Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISM Study Questions C > CISM Practice C Topic 3 > Flashcards

CISM Practice C Topic 3 Flashcards

1
Q

Who can BEST advocate the development of and ensure the success of an information security program?

A

Steering committee

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Which of the following BEST ensures that information transmitted over the Internet will remain confidential?

A

Virtual private network (VPN)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

The effectiveness of virus detection software is MOST dependent on which of the following?

A

Definition tables

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Which of the following is the MOST effective type of access control?

A

Role-based

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Which of the following devices should be placed within a DMZ?

A

Mail relay

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

An intrusion detection system should be placed:

A

on a screened subnet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

The BEST reason for an organization to have two discrete firewalls connected directly to the Internet and to the same DMZ would be to:

A

permit traffic load balancing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

An extranet server should be placed:

A

on a screened subnet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Which of the following is the BEST metric for evaluating the effectiveness of security awareness twining?

A

reported incidents.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Security monitoring mechanisms should PRIMARILY:

A

focus on business-critical information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Which of the following is the BEST method for ensuring that security procedures and guidelines are known and understood?

A

Computer-based certification training (CBT)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

When contracting with an outsourcer to provide security administration, the MOST important contractual element is the:

A

service level agreement (SLA).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Which of the following is the BEST metric for evaluating the effectiveness of an intrusion detection mechanism?

A

Ratio of false positives to false negatives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Which of the following is MOST effective in preventing weaknesses from being introduced into existing production systems?

A

Change management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Which of the following tools is MOST appropriate for determining how long a security project will take to implement?

A

Critical path

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Which of the following is MOST effective in preventing security weaknesses in operating systems?

A

Patch management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

When a proposed system change violates an existing security standard, the conflict would be BEST resolved by:

A

calculating the residual risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Who can BEST approve plans to implement an information security governance framework?

A

Steering committee

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Which of the following is the MOST effective solution for preventing internal users from modifying sensitive and classified information?

A

Role-based access controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Which of the following is generally used to ensure that information transmitted over the Internet is authentic and actually transmitted by the named sender?

A

Embedded digital signature

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Which of the following is the MOST appropriate frequency for updating antivirus signature files for antivirus software on production servers?

A

Daily

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Which of the following devices should be placed within a demilitarized zone (DMZ)?

A

Web server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

On which of the following should a firewall be placed?

A

Domain boundary

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

An intranet server should generally be placed on the:

A

internal network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Access control to a sensitive intranet application by mobile users can BEST be implemented through:

A

two-factor authentication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

When application-level security controlled by business process owners is found to be poorly managed, which of the following could BEST improve current practices?

A

Centralizing security management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Security awareness training is MOST likely to lead to which of the following?

A

Increase in reported incidents

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

The information classification scheme should:

A

consider possible impact of a security breach.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Which of the following is the BEST method to provide a new user with their initial password for email system access?

A

Give a dummy password over the telephone set for immediate expiration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

An information security program should be sponsored by:

A

key business process owners.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Which of the following is the MOST important item to include when developing web hosting agreements with third-party providers?

A

Service levels

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

The BEST metric for evaluating the effectiveness of a firewall is the:

A

number of attacks blocked.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Which of the following ensures that newly identified security weaknesses in an operating system are mitigated in a timely fashion?

A

Patch management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

The MAIN advantage of implementing automated password synchronization is that it:

A

reduces overall administrative workload.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Which of the following tools is MOST appropriate to assess whether information security governance objectives are being met?

A

Balanced scorecard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Which of the following is MOST effective in preventing the introduction of a code modification that may reduce the security of a critical business application?

A

Change management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

An operating system (OS) noncritical patch to enhance system security cannot be applied because a critical application is not compatible with the change. Which of the following is the BEST solution?

A

Compensate for not installing the patch with mitigating controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Which of the following is MOST important to the success of an information security program?

A

Senior management sponsorship

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Which of the following is MOST important for a successful information security program?

A

Executive management commitment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Which of the following is the MOST effective solution for preventing individuals external to the organization from modifying sensitive information on a corporate database?

A

Screened subnets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Which of the following technologies is utilized to ensure that an individual connecting to a corporate internal network over the Internet is not an intruder masquerading as an authorized user?

A

Two-factor authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What is an appropriate frequency for updating operating system (OS) patches on production servers?

A

Whenever important security patches are released

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Which of the following devices should be placed within a DMZ?

A

Application server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

A border router should be placed on which of the following?

A

Domain boundary

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

An e-commerce order fulfillment web server should generally be placed on which of the following?

A

Demilitarized zone (DMZ)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Secure customer use of an e-commerce application can BEST be accomplished through:

A

data encryption.

47
Q

What is the BEST defense against a Structured Query Language (SQL) injection attack?

A

Strict controls on input fields

48
Q

Which of the following is the MOST important consideration when implementing an intrusion detection system (IDS)?

A

Tuning

49
Q

Which of the following is the MOST important consideration when securing customer credit card data acquired by a point-of-sale (POS) cash register?

A

Encryption

50
Q

Which of the following practices is BEST to remove system access for contractors and other temporary users when it is no longer required?

A

Establish predetermined automatic expiration dates

51
Q

Primary direction on the impact of compliance with new regulatory requirements that may lead to major application system changes should be obtained from the:

A

key business process owners.

52
Q

Which of the following is the MOST important item to consider when evaluating products to monitor security across the enterprise?

A

System overhead

53
Q

Which of the following is the MOST important guideline when using software to scan for security exposures within a corporate network?

A

Do not interrupt production processes

54
Q

Which of the following BEST ensures that modifications made to in-house developed business applications do not introduce new security exposures?

A

Change management

55
Q

The advantage of Virtual Private Network (VPN) tunneling for remote users is that it:

A

helps ensure that communications are secure.

56
Q

Which of the following is MOST effective for securing wireless networks as a point of entry into a corporate network?

A

Strong encryption

57
Q

Which of the following is MOST effective in protecting against the attack technique known as phishing?

A

Security awareness training

58
Q

When a newly installed system for synchronizing passwords across multiple systems and platforms abnormally terminates without warning, which of the following should automatically occur FIRST?

A

Access control should fall back to no synchronized mode

59
Q

Which of the following is the MOST important risk associated with middleware in a client-server environment?

A

System integrity may be affected

60
Q

An outsource service provider must handle sensitive customer information. Which of the following is MOST important for an information security manager to know?

A

Security in storage and transmission of sensitive data

61
Q

Which of the following security mechanisms is MOST effective in protecting classified data that have been encrypted to prevent disclosure and transmission outside the organization’s network?

A

Safeguards over keys

62
Q

In the process of deploying a new e-mail system, an information security manager would like to ensure the confidentiality of messages while in transit. Which of the following is the MOST appropriate method to ensure data confidentiality in a new e-mail system implementation?

A

Encryption

63
Q

The MOST important reason that statistical anomaly-based intrusion detection systems (stat IDSs) are less commonly used than signature-based IDSs, is that stat IDSs:

A

generate false alarms from varying user or system actions.

64
Q

An information security manager uses security metrics to measure the:

A

performance of the information security program.

65
Q

The MOST important success factor to design an effective IT security awareness program is to:

A

customize the content to the target audience.

66
Q

Which of the following practices completely prevents a man-in-the-middle (MitM) attack between two hosts?

A

Connect through an IPSec VPN

67
Q

Which of the following features is normally missing when using Secure Sockets Layer (SSL) in a web browser?

A

Certificate-based authentication of web client

68
Q

The BEST protocol to ensure confidentiality of transmissions in a business-to-customer (B2C) financial web application is:

A

Secure Sockets Layer (SSL).

69
Q

A message that has been encrypted by the sender’s private key and again by the receiver’s public key achieves:

A

confidentiality and nonrepudiation.

70
Q

When a user employs a client-side digital certificate to authenticate to a web server through Secure Socket Layer (SSL), confidentiality is MOST vulnerable to which of the following?

A

Trojan

71
Q

Which of the following is the MOST relevant metric to include in an information security quarterly report to the executive committee?

A

Security compliant servers trend report

72
Q

It is important to develop an information security baseline because it helps to define:

A

the minimum acceptable security to be implemented.

73
Q

Which of the following BEST provides message integrity, sender identity authentication and nonrepudiation?

A

Public key infrastructure (PKI)

74
Q

Which of the following controls is MOST effective in providing reasonable assurance of physical access compliance to an unmanned server room controlled with biometric devices?

A

Regular review of access control lists

75
Q

To BEST improve the alignment of the information security objectives in an organization, the chief information security officer (CISO) should:

A

evaluate a balanced business scorecard.

76
Q

What is the MOST important item to be included in an information security policy?

A

The key objectives of the security program

77
Q

In an organization, information systems security is the responsibility of:

A

all personnel.

78
Q

An organization without any formal information security program that has decided to implement information security best practices should FIRST:

A

define high-level business security requirements.

79
Q

When considering the value of assets, which of the following would give the information security manager the MOST objective basis for measurement of value delivery in information security governance?

A

Cost of achieving control objectives

80
Q

Which of the following would be the BEST metric for the IT risk management process?

A

Percentage of critical assets with budgeted remedial

81
Q

Which of the following is a key area of the ISO 27001 framework?

A

Business continuity management

82
Q

The MAIN goal of an information security strategic plan is to:

A

protect information assets and resources.

83
Q

Which of the following, using public key cryptography, ensures authentication, confidentiality and nonrepudiation of a message?

A

Encrypting first by sender’s private key and second by receiver’s public key

84
Q

The main mail server of a financial institution has been compromised at the superuser level; the only way to ensure the system is secure would be to:

A

rebuild the system from the original installation medium.

85
Q

The IT function has declared that, when putting a new application into production, it is not necessary to update the business impact analysis (BIA) because it does not produce modifications in the business processes. The information security manager should:

A

verify the decision with the business units.

86
Q

A risk assessment study carried out by an organization noted that there is no segmentation of the local area network (LAN). Network segmentation would reduce the potential impact of which of the following?

A

Traffic sniffing

87
Q

The PRIMARY objective of an Internet usage policy is to prevent:

A

disruption of Internet access.

88
Q

An internal review of a web-based application system finds the ability to gain access to all employees’ accounts by changing the employee’s ID on the URL used for accessing the account. The vulnerability identified is:

A

broken authentication.

89
Q

A test plan to validate the security controls of a new system should be developed during which phase of the project?

A

Design

90
Q

The MOST effective way to ensure that outsourced service providers comply with the organization’s information security policy would be:

A

periodically auditing.

91
Q

In order to protect a network against unauthorized external connections to corporate systems, the information security manager should BEST implement:

A

a strong authentication.

92
Q

The PRIMARY driver to obtain external resources to execute the information security program is that external resources can:

A

contribute cost-effective expertise not available internally.

93
Q

Priority should be given to which of the following to ensure effective implementation of information security governance?

A

Planning

94
Q

The MAIN reason for deploying a public key infrastructure (PKI) when implementing an information security program is to:

A

provide a high assurance of identity.

95
Q

Which of the following controls would BEST prevent accidental system shutdown from the console or operations area?

A

Protective switch covers

96
Q

Which of the following is the MOST important reason why information security objectives should be defined?

A

Tool for measuring effectiveness

97
Q

What is the BEST policy for securing data on mobile universal serial bus (USB) drives?

A

Encryption

98
Q

When speaking to an organization’s human resources department about information security, an information security manager should focus on the need for:

A

security awareness training for employees.

99
Q

Which of the following would BEST protect an organization’s confidential data stored on a laptop computer from unauthorized access?

A

Encrypted hard drives

100
Q

What is the MOST important reason for conducting security awareness programs throughout an organization?

A

Reducing the human risk

101
Q

At what stage of the applications development process would encryption key management initially be addressed?

A

Requirements development

102
Q

The MOST effective way to ensure network users are aware of their responsibilities to comply with an organization’s security requirements is:

A

messages displayed at every logon.

103
Q

Which of the following would be the BEST defense against sniffing?

A

Encrypt the data being transmitted

104
Q

A digital signature using a public key infrastructure (PKI) will:

A

rely on the extent to which the certificate authority (CA) is trusted.

105
Q

When configuring a biometric access control system that protects a high-security data center, the system’s sensitivity level should be set:

A

to a higher false reject rate (FRR).

106
Q

Which of the following is the BEST method to securely transfer a message?

A

Using public key infrastructure (PKI) encryption

107
Q

Which of the following would be the FIRST step in establishing an information security program?

A

Develop the security plan.

108
Q

An organization has adopted a practice of regular staff rotation to minimize the risk of fraud and encourage cross-training. Which type of authorization policy would BEST address this practice?

A

Role-based

109
Q

Which of the following is the MOST important reason for an information security review of contracts?

A

appropriate controls are included.

110
Q

For virtual private network (VPN) access to the corporate network, the information security manager is requiring strong authentication. Which of the following is the strongest method to ensure that logging onto the network is secure?

A

Two-factor authentication

111
Q

Which of the following guarantees that data in a file have not changed?

A

Creating a hash of the file, then comparing the file hashes

112
Q

Which of the following mechanisms is the MOST secure way to implement a secure wireless network?

A

Use a Wi-Fi Protected Access (WPA2) protocol

113
Q

Which of the following devices could potentially stop a Structured Query Language (SQL) injection attack?

A

An intrusion prevention system (IPS)

114
Q

Nonrepudiation can BEST be ensured by using:

A

digital signatures.

CISM Study Questions C (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions