Isaca CISM Practice Test - Questions Answers, Page 68

A monitoring system for a critical application can help detect and prevent incidents that could affect the availability, integrity, and confidentiality of the application and its data. The impact of downtime could include loss of revenue, reputation, customer satisfaction, and regulatory compliance. Therefore, the cost of implementing the system should be justified by the potential savings from avoiding or minimizing these impacts.

Reference=CISM Review Manual, 15th Edition, page 173;An Introduction to Metrics, Monitoring, and Alerting;Business-critical applications: What are they and how do you protect them from cyberattack?

According to the CISM Review Manual, 15th Edition1, the information security manager is responsible for ensuring that the information security program supports the organization's objectives and aligns with applicable laws and regulations. The information security manager is also responsible for overseeing the implementation and maintenance of effective IT controls, as well as monitoring and reporting on their performance.

Reference=1: CISM Review Manual, 15th Edition, ISACA, 2016, Chapter 1, page 10.

A gap analysis is a tool that helps to identify the current state of compliance and the desired state of compliance, as well as the actions needed to achieve the desired state. A gap analysis should be done before implementing any specific controls or solutions, such as encryption, data minimization, or ROI analysis.

Reference=CISM Review Manual 15th Edition, page 65;Information Security Architecture: Gap Assessment and Prioritization, ISACA Journal, volume 2, 2018.

According to the NIST SP 800-61 Computer Security Incident Handling Guide, the type of confirmed incident is one of the most important criteria for choosing a containment strategy, as different types of incidents may require different levels of urgency, scope, and impact1. For example, a denial-of-service attack may require a different containment strategy than a ransomware attack or a data breach.

Reference=1: NIST SP 800-61: 3.1.Choosing a Containment Strategy2

An emerging technology roadmap is a strategic plan that identifies the potential benefits, risks, and challenges of adopting new technologies in alignment with the organization's goals and objectives. It also defines the roles and responsibilities, processes, and controls for managing the technology lifecycle, from evaluation to implementation to maintenance. An emerging technology roadmap can help the information security program support the adoption of emerging technologies by ensuring that security requirements are considered and addressed at every stage, and that the technologies are aligned with the organization's risk appetite and compliance obligations.

Reference=CISM Review Manual, 15th Edition, page 97;Privacy, Security and Bias in Emerging Technologies;The Impact of Emerging Technology on the Future of Cybersecurity

According to the CISM Review Manual, 15th Edition1, information asset classification is the process of assigning a level of sensitivity to information assets based on their importance to the organization and the potential impact of unauthorized disclosure, modification or destruction. The criticality of an information asset to a business process is one of the key factors that determines its classification level.

Reference=1: CISM Review Manual, 15th Edition, ISACA, 2016, Chapter 2, page 61.

False negatives are events that are not detected by the IDS, but should have been. An increase in false negatives indicates that the IDS is missing potential attacks or intrusions, which could compromise the security of the organization.

Reference= CISM Review Manual, 15th Edition, page 212; CISM Review Questions, Answers & Explanations Database, question ID 1001.

According to the NIST SP 800-61 Computer Security Incident Handling Guide1, the first step in responding to a cybersecurity incident is to invoke the incident response plan (IRP), which is a written document that defines the roles, responsibilities, and procedures for dealing with a confirmed or suspected security breach1.The IRP helps the organization to prepare for, detect, analyze, contain, eradicate, recover from, and learn from incidents1. Invoking the IRP ensures that the right personnel and resources are mobilized to effectively deal with the threat and minimize the impact.

Reference=1: NIST SP 800-61: 1.Introduction1