Last Updated on October 26, 2022 by InfraExam
CISM : Certified Information Security Manager : Part 67
-
Which of the following is the MOST important factor to consider when establishing a severity hierarchy for information security incidents?
- Regulatory compliance
- Business impact
- Management support
- Residual risk
-
Which of the following is the MOST important reason to document information security incidents that are reported across the organization?
- Identify unmitigated risk
- Prevent incident recurrence
- Evaluate the security posture of the organization
- Support business investments in security
-
Which of the following is the MOST important part of an incident response plan?
- Recovery time objective (RTO)
- Business impact analysis (BIA)
- Recovery point objective (RPO)
- Mean time to report (MTTR)
-
When designing an incident response plan to be agreed upon with a cloud computing vendor, including which of the following will BEST help to ensure the effectiveness of the plan?
- A training program for the vendor staff
- An audit and compliance program
- Responsibility and accountability assignments
- Requirements for onsite recovery testing
-
Which is the MOST important to enable a timely response to a security breach?
- Knowledge sharing and collaboration
- Security event logging
- Roles and responsibilities
- Forensic analysis
-
Following a highly sensitive data breach at a large company, all servers and workstations were patched. The information security manager’s NEXT step should be to:
- inform senior management of changes in risk metrics.
- perform an assessment to measure the current state.
- deliver security awareness training.
- ensure baseline back-ups are performed.
-
The MOST likely cause of a security information event monitoring (SIEM) solution failing to identify a serious incident is that the system:
- is not collecting logs from relevant devices.
- has not been updated with the latest patches.
- is hosted by a cloud service provider.
- has performance issues.
-
Which of the following should be determined FIRST when establishing a business continuity program?
- Cost to rebuild information processing facilities
- Incremental daily cost of the unavailability of systems
- Location and cost of offsite recovery facilities
- Composition and mission of individual recovery teams
Explanation:
Prior to creating a detailed business continuity plan, it is important to determine the incremental daily cost of losing different systems. This will allow recovery time objectives to be determined which, in turn, affects the location and cost of offsite recovery facilities, and the composition and mission of individual recovery teams. Determining the cost to rebuild information processing facilities would not be the first thing to determine. -
A desktop computer that was involved in a computer security incident should be secured as evidence by:
- disconnecting the computer from all power sources.
- disabling all local user accounts except for one administrator.
- encrypting local files and uploading exact copies to a secure server.
- copying all files using the operating system (OS) to write-once media.
Explanation:
To preserve the integrity of the desktop computer as an item of evidence, it should be immediately disconnected from all sources of power. Any attempt to access the information on the computer by copying, uploading or accessing it remotely changes the operating system (OS) and temporary files on the computer and invalidates it as admissible evidence. -
A company has a network of branch offices with local file/print and mail servers; each branch individually contracts a hot site. Which of the following would be the GREATEST weakness in recovery capability?
- Exclusive use of the hot site is limited to six weeks
- The hot site may have to be shared with other customers
- The time of declaration determines site access priority
- The provider services all major companies in the area
Explanation:
Sharing a hot site facility is sometimes necessary in the case of a major disaster. Also, first come, first served usually determines priority of access based on general industry practice. Access to a hot site is not indefinite; the recovery plan should address a long-term outage. In case of a disaster affecting a localized geographical area, the vendor’s facility and capabilities could be insufficient for all of its clients, which will all be competing for the same resource. Preference will likely be given to the larger corporations, possibly delaying the recovery of a branch that will likely be smaller than other clients based locally. -
Which of the following actions should be taken when an online trading company discovers a network attack in progress?
- Shut off all network access points
- Dump all event logs to removable media
- Isolate the affected network segment
- Enable trace logging on all event
Explanation:
Isolating the affected network segment will mitigate the immediate threat while allowing unaffected portions of the business to continue processing. Shutting off all network access points would create a denial of service that could result in loss of revenue. Dumping event logs and enabling trace logging, while perhaps useful, would not mitigate the immediate threat posed by the network attack. -
The BEST method for detecting and monitoring a hacker’s activities without exposing information assets to unnecessary risk is to utilize:
- firewalls.
- bastion hosts.
- decoy files.
- screened subnets.
Explanation:
Decoy files, often referred to as honeypots, are the best choice for diverting a hacker away from critical files and alerting security of the hacker’s presence. Firewalls and bastion hosts attempt to keep the hacker out, while screened subnets or demilitarized zones (DM/.s) provide a middle ground between the trusted internal network and the external untrusted Internet. -
The FIRST priority when responding to a major security incident is:
- documentation.
- monitoring.
- restoration.
- containment.
Explanation:
The first priority in responding to a security incident is to contain it to limit the impact. Documentation, monitoring and restoration are all important, but they should follow containment. -
Which of the following is the MOST important to ensure a successful recovery?
- Backup media is stored offsite
- Recovery location is secure and accessible
- More than one hot site is available
- Network alternate links are regularly tested
Explanation:
Unless backup media are available, all other preparations become meaningless. Recovery site location and security are important, but would not prevent recovery in a disaster situation. Having a secondary hot site is also important, but not as important as having backup media available. Similarly, alternate data communication lines should be tested regularly and successfully but, again, this is not as critical. -
Which of the following is the MOST important element to ensure the success of a disaster recovery test at a vendor-provided hot site?
- Tests are scheduled on weekends
- Network IP addresses are predefined
- Equipment at the hot site is identical
- Business management actively participates
Explanation:
Disaster recovery testing requires the allocation of sufficient resources to be successful. Without the support of management, these resources will not be available, and testing will suffer as a result. Testing on weekends can be advantageous but this is not the most important choice. As vendor-provided hot sites are in a state of constant change, it is not always possible to have network addresses defined in advance. Although it would be ideal to provide for identical equipment at the hot site, this is not always practical as multiple customers must be served and equipment specifications will therefore vary. -
At the conclusion of a disaster recovery test, which of the following should ALWAYS be performed prior to leaving the vendor’s hot site facility?
- Erase data and software from devices
- Conduct a meeting to evaluate the test
- Complete an assessment of the hot site provider
- Evaluate the results from all test scripts
Explanation:
For security and privacy reasons, all organizational data and software should be erased prior to departure. Evaluations can occur back at the office after everyone is rested, and the overall results can be discussed and compared objectively. -
An incident response policy must contain:
- updated call trees.
- escalation criteria.
- press release templates.
- critical backup files inventory.
Explanation:
Escalation criteria, indicating the circumstances under which specific actions are to be undertaken, should be contained within an incident response policy. Telephone trees, press release templates and lists of critical backup files are too detailed to be included in a policy document. -
The BEST approach in managing a security incident involving a successful penetration should be to:
- allow business processes to continue during the response.
- allow the security team to assess the attack profile.
- permit the incident to continue to trace the source.
- examine the incident response process for deficiencies.
Explanation:
Since information security objectives should always be linked to the objectives of the business, it is imperative that business processes be allowed to continue whenever possible. Only when there is no alternative should these processes be interrupted. Although it is important to allow the security team to assess the characteristics of an attack, this is subordinate to the needs of the business. Permitting an incident to continue may expose the organization to additional damage. Evaluating the incident management process for deficiencies is valuable but it, too, is subordinate to allowing business processes to continue. -
A post-incident review should be conducted by an incident management team to determine:
- relevant electronic evidence.
- lessons learned.
- hacker’s identity.
- areas affected.
Explanation:
Post-incident reviews are beneficial in determining ways to improve the response process through lessons learned from the attack. Evaluating the relevance of evidence, who launched the attack or what areas were affected are not the primary purposes for such a meeting because these should have been already established during the response to the incident. -
An organization with multiple data centers has designated one of its own facilities as the recovery site. The MOST important concern is the:
- communication line capacity between data centers.
- current processing capacity loads at data centers.
- differences in logical security at each center.
- synchronization of system software release versions.
Explanation:
If data centers are operating at or near capacity, it may prove difficult to recover critical operations at an alternate data center. Although line capacity is important from a mirroring perspective, this is secondary to having the necessary capacity to restore critical systems. By comparison, differences in logical and physical security and synchronization of system software releases are much easier issues to overcome and are, therefore, of less concern.