ExamGecko
Question list
Search
Search

Question 36 - CISM discussion

Report
Export

Which of the following Is MOST useful to an information security manager when conducting a post-incident review of an attack?

A.
Cost of the attack to the organization
Answers
A.
Cost of the attack to the organization
B.
Location of the attacker
Answers
B.
Location of the attacker
C.
Method of operation used by the attacker
Answers
C.
Method of operation used by the attacker
D.
Details from intrusion detection system (IDS) logs
Answers
D.
Details from intrusion detection system (IDS) logs
Suggested answer: C

Explanation:

= The method of operation used by the attacker is the most useful information for an information security manager when conducting a post-incident review of an attack. This information can help identify the root cause of the incident, the vulnerabilities exploited, the impact and severity of the attack, and the effectiveness of the existing security controls. The method of operation can also provide insights into the attacker's motives, skills, and resources, which can help improve the organization's threat intelligence and risk assessment. The cost of the attack to the organization, the location of the attacker, and the details from IDS logs are all relevant information for a post-incident review, but they are not as useful as the method of operation for improving the incident handling process and preventing future attacks.Reference=CISM Review Manual 2022, page 316;CISM Item Development Guide 2022, page 9;ISACA CISM: PRIMARY goal of a post-incident review should be to?

asked 01/10/2024
Hydir Sherbini
26 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first