Which of the following should an information security manager do FIRST upon confirming a privileged user's unauthorized modifications to a security application?

Enforce the security configuration and require the change to be reverted.

Report the risk associated with the policy breach.

Enforce the security configuration and require the change to be reverted.

Implement compensating controls to address the risk.

Implement a privileged access management system.

Which of the following is the MOST important outcome of effective risk treatment?

Implementation of corrective actions

Reduced cost of acquiring controls

Implementation of corrective actions

Which of the following tools provides an incident response team with the GREATEST insight into insider threat activity across multiple systems?

A security information and event management (SIEM) system

An intrusion prevention system (IPS)

A virtual private network (VPN) with multi-factor authentication (MFA)

An identity and access management (IAM) system

Which of the following would BEST mitigate accidental data loss events?

Conduct periodic user awareness training.

Obtain senior management support for the information security strategy.

Conduct a data loss prevention (DLP) audit.

Enforce a data hard drive encryption policy.

Which of the following should be the GREATEST consideration when determining the recovery time objective (RTO) for an in-house critical application, database, or server?

Determination of recovery point objective (RPO)

Direction from senior management

Which of the following is the BEST way to ensure the business continuity plan (BCP) is current?

Manage business process changes.

Update business impact analyses (BIAs) on a regular basis.

Review and update emergency contact lists.

An organization's information security manager reads on social media that a recently purchased vendor product has been compromised and customer data has been posted online. What should the information security manager do FIRST?

Validate the risk to the organization.

Perform a business impact analysis (BIA).

Notify local law enforcement agencies of a breach.

Activate the incident response program.

Validate the risk to the organization.

When integrating security risk management into an organization it is MOST important to ensure:

business units approve the risk management methodology.

the risk treatment process is defined.

information security policies are documented and understood.

the risk management methodology follows an established framework.

What is the PRIMARY objective of implementing standard security configurations?

Control vulnerabilities and reduce threats from changed configurations.

Maintain a flexible approach to mitigate potential risk to unsupported systems.

Minimize the operational burden of managing and monitoring unsupported systems.

Control vulnerabilities and reduce threats from changed configurations.

Compare configurations between supported and unsupported systems.

An organization has identified a large volume of old data that appears to be unused. Which of the following should the information security manager do NEXT?

Consult the record retention policy.

Update the awareness and training program.

Implement media sanitization procedures.

Consult the backup and recovery policy.

Which of the following BEST indicates the effectiveness of the vendor risk management process?

Increase in the percentage of vendors certified to a globally recognized security standard

Increase in the percentage of vendors with a completed due diligence review

Increase in the percentage of vendors conducting mandatory security training

Increase in the percentage of vendors that have reported security breaches

To effectively manage an organization's information security risk, it is MOST important to:

establish and communicate risk tolerance.

assign risk management responsibility to an experienced consultant.

periodically identify and correct new systems vulnerabilities.

establish and communicate risk tolerance.

benchmark risk scenarios against peer organizations.

In order to gain organization-wide support for an information security program, which of the following is MOST important to consider?

Maturity of the security policy

Clarity of security roles and responsibilities

Which of the following would be MOST helpful when creating information security policies?

The information security framework

What should be the GREATEST concern for an information security manager of a large multinational organization when outsourcing data processing to a cloud service provider?

Vendor service level agreements (SLAs)

Independent review of the vendor

Which of the following is the MOST important outcome of a post-incident review?

The root cause of the incident is determined.

The impact of the incident is reported to senior management.

The system affected by the incident is restored to its prior state.

The person responsible for the incident is identified.

The root cause of the incident is determined.

When establishing metrics for an information security program, the BEST approach is to identify indicators that:

demonstrate the effectiveness of the security program.

reduce information security program spending.

support major information security initiatives.

reflect the corporate risk culture.

demonstrate the effectiveness of the security program.

Which of the following eradication methods is MOST appropriate when responding to an incident resulting in malware on an application server?

Restore the system from a known good backup.

Disconnect the system from the network.

Change passwords on the compromised system.

Restore the system from a known good backup.

Perform operation system hardening.

An organization uses a security standard that has undergone a major revision by the certifying authority. The old version of the standard will no longer be used for organizations wishing to maintain their certifications. Which of the following should be the FIRSTcourse of action?

Review the new standard for applicability to the business.

Evaluate the cost of maintaining the certification.

Review the new standard for applicability to the business.

Modify policies to ensure new requirements are covered.

Communicate the new standard to senior leadership.

Which of the following is the MOST important reason for an organization to communicate to affected parties that a security incident has occurred?

To comply with regulations regarding notification

To improve awareness of information security

To disclose the root cause of the incident

To increase goodwill toward the organization

To comply with regulations regarding notification

Within the confidentiality, integrity, and availability (CIA) triad, which of the following activities BEST supports the concept of confidentiality?

Ensuring encryption for data in transit

Ensuring hashing of administrator credentials

Enforcing service level agreements (SLAs)

Ensuring encryption for data in transit

Utilizing a formal change management process

Following a breach where the risk has been isolated and forensic processes have been performed, which of the following should be done NEXT?

Rebuild the server from the last verified backup.

Place the web server in quarantine.

Rebuild the server from the last verified backup.

Shut down the server in an organized manner.

Rebuild the server with relevant patches from the original media.

An organization is about to purchase a rival organization. The PRIMARY reason for performing information security due diligence prior to making the purchase is to:

determine the security exposures.

assess the ability to integrate the security department operations.

ensure compliance with international standards.

evaluate the security policy and standards.

Which of the following BEST demonstrates that an anti-phishing campaign is effective?

Decreased number of incidents that have occurred

Improved staff attendance in awareness sessions

Decreased number of phishing emails received

Improved feedback on the anti-phishing campaign

Decreased number of incidents that have occurred

An organization that conducts business globally is planning to utilize a third-party service provider to process payroll information. Which of the following issues poses the GREATEST risk to the organization?

The third party has not provided evidence of compliance with local regulations where data is generated.

The third party does not have an independent assessment of controls available for review.

The third party has not provided evidence of compliance with local regulations where data is generated.

The third-party contract does not include an indemnity clause for compensation in the event of a breach.

The third party's service level agreement (SLA) does not include guarantees of uptime.

Capacity planning would prevent:

application failures arising from insufficient hardware resources.

file system overload arising from distributed denial of service (DDoS) attacks.

system downtime for scheduled security maintenance.

application failures arising from insufficient hardware resources.

software failures arising from exploitation of buffer capacity vulnerabilities.

Which of the following is the BEST indication of a mature information security program?

Security resources are optimized.

Security incidents are managed properly.

Security spending is below budget.

Security resources are optimized.

Security audit findings are reduced.

Which of the following is the PRIMARY benefit of implementing an information security governance framework?

The framework provides direction to meet business goals while balancing risks and controls.

The framework defines managerial responsibilities for risk impacts to business goals.

The framework provides direction to meet business goals while balancing risks and controls.

The framework provides a roadmap to maximize revenue through the secure use of technology.

The framework is able to confirm the validity of business goals and strategies.

Which of the following is MOST important for guiding the development and management of a comprehensive information security program?

Establishing and maintaining an information security governance framework

Adopting information security program management best practices

Implementing policies and procedures to address the information security strategy

Aligning the organization's business objectives with IT objectives

Establishing and maintaining an information security governance framework

Isaca CISM Practice Test 13 - Free Online Exam Prep & Questions

Which of the following should be the PRIMARY focus of a lessons learned exercise following a successful response to a cybersecurity incident?

Become a Premium Member for full access

Unlock Premium Member

Isaca CISM Practice Test 13

Question

Isaca CISM Practice Tests

Practice Tests