which of the following?

Which of the following BEST enables an organization to enhance its incident response plan processes and procedures?

Which of the following is BEST used to determine the maturity of an information security program?

Which of the following should be done FIRST when developing an information security strategy that is aligned with organizational goals?

A business impact analysis (BIA) BEST enables an organization to establish:

Which of the following is the PRIMARY objective of developing an information security program that aligns with the information security strategy?

Which of the following is MOST important to include in an information security framework?

An organization learns that a service provider experienced a breach last month and did not notify the organization. Which of the following should be the information security manager’s FIRST course of action?

Which of the following approaches to communication with senior management BEST enables an information security manager to maximize the effectiveness of the information security program?

Which of the following control types should be considered FIRST for aligning employee behavior with an organization’s information security objectives?

An organization’s information security team presented the risk register at a recent information security steering committee meeting. Which of the following should be of MOST concern to the committee?

Which of the following BEST enables an organization to determine what activities and changes have occurred on a system during a cybersecurity incident?

Which of the following should the information security manager do FIRST upon learning that a business department wants to use blockchain technology for a new payment process?

Which of the following BEST facilitates the development of information security procedures that effectively support the information security policy?

Which of the following would provide the BEST input to a business case for a technical solution to address potential system vulnerabilities?

Which of the following is MOST helpful for determining priorities when creating a long-term information security roadmap?

A KEY consideration in the use of quantitative risk analysis is that it: