The PRIMARY objective of timely declaration of a disaster is to:

ensure the continuity of the organization's essential services.

protect critical physical assets from further loss.

assess and correct disaster recovery process deficiencies.

ensure engagement of business management in the recovery process.

Which of the following control types should be considered FIRST for aligning employee behavior with an organization's information security objectives?

Administrative security controls

A small organization has a contract with a multinational cloud computing vendor. Which of the following would present the GREATEST concern to an information security manager if omitted from the contract?

Authority of the subscriber to approve access to its data

Right of the subscriber to conduct onsite audits of the vendor

Commingling of subscribers' data on the same physical server

Escrow of software code with conditions for code release

Which of the following is the BEST course of action when an information security manager identifies that systems are vulnerable to emerging threats?

Frequently update systems and monitor the threat landscape.

Monitor the network containing the affected systems for malicious traffic.

Increase awareness of the threats among employees who work with the systems.

Notify senior management and key stakeholders of the threats.

The categorization of incidents is MOST important for evaluating which of the following?

Risk severity and incident priority

Appropriate communication channels

Risk severity and incident priority

Response and containment requirements

The ULTIMATE responsibility for ensuring the objectives of an information security framework are being met belongs to:

the information security officer.

Which of the following is a PRIMARY responsibility of the information security goxernance function?

Defining security strategies to support organizational programs

Administering information security awareness training

Defining security strategies to support organizational programs

Ensuring adequate support for solutions using emerging technologies

Advising senior management on optimal levels of risk appetite and tolerance

Which of the following is MOST important to include in security incident escalation procedures?

Key objectives of the security program

Which of the following should have the MOST influence on an organization's response to a new industry regulation?

The organization's risk appetite

The organization's control objectives

The organization's risk management framework

The organization's risk appetite

The organization's risk control baselines

An organization is considering using a third party to host sensitive archived data. Which of the following is MOST important to verify before entering into the relationship?

The vendor's controls are in line with the organization's security standards.

The vendor's data centers are in the same geographic region.

The encryption keys are not provisled to the vendor.

The vendor's controls are in line with the organization's security standards.

Independent audits of the vendor's operations are regularly conducted.

Which of the following BEST indicates that an information security governance framework has been successfully implemented?

The framework aligns internal and external resources.

The framework aligns security processes with industry best practices.

The framework aligns management and other functions within the security organization.

The framework includes commercial off-the-shelf security solutions.

What is the MOST important consideration when establishing metrics for reporting to the information security strategy committee?

Aligning the metrics with the organizational culture

Developing a dashboard for communicating the metrics

Agreeing on baseline values for the metrics

Benchmarking the expected value of the metrics against industry standards

Aligning the metrics with the organizational culture

An organization is performing due diligence when selecting a third party. Which of the following is MOST helpful to reduce the risk of unauthorized sharing of information during this process?

Establishing mutual non-disclosure agreements (NDAs)

Using secure communication channels

Establishing mutual non-disclosure agreements (NDAs)

Requiring third-party privacy policies

Which of the following is MOST important to complete during the recovery phase of an incident response process before bringing affected systems back online?

Test and verify that compromisedsystems are clean.

Record and close security incident tickets.

Test and verify that compromisedsystems are clean.

Document recovery steps for senior management reporting.

Capture and preserve forensic images of affected systems.

An information security manager has been asked to provide both one-year and five-year plans for the information security program. What is the PRIMARY purpose for the long-term plan?

To ensure controls align with security needs

To facilitate the continuous improvement of the IT organization

To ensure controls align with security needs

To create and document required IT capabilities

To prioritize security risks on a longer scale than the one-year plan

Which of the following is MOST important for the improvement of a business continuity plan (BCP)?

Implementing an IT resilience solution

Implementing management reviews

Documenting critical business processes

Which of the following is the BEST way to help ensure alignment of the information security program with organizational objectives?

Establish an information security steering committee.

Employ a process-based approach for information asset classification.

Utilize an industry-recognized risk management framework.

Provide security awareness training to board executives.

When establishing an information security governance framework, it is MOST important for an information security manager to understand:

information security best practices.

An enterprise has decided to procure security services from a third-party vendor to support its information security program. Which of the following is MOST important to include in the vendor selection criteria?

Alignment of the vendor's business objectives with enterprise security goals

Feedback from the vendor's previous clients

Alignment of the vendor's business objectives with enterprise security goals

The maturity of the vendor's internal control environment

Penetration testing against the vendor's network

Which of the following BEST indicates the organizational benefit of an information security solution?

Costs and benefits of the solution calculated over time

Cost savings the solution brings to the information security department

Reduced security training requirements

Alignment to security threats and risks

Costs and benefits of the solution calculated over time

Which of the following is the MOST important consideration when developing key performance indicators (KPIs) for the information security program?

Alignment with business initiatives

Alignment with financial reporting

Alignment with business initiatives

Alignment with industry frameworks

Which of the following is the PRIMARY advantage of an organization using Disaster Recovery as a Service (DRaaS) to help manage its disaster recovery program?

It allows the organization to prioritize its core operations.

It offers the organization flexible deployment options using cloud infrastructure.

It allows the organization to prioritize its core operations.

It is more secure than traditional data backup architecture.

It allows the use of a professional response team at a lower cost.

Which of the following would be MOST effective in reducing the impact of a distributed denial of service (DDoS) attack?

Spread a site across multiple ISPs.

Impose state limits on servers.

Spread a site across multiple ISPs.

Block the attack at the source.

Which of the following is the GREATEST benefit of incorporating information security governance into the corporate governance framework?

Management accountability for information security

Heightened awareness of information security strategies

Improved process resiliency in the event of attacks

Promotion of security-by-design principles to the business

Management accountability for information security

Which of the following is the BEST reason to implement a comprehensive information security management system?

To ensure continuous alignment with the organizational strategy

To gain senior management support for the information security program

To support identification of key risk indicators (KRIs)

To facilitate compliance with external regulatory requirements

Which of the following is the BEST reason for senior management to support a business case for developing a monitoring system for a critical application?

The cost of implementing the system is less than the impact of downtime.

An industry peer experienced a recent breach with a similar application.

The system can be replicated for additional use cases.

The cost of implementing the system is less than the impact of downtime.

The solution is within the organization's risk tolerance.

Which of the following should be done NEXT following senior management's decision to comply with new personal data regulations that are much more stringent than those currently followed to avoid massive fines?

Encrypt data in transit and at rest.

Complete a return on investment (ROI) analysis.

Create and implement a data minimization plan.

Predetermined containment methods to be used in a cybersecurity incident response should be based PRIMARILY on the:

capability of incident handlers.

How would the information security program BEST support the adoption of emerging technologies?

Developing an emerging technology roadmap

Conducting a control assessment

Developing an emerging technology roadmap

Providing effective risk governance

Developing an acceptable use policy

Which of the following BEST determines an information asset's classification?

Criticality to a business process

Value of the information asset in the marketplace

Criticality to a business process

Risk assessment from the data owner

Cost of producing the information asset

An information security team has confirmed that threat actors are taking advantage of a newly announced critical vulnerability within an application. Which of the following should be doneFIRST?

Invoke the incident response plan.

Install additional application controls.

Invoke the incident response plan.

Prevent access to the application.

Which of the following is the MOST effective way to increase security awareness in an organization?

Conduct periodic simulated phishing exercises.

Implement regularly scheduled information security audits.

Require signed acknowledgment of information security policies.

Conduct periodic simulated phishing exercises.

Include information security requirements in job descriptions.

Isaca CISM Practice Test 17 - Free Online Exam Questions 641-680

An organization experienced a loss of revenue during a recent disaster. Which of the following would BEST prepare the organization to recover?

Become a Premium Member for full access

Unlock Premium Member

Isaca CISM Practice Test 17

Question

Isaca CISM Practice Tests

Practice Tests