An information security manager is working to incorporate media communication procedures into the security incident communication plan. It would be MOST important to include:

a single point of contact within the organization

a directory of approved local media contacts

procedures to contact law enforcement

a single point of contact within the organization

Which of the following is the PRIMARY benefit of an information security awareness training program?

Evaluating organizational security culture

Which of the following is a viable containment strategy for a distributed denial of service (DDoS) attack?

Redirect the attacker's traffic

Block IP addresses used by the attacker

Redirect the attacker's traffic

Disable firewall ports exploited by the attacker.

Which of the following is the BEST way to determine if an information security profile is aligned with business requirements?

Review security-related key risk indicators (KRIs)

Review the key performance indicator (KPI) dashboard

Review security-related key risk indicators (KRIs)

Review control self-assessment (CSA) results

Review periodic security audits

Which of the following is the GREATEST challenge with assessing emerging risk in an organization?

Incomplete identification of threats

Presence of known vulnerabilities

Incomplete identification of threats

Which of the following would BEST enable a new information security manager to obtain senior management support for an information security governance program?

Demonstrating the program's value to the organization

Discussing governance programs found in similar organizations

Providing the results of external audits

Providing examples of information security incidents within the organization

An organization has introduced a new bring your own device (BYOD) program. The security manager has determined that a small number of employees are utilizing free cloud storage services to store company data through their mobile devices. Which of the following is the MOST effective course of action?

Assess the business need to provide a secure solution

Allow the practice to continue temporarily for monitoring purposes.

Disable the employees' remote access to company email and data

Initiate remote wipe of the devices

Assess the business need to provide a secure solution

An employee of an organization has reported losing a smartphone that contains sensitive information The BEST step to address this situation is to:

disable the user's access to corporate resources.

terminate the device connectivity.

escalate to the user's management

Which of the following should an information security manager do FIRST after learning through mass media of a data breach at the organization's hosted payroll service provider?

Validate the breach with the provider

Suspend the data exchange with the provider

Notify appropriate regulatory authorities of the breach.

Initiate the business continuity plan (BCP)

Validate the breach with the provider

An incident response team has established that an application has been breached. Which of the following should be done NEXT?

Isolate the impacted systems from the rest of the network

Maintain the affected systems in a forensically acceptable state

Conduct a risk assessment on the affected application

Inform senior management of the breach.

Isolate the impacted systems from the rest of the network

When preventive controls to appropriately mitigate risk are not feasible, which of the following is the MOST important action for the information security manager?

Identifying unacceptable risk levels

When assigning a risk owner, the MOST important consideration is to ensure the owner has:

decision-making authority and the ability to allocate resources for risk.

adequate knowledge of risk treatment and related control activities.

decision-making authority and the ability to allocate resources for risk.

sufficient time for monitoring and managing the risk effectively.

risk communication and reporting skills to enable decision-making.

The MOST useful technique for maintaining management support for the information security program is:

identifying the risks and consequences of failure to comply with standards.

informing management about the security of business operations.

implementing a comprehensive security awareness and training program.

identifying the risks and consequences of failure to comply with standards.

benchmarking the security programs of comparable organizations.

After a ransomware incident an organization's systems were restored. Which of the following should be of MOST concern to the information security manager?

The root cause was not identified.

The service level agreement (SLA) was not met.

The recovery time objective (RTO) was not met.

The root cause was not identified.

Notification to stakeholders was delayed.

Management of a financial institution accepted an operational risk that consequently led to the temporary deactivation to a critical monitoring process. Which of the following should be the information security manager's GREATEST concern with this situation?

Inability to determine short-term impact.

Deviation from risk management best practices

To improve the efficiency of the development of a new software application, security requirements should be defined:

concurrently with other requirements.

based on available security assessment tools.

concurrently with other requirements.

Which of the following is the PRIMARY role of the information security manager in application development?

To ensure security is integrated into the system development life cycle (SDLC)

To ensure compliance with industry best practice

To ensure enterprise security controls are implemented

To ensure control procedures address business risk

Which of the following should be an information security manager s MOST important consideration when determining the priority for implementing security controls?

Results of business impact analyses (BIAs)

Alignment with industry benchmarks

Results of business impact analyses (BIAs)

Possibility of reputational loss due to incidents

Availability of security budget

Which of the following BEST minimizes information security risk in deploying applications to the production environment?

Integrating security controls in each phase of the life cycle

Conducting penetration testing post implementation

Having a well-defined change process

Verifying security during the testing process

Which of the following is the BEST way to determine the effectiveness of an incident response plan?

Reviewing previous audit reports

Benchmarking the plan against best practices

The PRIMARY goal to a post-incident review should be to:

determine how to improve the incident handling process.

identify policy changes to prevent a recurrence.

determine how to improve the incident handling process.

establish the cost of the incident to the business.

determine why the incident occurred.

A security incident has been reported within an organization When should an information security manager contact the information owner?

After the incident has been confirmed.

After the incident has been mitigated

After the incident has been confirmed.

After the potential incident has been togged

After the incident has been contained

Which of the following is the BEST way to contain an SQL injection attack that has been detected by a web application firewall?

Reconfigure the web application firewall to block the attack.

Force password changes on the SQL database.

Reconfigure the web application firewall to block the attack.

Update the detection patterns on the web application firewall.

Block the IPs from where the attack originates.

Which of the following should an information security manager do FIRST after discovering that a business unit has implemented a newly purchased application and bypassed the change management process?

Discuss the issue with senior leadership.

Revise the procurement process.

Update the change management process.

Discuss the issue with senior leadership.

Remove the application from production.

The effectiveness of an incident response team will be GREATEST when:

the incident response process is updated based on lessons learned.

the incident response team meets on a regular basis to review log files.

the incident response team members are trained security personnel.

the incident response process is updated based on lessons learned.

incidents are identified using a security information and event monitoring {SIEM) system.

Which of the following has the GREATEST impact on efforts to improve an organization's security posture?

Supportive tone at the top regarding security

Regular reporting to senior management

Supportive tone at the top regarding security

Automation of security controls

Well-documented security policies and procedures

Which of the following is the MOST effective way to detect security incidents?

Analyze recent security risk assessments.

Analyze penetration test results.

Analyze vulnerability assessments.

Which of the following will BEST enable an effective information asset classification process?

Including security requirements in the classification process

Reviewing the recovery time objective (RTO) requirements of the asset

Application data integrity risk is MOST directly addressed by a design that includes:

reconciliation routines such as checksums, hash totals, and record counts.

strict application of an authorized data dictionary.

application log requirements such as field-level audit trails and user activity logs.

access control technologies such as role-based entitlements.

When drafting the corporate privacy statement for a public website, which of the following MUST be included?

Explanation of information usage

Information encryption requirements

Which of the following BEST enables an organization to maintain an appropriate security control environment?

Alignment to an industry security framework

Periodic employee security training

Monitoring of the threat landscape

Isaca CISM Practice Test 11 - Free Online Exam Prep & Questions

Which of the following is MOST important when defining how an information security budget should be allocated?

Become a Premium Member for full access

Unlock Premium Member

Isaca CISM Practice Test 11

Question

Isaca CISM Practice Tests

Practice Tests