CISM : Certified Information Security Manager : Part 40

  1. An organization permits the storage and use of its critical and sensitive information on employee-owned smartphones. Which of the following is the BEST security control?

    • Requiring the backup of the organization’s data by the user
    • Establishing the authority to remote wipe
    • Monitoring how often the smartphone is used
    • Developing security awareness training
  2. During which phase of an incident response process should corrective actions to the response procedure be considered and implemented?

    • Eradication
    • Review
    • Containment
    • Identification
  3. Employees in a large multinational organization frequently travel among various geographic locations. Which type of authorization policy BEST addresses this practice?

    • Multilevel
    • Identity
    • Role-based
    • Discretionary
  4. To ensure IT equipment meets organizational security standards, the MOST efficient approach is to:

    • assess security during equipment deployment.
    • ensure compliance during user acceptance testing (UAT).
    • assess the risks of all new equipment.
    • develop an approved equipment list.
  5. Segregation of duties is a security control PRIMARILY used to:

    • establish dual check.
    • establish hierarchy.
    • limit malicious behavior.
    • decentralize operations.
  6. Which of the following is the BEST approach when using sensitive customer data during the testing phase of a systems development project?

    • Establish the test environment on a separate network.
    • Sanitize customer data.
    • Monitor the test environment for data loss.
    • Implement equivalent controls to those on the source system.
  7. Which of the following analyses will BEST identify the external influences to an organization’s information security?

    • Gap analysis
    • Business impact analysis
    • Threat analysis
    • Vulnerability analysis.
  8. Spoofing should be prevented because it may be used to:

    • assemble information, track traffic, and identify network vulnerabilities.
    • predict which way a program will branch when an option is presented.
    • gain illegal entry to a secure system by faking the sender’s address.
    • capture information such as password traveling through the network.
  9. Utilizing external resources for highly technical information security tasks allows an information security manager to:

    • distribute technology risk.
    • leverage limited resources.
    • outsource responsibility.
    • transfer business risk.
  10. The PRIMARY reason for using information security metrics is to:

    • achieve senior management commitment.
    • ensure alignment with corporate requirements.
    • adhere to legal and regulatory requirements.
    • monitor the effectiveness of controls.
  11. An information security team is investigating an alleged breach of an organization’s network. Which of the following would be the BEST single source of evidence to review?

    • Intrusion detection system (IDS)
    • Security information and event management (SIEM) tool
    • Antivirus software
    • File integrity monitoring (FIM) software
  12. Which of the following is the BEST defense against distributed denial of service (DDoS) attacks?

    • Multiple and redundant paths
    • Well-configured routers and firewalls
    • Regular patching
    • Intruder-detection lockout
  13. Which of the following functions is the MOST critical when initiating the removal of system access for terminated employees?

    • Human resources
    • Legal
    • Help desk
    • Information security
  14. After logging in to a web application, further password credentials are required at various application points. Which of the following is the PRIMARY reason for such an approach?

    • To ensure access is granted to the authorized person
    • To enforce strong two-factor authentication
    • To ensure session management variables are secure
    • To implement single sign-on
  15. The MAIN reason for continuous monitoring of a security strategy is to:

    • optimize resource allocation.
    • confirm benefits are being realized.
    • evaluate the implementation of the strategy.
    • allocate funds for information security
  16. Which of the following is the MOST important factor in an organization’s selection of a key risk indicator (KRI)?

    • Return on investment
    • Organizational culture
    • Compliance requirements
    • Criticality of information
  17. During the initiation phase of the system development life cycle (SDLC) for a software project, information security activities should address:

    • baseline security controls.
    • cost-benefit analyses.
    • benchmarking security metrics.
    • security objectives.
  18. In an organization that has undergone an expansion through an acquisition which of the following would BEST secure the enterprise network?

    • Using security groups
    • Log analysis of system access
    • Business or role-based segmentation
    • Encryption of data traversing networks
  19. An organization has established information security policies, but the information security manager has noted a large number of exception requests. Which of the following is the MOST likely reason for this situation?

    • The organization is operating in a highly regulated industry.
    • The information security program is not adequately funded.
    • The information security policies lack alignment with corporate goals.
    • The information security policies are not communicated across the organization
  20. An organization shares customer information across its globally dispersed branches. Which of the following should be the GREATEST concern to information security management?

    • Cross-cultural differences between branches
    • Conflicting data protection regulations
    • Insecure wide area networks (WANs)
    • Decentralization of information security
Notify of
Inline Feedbacks
View all comments