Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISM Study Questions C > CISM Practice C Topic 1 > Flashcards

CISM Practice C Topic 1 Flashcards

1
Q

Which of the following should be the FIRST step in developing an information security plan?

A

Analyze the current business strategy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Senior management commitment and support for information security can BEST be obtained through presentations that:

A

tie security risks to key business objectives.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

The MOST appropriate role for senior management in supporting information security is the:

A

approval of policy statements and funding.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Which of the following would BEST ensure the success of information security governance within an organization?

A

Steering committees approve security projects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Information security governance is PRIMARILY driven by:

A

business strategy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Which of the following represents the MAJOR focus of privacy regulations?

A

Identifiable personal data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Investments in information security technologies should be based on:

A

value analysis.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Retention of business records should PRIMARILY be based on:

A

regulatory and legal requirements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Which of the following is characteristic of centralized information security management?

A

Better adherence to policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Successful implementation of information security governance will FIRST require:

A

updated security policies.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Which of the following individuals would be in the BEST position to sponsor the creation of an information security steering group?

A

Chief operating officer (COO)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

The MOST important component of a privacy policy is:

A

notifications.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

The cost of implementing a security control should not exceed the:

A

asset value.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

When a security standard conflicts with a business objective, the situation should be resolved by:

A

performing a risk analysis.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Minimum standards for securing the technical infrastructure should be defined in a security:

A

architecture.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Which of the following is MOST appropriate for inclusion in an information security strategy?

A

Security processes, methods, tools and techniques

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Senior management commitment and support for information security will BEST be attained by an information security manager by emphasizing:

A

organizational risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Which of the following roles would represent a conflict of interest for an information security manager?

A

Final approval of information security policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Which of the following situations must be corrected FIRST to ensure successful information security governance within an organization?T

A

The data center manager has final signoff on all security projects.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Which of the following requirements would have the lowest level of priority in information security?

A

Technical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

When an organization hires a new information security manager, which of the following goals should this individual pursue FIRST?

A

Establish good communication with steering committee members

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

It is MOST important that information security architecture be aligned with which of the following?

A

Business objectives and goals

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Which of the following is MOST likely to be discretionary?

A

Guidelines

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Security technologies should be selected PRIMARILY on the basis of their:

A

ability to mitigate business risks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Which of the following are seldom changed in response to technological changes?

A

Policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

The MOST important factor in planning for the long-term retention of electronically stored business records is to take into account potential changes in:

A

application systems and media.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Which of the following is characteristic of decentralized information security management across a geographically dispersed organization?

A

Better alignment to business unit needs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Which of the following is the MOST appropriate position to sponsor the design and implementation of a new security infrastructure in a large global enterprise?

A

Chief operating officer (COO)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Which of the following would be the MOST important goal of an information security governance program?

A

Ensuring trust in data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Relationships among security technologies are BEST defined through which of the following?

A

Security architecture

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

A business unit intends to deploy a new technology in a manner that places it in violation of existing information security standards. What immediate action should an information security manager take?

A

Perform a risk analysis to quantify the risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Acceptable levels of information security risk should be determined by:

A

the steering committee.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

The PRIMARY goal in developing an information security strategy is to:

A

support the business objectives of the organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Senior management commitment and support for information security can BEST be enhanced through:

A

periodic review of alignment with business management goals.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

When identifying legal and regulatory issues affecting information security, which of the following would represent the BEST approach to developing information security policies?

A

Develop policies that meet all mandated requirements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Which of the following MOST commonly falls within the scope of an information security governance steering committee?

A

Prioritizing information security initiatives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Which of the following is the MOST important factor when designing information security architecture?

A

Stakeholder requirements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Which of the following characteristics is MOST important when looking at prospective candidates for the role of chief information security officer (CISO)?

A

Ability to understand and map organizational needs to security technologies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Which of the following are likely to be updated MOST frequently?

A

Procedures for hardening database servers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Who should be responsible for enforcing access rights to application data?

