Home / Isaca / CISM

Isaca CISM Practice Test - Questions Answers, Page 69

Question list

List of questions

Question 681

(0)

Which of the following should an information security manager do FIRST upon confirming a privileged user's unauthorized modifications to a security application?

Question 682

(0)

The results of a risk assessment for a potential network reconfiguration reveal a high likelihood of sensitive data being compromised. What is the information security manager's BEST course of actio

Question 683

(0)

Which of the following is an information security manager's BEST course of action when a penetration test reveals a security exposure due to a firewall that is not configured correctly?

Question 684

(0)

Which of the following is the MOST important objective when planning an incident response program?

Question 685

(0)

The use of a business case to obtain funding for an information security investment is MOST effective when the business case:

Question 686

(0)

Which of the following presents the GREATEST challenge to a large multinational organization using an automated identity and access management (1AM) system?

Question 687

(0)

When an organization lacks internal expertise to conduct highly technical forensics investigations, what is the BEST way to ensure effective and timely investigations following an information securi

Question 688

(0)

Which of the following considerations is MOST important when selecting a third-party intrusion detection system (IDS) vendor?

Question 689

(0)

A software vendor has announced a zero-day vulnerability that exposes an organization's critical business systems. The vendor has released an emergency patch. Which of the following should be the in

Question 690

(0)

A new information security manager finds that the organization tends to use short-term solutions to address problems. Resource allocation and spending are not effectively tracked, and there is no as

Question 681

Which of the following should an information security manager do FIRST upon confirming a privileged user's unauthorized modifications to a security application?

Implement compensating controls to address the risk.

Report the risk associated with the policy breach.

Implement a privileged access management system.

Enforce the security configuration and require the change to be reverted.

Show Answer Comment (0)

The results of a risk assessment for a potential network reconfiguration reveal a high likelihood of sensitive data being compromised. What is the information security manager's BEST course of action?

Recommend additional network segmentation.

Seek an independent opinion to confirm the findings.

Determine alignment with existing regulations.

Report findings to key stakeholders.

Show Answer Comment (0)

Question 683

Which of the following is an information security manager's BEST course of action when a penetration test reveals a security exposure due to a firewall that is not configured correctly?

Ensure a plan with milestones is developed.

Implement a distributed denial of service (DDoS) control.

Engage the incident response team.

Define new key performance indicators (KPIs).

Show Answer Comment (0)

Question 684

Which of the following is the MOST important objective when planning an incident response program?

Managing resources

Ensuring IT resiliency

Recovering from a disaster

Minimizing business impact

Show Answer Comment (0)

Question 685

The use of a business case to obtain funding for an information security investment is MOST effective when the business case:

relates the investment to the organization's strategic plan.

translates information security policies and standards into business requirements.

articulates management's intent and information security directives in clear language.

realigns information security objectives to organizational strategy.

Show Answer Comment (0)

Question 686

Which of the following presents the GREATEST challenge to a large multinational organization using an automated identity and access management (1AM) system?

Staff turnover rates that significantly exceed industry averages

Large number of applications in the organization

Inaccurate workforce data from human resources (HR)

Frequent changes to user roles during employment

Show Answer Comment (0)

Question 687

When an organization lacks internal expertise to conduct highly technical forensics investigations, what is the BEST way to ensure effective and timely investigations following an information security incident?

Purchase forensic standard operating procedures.

Provide forensics training to the information security team.

Ensure the incident response policy allows hiring a forensics firm.

Retain a forensics firm prior to experiencing an incident.

Show Answer Comment (0)

Question 688

Which of the following considerations is MOST important when selecting a third-party intrusion detection system (IDS) vendor?

The vendor's proposal allows for contract modification during technology refresh cycles.

The vendor's proposal aligns with the objectives of the organization.

The vendor's proposal requires the provider to have a business continuity plan (BCP).

The vendor's proposal allows for escrow in the event the third party goes out of business.

Show Answer Comment (0)

Question 689

A software vendor has announced a zero-day vulnerability that exposes an organization's critical business systems. The vendor has released an emergency patch. Which of the following should be the information security managers PRIMARY concern?

Ability to test the patch prior to deployment

Documentation of patching procedures

Adequacy of the incident response plan

Availability of resources to implement controls

Show Answer Comment (0)

Question 690

A new information security manager finds that the organization tends to use short-term solutions to address problems. Resource allocation and spending are not effectively tracked, and there is no assurance that compliance requirements are being met. What should be done FIRST to reverse this bottom-up approach to security?

Conduct a threat analysis.

Implement an information security awareness training program.

Establish an audit committee.

Create an information security steering committee.

Show Answer Comment (0)

Total 793 questions