A

Security administrators

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

The chief information security officer (CISO) should ideally have a direct reporting relationship to the:

A

chief operations officer (COO).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Which of the following is the MOST essential task for a chief information security officer (CISO) to perform?

A

Develop an information security strategy paper

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Developing a successful business case for the acquisition of information security software products can BEST be assisted by:

A

calculating return on investment (ROI) projections.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

When an information security manager is developing a strategic plan for information security, the timeline for the plan should be:

A

aligned with the business strategy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Which of the following is the MOST important information to include in a strategic plan for information security?

A

Current state and desired future state

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Information security projects should be prioritized on the basis of:

A

impact on the organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Which of the following is the MOST important information to include in an information security standard?

A

Last review date

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Which of the following would BEST prepare an information security manager for regulatory reviews? department

A

Perform self-assessments using regulatory guidelines and reports

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

An information security manager at a global organization that is subject to regulation by multiple governmental jurisdictions with differing requirements should:

A

establish baseline standards for all locations and add supplemental standards as required.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Which of the following BEST describes an information security manager’s role in a multidisciplinary team that will address a new regulatory requirement regarding operational risk?

A

Evaluate the impact of information security risks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

From an information security manager perspective, what is the immediate benefit of clearly defined roles and responsibilities?

A

Better accountability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

An internal audit has identified major weaknesses over IT processing. Which of the following should an information security manager use to BEST convey a sense of urgency to management?

A

Risk assessment reports

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Reviewing which of the following would BEST ensure that security controls are effective?

A

Security metrics

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Which of the following is responsible for legal and regulatory liability?

A

Board and senior management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

While implementing information security governance an organization should FIRST:

A

define the security strategy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Information security policy enforcement is the responsibility of the:

A

chief information security officer (CISO).

57
Q

A good privacy statement should include:

A

what the company will do with information it collects.

58
Q

Which of the following would be MOST effective in successfully implementing restrictive password policies?

A

Security awareness program

59
Q

When designing an information security quarterly report to management, the MOST important element to be considered should be the:

A

linkage to business area objectives.

60
Q

An information security manager at a global organization has to ensure that the local information security program will initially ensure compliance with the:

A

data privacy policy where data are collected.

61
Q

A new regulation for safeguarding information processed by a specific type of transaction has come to the attention of an information security officer. The officer should FIRST:

A

assess whether existing controls meet the regulation.

62
Q

The PRIMARY objective of a security steering group is to:

A

ensure information security aligns with business goals.

63
Q

Data owners must provide a safe and secure environment to ensure confidentiality, integrity and availability of the transaction. This is an example of an information security:

A

policy.

64
Q

At what stage of the applications development process should the security department initially become involved?

A

At detail requirements

65
Q

A security manager is preparing a report to obtain the commitment of executive management to a security program. Inclusion of which of the following would be of MOST value?

A

Associating realistic threats to corporate objectives

66
Q

The PRIMARY concern of an information security manager documenting a formal data retention policy would be:

A

business requirements.

67
Q

When personal information is transmitted across networks, there MUST be adequate controls over:

A

privacy protection.

68
Q

An organization’s information security processes are currently defined as ad hoc. In seeking to improve their performance level, the next step for the organization should be to:

A

ensure that security processes are consistent across the organization.

69
Q

Who in an organization has the responsibility for classifying information?

A

Data owner

70
Q

What is the PRIMARY role of the information security manager in the process of information classification within an organization?

A

Defining and ratifying the classification structure of information assets

71
Q

Logging is an example of which type of defense against systems compromise?

A

Detection

72
Q

Which of the following is MOST important in developing a security strategy?

A

Understanding key business objectives

73
Q

Who is ultimately responsible for the organization’s information?

A

Board of directors

74
Q

Which of the following factors is a PRIMARY driver for information security governance that does not require any further justification?

A

Regulatory compliance

75
Q

A security manager meeting the requirements for the international flow of personal data will need to ensure:

A

the agreement of the data subjects.

76
Q

An information security manager mapping a job description to types of data access is MOST likely to adhere to which of the following information security principles?

A

Proportionality

77
Q

Which of the following is the MOST important prerequisite for establishing information securitymanagement within an organization?

A

Senior management commitment

78
Q

What will have the HIGHEST impact on standard information security governance models?

A

Complexity of organizational structure

79
Q

In order to highlight to management the importance of integrating information security in the business processes, a newly hired information security officer should FIRST:

A

conduct a risk assessment.

80
Q

Temporarily deactivating some monitoring processes, even if supported by an acceptance of operational risk, may not be acceptable to the information security manager if:

A

it implies compliance risks.

81
Q

An outcome of effective security governance is:

A

strategic alignment.

82
Q

How would an information security manager balance the potentially conflicting requirements of an international organization’s security standards and local regulation?

A

Negotiate a local version of the organization standards

83
Q

Who should drive the risk analysis for an organization?

A

Security manager

84
Q

The FIRST step in developing an information security management program is to:

A

clarify organizational purpose for creating the program.

85
Q

Which of the following is the MOST important to keep in mind when assessing the value of information?

A

The potential financial loss

86
Q

What would a security manager PRIMARILY utilize when proposing the implementation of a security solution?

A

Business case

87
Q

To justify its ongoing security budget, which of the following would be of MOST use to the information security department?

A

Cost-benefit analysis

88
Q

Which of the following situations would MOST inhibit the effective implementation of security governance:

A

High-level sponsorship

89
Q

To achieve effective strategic alignment of security initiatives, it is important that:

A

Inputs be obtained and consensus achieved between the major organizational units.

90
Q

What would be the MOST significant security risks when using wireless local area network (LAN) technology?

A

Rogue access point

91
Q

When developing incident response procedures involving servers hosting critical applications, which of the following should be the FIRST to be notified?

A

Information security manager

92
Q

In implementing information security governance, the information security manager is PRIMARILY responsible for:

A

developing the security strategy.

93
Q

An information security strategy document that includes specific links to an organization’s business activities is PRIMARILY an indicator of:

A

alignment.

94
Q

When an organization is setting up a relationship with a third-party IT service provider, which of the following is one of the MOST important topics to include in the contract from a security standpoint?

A

Compliance with the organization’s information security requirements

95
Q

To justify the need to invest in a forensic analysis tool, an information security manager should FIRST:

A

substantiate the investment in meeting organizational needs.

96
Q

The MOST useful way to describe the objectives in the information security strategy is through:

A

attributes and characteristics of the “desired state.”

97
Q

In order to highlight to management the importance of network security, the security manager should FIRST:

A

conduct a risk assessment.

98
Q

When developing an information security program, what is the MOST useful source of information for determining available resources?

A

Skills inventory

99
Q

The MOST important characteristic of good security policies is that they:

A

are aligned with organizational goals.

100
Q

An information security manager must understand the relationship between information security and business operations in order to:

A

support organizational objectives.

101
Q

The MOST effective approach to address issues that arise between IT management, business units and security management when implementing a new security strategy is for the information security manager to:

A

refer the issues to senior management along with any security recommendations.

102
Q

Obtaining senior management support for establishing a warm site can BEST be accomplished by:

A

developing a business case.

103
Q

Which of the following would be the BEST option to improve accountability for a system administrator who has security functions?

A

Include security responsibilities in the job description

104
Q

Which of the following is the MOST important element of an information security strategy?

A

Defined objectives

105
Q

A multinational organization operating in fifteen countries is considering implementing an information security program. Which factor will MOST influence the design of the Information security program?

A

Cultures of the different countries

106
Q

Which of the following is the BEST justification to convince management to invest in an information security program?

A

Increased business valueI

107
Q

On a company’s e-commerce web site, a good legal statement regarding data privacy should include:

A

a statement regarding what the company will do with the information it collects.

108
Q

The MOST important factor in ensuring the success of an information security program is effective:

A

alignment with organizational goals and objectives.

109
Q

Which of the following would be MOST helpful to achieve alignment between information security and organization objectives?

A

A security program that enables business activities

110
Q

Which of the following BEST contributes to the development of a security governance framework that supports the maturity model concept?

A

Continuous analysis, monitoring and feedback

111
Q

The MOST complete business case for security solutions is one that:

A

includes appropriate justification.

112
Q

Which of the following is MOST important to understand when developing a meaningful information security strategy?

A

Organizational goals

113
Q

Which of the following is an advantage of a centralized information security organizational structure?

A

It is easier to manage and control.

114
Q

Which of the following would help to change an organization’s security culture?

A

Obtain strong management support

115
Q

The BEST way to justify the implementation of a single sign-on (SSO) product is to use:

A

a business case.

116
Q

The FIRST step in establishing a security governance program is to:

A

obtain high-level sponsorship.

117
Q

An IS manager has decided to implement a security system to monitor access to the Internet and prevent access to numerous sites. Immediately upon installation, employees flood the IT helpdesk with complaints of being unable to perform business functions on Internet sites. This is an example of:

A

conflicting security controls with organizational needs.

118
Q

An organization’s information security strategy should be based on:

A

managing risk relative to business objectives.

119
Q

Which of the following should be included in an annual information security budget that is submitted for management approval?

A

A cost-benefit analysis of budgeted resources

120
Q

Which of the following is a benefit of information security governance?

A

Reduction of the potential for civil or legal liability

121
Q

Investment in security technology and processes should be based on:

A

clear alignment with the goals and objectives of the organization.

122
Q

The data access requirements for an application should be determined by the:

A

business owner.

123
Q

From an information security perspective, information that no longer supports the main purpose of the business should be:

A

analyzed under the retention policy.

124
Q

The organization has decided to outsource the majority of the IT department with a vendor that is hosting servers in a foreign country. Of the following, which is the MOST critical security consideration?

A

Laws and regulations of the country of origin may not be enforceable in the foreign country.

125
Q

Effective IT governance is BEST ensured by:

A

utilizing a top-down approach.

126
Q

The FIRST step to create an internal culture that focuses on information security is to:

A

gain the endorsement of executive management.

127
Q

Which of the following is the BEST method or technique to ensure the effective implementation of an information security program?

A

Obtain the support of the board of directors.

128
Q

When an organization is implementing an information security governance program, its board of directors should be responsible for:

A

setting the strategic direction of the program.

129
Q

A risk assessment and business impact analysis (BIA) have been completed for a major proposed purchase and new process for an organization. There is disagreement between the information security manager and the business department manager who will own the process regarding the results and the assigned risk. Which of the following would be the BEST approach of the information security manager?A

A

Review of the assessment with executive management for final input

130
Q

Who is responsible for ensuring that information is categorized and that specific protective measures are taken?

A

Senior management

131
Q

An organization’s board of directors has learned of recent legislation requiring organizations within the industry to enact specific safeguards to protect confidential customer information. What actions should the board take next?

A

Require management to report on compliance

132
Q

Information security should be:

A

a balance between technical and business requirements.

133
Q

What is the MOST important factor in the successful implementation of an enterprise wide information security program?

A

Support of senior management

134
Q

What is the MAIN risk when there is no user management representation on the Information Security Steering Committee?

A

Information security plans are not aligned with business requirements

135
Q

The MAIN reason for having the Information Security Steering Committee review a new security controls implementation plan is to ensure that:

A

the plan aligns with the organization’s business plan.

136
Q

The MAIN reason for having the Information Security Steering Committee review a new security controls implementation plan is to ensure that:

A

the plan aligns with the organization’s business plan.

137
Q

Which of the following should be determined while defining risk management strategies?

A

Organizational objectives and risk appetite

138
Q

When implementing effective security governance within the requirements of the company’s security strategy, which of the following is the MOST important factor to consider?

A

Preserving the confidentiality of sensitive data

139
Q

Which of the following is the BEST reason to perform a business impact analysis (BIA)?

A

To help determine the current state of risk

CISM Study Questions C (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions