Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISM Study Questions C > CISM Practice C Topic 4 > Flashcards

CISM Practice C Topic 4 Flashcards

1
Q

The BEST way to ensure that security settings on each platform are in compliance with information security policies and procedures is to:

A

establish security baselines.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

A web-based business application is being migrated from test to production. Which of the following is the MOST important management signoff for this migration?

A

User

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

The BEST way to ensure that information security policies are followed is to:

A

perform periodic reviews for compliance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

The MOST appropriate individual to determine the level of information security needed for a specific business application is the:

A

system data owner.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Which of the following will MOST likely reduce the chances of an unauthorized individual gaining access to computing resources by pretending to be an authorized individual needing to have his or her password reset?

A

Conducting security awareness programs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Which of the following is the MOST likely to change an organization’s culture to one that is more security conscious?

A

Security awareness campaigns

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

The BEST way to ensure that an external service provider complies with organizational security policies is to:

A

Perform periodic reviews of the service provider.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

When an emergency security patch is received via electronic mail, the patch should FIRST be:

A

validated to ensure its authenticity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

In a well-controlled environment, which of the following activities is MOST likely to lead to the introduction of weaknesses in security software?

A

Changing access rules

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Which of the following is the BEST indicator that security awareness training has been effective?

A

More incidents are being reported

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Which of the following metrics would be the MOST useful in measuring how well information security is monitoring violation logs?

A

Penetration attempts investigated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Which of the following change management activities would be a clear indicator that normal operational procedures require examination?

A

emergency change requests.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Which of the following is the MOST important management signoff for migrating an order processing system from a test environment to a production environment?

A

User

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Prior to having a third party perform an attack and penetration test against an organization, the MOST important action is to ensure that:

A

goals and objectives are clearly defined.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

When a departmental system continues to be out of compliance with an information security policy’s password strength requirements, the BEST action to undertake is to:

A

conduct an impact analysis to quantify the risks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Which of the following is MOST important to the successful promotion of good security management practices?

A

Management support

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Which of the following environments represents the GREATEST risk to organizational security?

A

Locally managed file server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Nonrepudiation can BEST be assured by using:

A

digital signatures.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Of the following, the BEST method for ensuring that temporary employees do not receive excessive access rights is:

A

role-based access controls.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Which of the following areas is MOST susceptible to the introduction of security weaknesses?

A

Configuration management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Security policies should be aligned MOST closely with:

A

organizational needs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

The BEST way to determine if an anomaly-based intrusion detection system (IDS) is properly installed is to:

A

simulate an attack and review IDS performance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

The BEST time to perform a penetration test is after:

A

various infrastructure changes are made.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Successful social engineering attacks can BEST be prevented through:

A

periodic awareness training.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is the BEST way to ensure that an intruder who successfully penetrates a network will be detected before significant damage is inflicted?

A

Install a honeypot on the network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Which of the following presents the GREATEST threat to the security of an enterprise resource planning (ERP) system?

A

Operating system (OS) security patches have not been applied

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

In a social engineering scenario, which of the following will MOST likely reduce the likelihood of an unauthorized individual gaining access to computing resources?

A

Conducting periodic security awareness programs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Which of the following will BEST ensure that management takes ownership of the decision making process for information security?

A

Security-steering committees

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Which of the following is the MOST appropriate individual to implement and maintain the level of information security needed for a specific business application?

A

Process owner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is the BEST way to ensure that contract programmers comply with organizational security policies?

A

Perform periodic security reviews of the contractors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Which of the following activities is MOST likely to increase the difficulty of totally eradicating malicious code that is not immediately detected?

A

Backing up files

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Security awareness training should be provided to new employees:

A

before they have access to data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What is the BEST method to verify that all security patches applied to servers were properly documented?

A

Trace OS patch logs to change control requests

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

A security awareness program should:

A

address specific groups and roles.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

The PRIMARY objective of security awareness is to:

A

influence employee behavior.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Which of the following will BEST protect against malicious activity by a former employee?

A

Effective termination procedures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Which of the following represents a PRIMARY area of interest when conducting a penetration test?

A

Network mapping

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

The return on investment of information security can BEST be evaluated through which of the following?

A

Support of business objectives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

To help ensure that contract personnel do not obtain unauthorized access to sensitive information, an information security manager should PRIMARILY:

A

avoid granting system administration roles.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Information security policies should:

A

be straightforward and easy to understand.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Which of the following is the BEST way to ensure that a corporate network is adequately secured against external attack?

A

Perform periodic penetration testing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Which of the following presents the GREATEST exposure to internal attack on a network?

A

User passwords are encoded but not encrypted

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Which of the following provides the linkage to ensure that procedures are correctly aligned with information security policy requirements?

A

Standards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Which of the following are the MOST important individuals to include as members of an information security steering committee?

A

IT management and key business process owners

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Security audit reviews should PRIMARILY:

A

ensure that controls operate as required.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Which of the following is the MOST appropriate method to protect a password that opens a confidential file?

A

Out-of-band channels

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What is the MOST effective access control method to prevent users from sharing files with unauthorized users?

A

Mandatory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Which of the following is an inherent weakness of signature-based intrusion detection systems?

A

New attack methods will be missed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Data owners are normally responsible for which of the following?

A

Determining the level of application security required

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Which of the following is the MOST appropriate individual to ensure that new exposures have not been introduced into an existing application during the change management process?

A

System user

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

What is the BEST way to ensure users comply with organizational security requirements for password complexity?

A

Enable system-enforced password configuration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Which of the following is the MOST appropriate method for deploying operating system (OS) patches to production application servers?

A

Initially load the patches on a test machine

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Which of the following would present the GREATEST risk to information security?

A

Security incidents are investigated within five business days

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

The PRIMARY reason for using metrics to evaluate information security is to:

A

enable steady improvement.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

What is the BEST method to confirm that all firewall rules and router configuration settings are adequate?

A

Periodically perform penetration tests

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Which of the following is MOST important for measuring the effectiveness of a security awareness program?

A

A quantitative evaluation to ensure user comprehension

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Which of the following is the MOST important action to take when engaging third-party consultants to conduct an attack and penetration test?

A

Establish clear rules of engagement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Which of the following will BEST prevent an employee from using a USB drive to copy files from desktop computers?

A

Restrict the available drive allocation on all PCs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

Which of the following is the MOST important area of focus when examining potential security compromise of a new wireless network?

A

Number of administrators

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

Good information security standards should:

A

define precise and unambiguous allowable limits.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

Good information security procedures should:

A

be updated frequently as new software is released.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

What is the MAIN drawback of e-mailing password-protected zip files across the Internet?

A

may be quarantined by mail filters.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

A major trading partner with access to the internal network is unwilling or unable to remediate serious information security exposures within its environment. Which of the following is the BEST recommendation?

A

Set up firewall rules restricting network traffic from that location

64
Q

Documented standards/procedures for the use of cryptography across the enterprise should PRIMARILY:

A

define the circumstances where cryptography should be used.

65
Q

Which of the following is the MOST immediate consequence of failing to tune a newly installed intrusion detection system (IDS) with the threshold set to a low value?

A

The number of false positives increases

66
Q

What is the MOST appropriate change management procedure for the handling of emergency program changes?

A

Documentation is completed with approval soon after the change

67
Q

Who is ultimately responsible for ensuring that information is categorized and that protective measures are taken?

A

Security steering committee

68
Q

The PRIMARY focus of the change control process is to ensure that changes are:

A

authorized

69
Q

An information security manager has been asked to develop a change control process. What is the FIRST thing the information security manager should do?

A

Meet with stakeholders

70
Q

A critical device is delivered with a single user and password that is required to be shared for multiple users to access the device. An information security manager has been tasked with ensuring all access to the device is authorized. Which of the following would be the MOST efficient means to accomplish this?

A

Enable access through a separate device that requires adequate authentication

71
Q

Which of the following documents would be the BEST reference to determine whether access control mechanisms are appropriate for a critical application?

A

IT security policy

72
Q

Which of the following is the MOST important process that an information security manager needs to negotiate with an outsource service provider?

A

The right to conduct independent security reviews

73
Q

Which resource is the MOST effective in preventing physical access tailgating/piggybacking?

A

Awareness training

74
Q

In business critical applications, where shared access to elevated privileges by a small group is necessary, the BEST approach to implement adequate segregation of duties is to:

A

implement role-based access control in the application.

75
Q

In business-critical applications, user access should be approved by the:

A

data owner.

76
Q

In organizations where availability is a primary concern, the MOST critical success factor of the patch management procedure would be the:

A

testing time window prior to deployment.

77
Q

To ensure that all information security procedures are functional and accurate, they should be designed with the involvement of:

A

operational units.

78
Q

An information security manager reviewed the access control lists and observed that privileged access was granted to an entire department. Which of the following should the information security manager do FIRST?

A

Meet with data owners to understand business needs

79
Q

When security policies are strictly enforced, the initial impact is that:

A

the total cost of security is increased.

80
Q

A business partner of a factory has remote read-only access to material inventory to forecast future acquisition orders. An information security manager should PRIMARILY ensure that there is:

A

an effective control over connectivity and continuity.

81
Q

Which of the following should be in place before a black box penetration test begins?

A

A clearly stated definition of scope

82
Q

What is the MOST important element to include when developing user security awareness material?

A

Easy-to-read and compelling information

83
Q

What is the MOST important success factor in launching a corporate information security awareness program?

A

Top-down approach

84
Q

Which of the following events generally has the highest information security impact?

A

Merging with another organization

85
Q

The configuration management plan should PRIMARILY be based upon input from:

A

IT senior management.

86
Q

Which of the following is the MOST effective, positive method to promote security awareness?

A

Competitions and rewards for compliance

87
Q

An information security program should focus on:

A

key controls identified in risk assessments.

88
Q

Who should determine the appropriate classification of accounting ledger data located on a database server and maintained by a database administrator in the IT department?

A

Finance department management

89
Q

Which of the following would be the MOST significant security risk in a pharmaceutical institution?

A

Theft of a Research and Development laptop

90
Q

Which of the following is the BEST tool to maintain the currency and coverage of an information security program within an organization?

A

The program’s governance oversight mechanisms

91
Q

Which of the following would BEST assist an information security manager in measuring the existing level of development of security processes against their desired state?

A

Capability maturity model (CMM)

92
Q

Who is responsible for raising awareness of the need for adequate funding for risk action plans?

A

Information security manager

93
Q

Managing the life cycle of a digital certificate is a role of a(n):

A

independent trusted source.

94
Q

Which of the following would be MOST critical to the successful implementation of a biometric authentication system?

A

User acceptance

95
Q

Change management procedures to ensure that disaster recovery/business continuity plans are kept up-to-date can be BEST achieved through which of the following?

A

Inclusion as a required step in the system life cycle process

96
Q

When a new key business application goes into production, the PRIMARY reason to update relevant business impact analysis (BIA) and business continuity/disaster recovery plans is because:

A

service level agreements may not otherwise be met.

97
Q

To reduce the possibility of service interruptions, an entity enters into contracts with multiple Internet service providers (ISPs). Which of the following would be the MOST important item to include?

A

Service level agreements (SLAs)

98
Q

To mitigate a situation where one of the programmers of an application requires access to production data, the information security manager could BEST recommend to:

A

log all of the programmers’ activity for review by supervisor.

99
Q

Before engaging outsourced providers, an information security manager should ensure that the organization’s data classification requirements:

A

are stated in the contract.

100
Q

What is the GREATEST risk when there is an excessive number of firewall rules?

A

One rule may override another rule in the chain and create a loophole

101
Q

Which of the following would be the MOST appropriate physical security solution for the main entrance to a data center?

A

Biometric lock

102
Q

What is the GREATEST advantage of documented guidelines and operating procedures from a security perspective?

A

Ensure consistency of activities to provide a more stable environment

103
Q

What is the BEST way to ensure data protection upon termination of employment?

A

Ensure all logical access is removed

104
Q

The MOST important reason for formally documenting security procedures is to ensure:

A

processes are repeatable and sustainable.

105
Q

Which of the following is the BEST approach for an organization desiring to protect its intellectualproperty?

A

Restrict access to a need-to-know basis

106
Q

The “separation of duties” principle is violated if which of the following individuals has update rights to the database access control list (ACL)?

A

Systems programmer

107
Q

An account with full administrative privileges over a production file is found to be accessible by a member of the software development team. This account was set up to allow the developer to download non-sensitive production data for software testing purposes. The information security manager should recommend which of the following?

A

Restrict account access to read only

108
Q

Which would be the BEST recommendation to protect against phishing attacks?

A

Publish security guidance for customers

109
Q

Which of the following is the BEST indicator that an effective security control is built into an organization?

A

The monthly service level statistics indicate a minimal impact from security issues.

110
Q

What is the BEST way to alleviate security team understaffing while retaining the capability inhouse?

A

Establish a virtual security team from competent employees across the company

111
Q

An information security manager wishing to establish security baselines would:

A

implement the security baselines to establish information security best practices.

112
Q

Requiring all employees and contractors to meet personnel security/suitability requirements commensurate with their position sensitivity level and subject to personnel screening is an example of a security:

A

policy.

113
Q

An organization’s information security manager has been asked to hire a consultant to help assess the maturity level of the organization’s information security management. The MOST important element of the request for proposal (RFP) is the:

A

methodology used in the assessment.

114
Q

Several business units reported problems with their systems after multiple security patches were deployed. The FIRST step in handling this problem would be to:

A

assess the problems and institute rollback procedures, if needed.

115
Q

When defining a service level agreement (SLA) regarding the level of data confidentiality that is handled by a third-party service provider, the BEST indicator of compliance would be the:

A

access control matrix.

116
Q

The PRIMARY reason for involving information security at each stage in the systems development life cycle (SDLC) is to identify the security implications and potential solutions required for:

A

sustaining the organization’s security posture.It is important to maintain the organization’s security posture at all times. The focus should not be confined to the new system being developed or acquired, or to the existing systems in use. Segregation of duties is only part of a solution to improving the security of the systems, not the primary reason to involve security in the systems development life cycle (SDLC)

117
Q

The implementation of continuous monitoring controls is the BEST option where:

A

incidents may have a high impact and frequency

118
Q

A third party was engaged to develop a business application. Which of the following would an information security manager BEST test for the existence of back doors?

A

Security code reviews for the entire application

119
Q

An information security manager reviewing firewall rules will be MOST concerned if the firewall allows:

A

source routing.

120
Q

What is the MOST cost-effective means of improving security awareness of staff personnel?

A

User education and training

121
Q

Which of the following is the MOST effective at preventing an unauthorized individual from following an authorized person through a secured entrance (tailgating or piggybacking)?

A

Awareness training

122
Q

Data owners will determine what access and authorizations users will have by:

A

mapping to business needs.

123
Q

Which of the following is the MOST likely outcome of a well-designed information security awareness course?

A

Increased reporting of security incidents to the incident response function

124
Q

Which item would be the BEST to include in the information security awareness training program for new general staff employees?

A

Review of various security models

125
Q

A critical component of a continuous improvement program for information security is:

A

measuring processes and providing feedback.

126
Q

The management staff of an organization that does not have a dedicated security function decides to use its IT manager to perform a security review. The MAIN job requirement in this arrangement is that the IT manager:

A

report significant security risks.

127
Q

An organization has implemented an enterprise resource planning (ERP) system used by 500 employees from various departments. Which of the following access control approaches is MOST appropriate?

A

Role-based

128
Q

An organization plans to contract with an outside service provider to host its corporate web site. The MOST important concern for the information security manager is to ensure that:

A

the contract should mandate that the service provider will comply with security policies.

129
Q

Which of the following is the MAIN objective in contracting with an external company to perform penetration testing?

A

To receive an independent view of security exposures

130
Q

A new port needs to be opened in a perimeter firewall. Which of the following should be the FIRST step before initiating any changes?

A

Prepare an impact assessment report.

131
Q

An organization plans to outsource its customer relationship management (CRM) to a third-party service provider. Which of the following should the organization do FIRST?

A

Perform an internal risk assessment to determine needed controls.

132
Q

Which of the following would raise security awareness among an organization’s employees?

A

Continually reinforcing the security policy

133
Q

Which of the following is the MOST appropriate method of ensuring password strength in a large organization?

A

Review general security settings on each platform

134
Q

What is the MOST cost-effective method of identifying new vendor vulnerabilities?

A

External vulnerability reporting sources

135
Q

Which of the following is the BEST approach for improving information security management processes?

A

Define and monitor security metrics.

136
Q

An effective way of protecting applications against Structured Query Language (SQL) injection vulnerability is to:

A

validate and sanitize client side inputs.

137
Q

The root cause of a successful cross site request forgery (XSRF) attack against an application is that the vulnerable application:

A

has implemented cookies as the sole authentication mechanism.

138
Q

Of the following, retention of business records should be PRIMARILY based on:

A

regulatory and legal requirements.

139
Q

An organization is entering into an agreement with a new business partner to conduct customer mailings. What is the MOST important action that the information security manager needs to perform?

A

Ensuring that the third party is contractually obligated to all relevant security requirements

140
Q

An organization that outsourced its payroll processing performed an independent assessment of the security controls of the third party, per policy requirements. Which of the following is the MOST useful requirement to include in the contract?

A

Right to audit

141
Q

Which of the following is the MOST critical activity to ensure the ongoing security of outsourced IT services?

A

Conduct regular security reviews of the third-party provider

142
Q

An organization’s operations staff places payment files in a shared network folder and then the disbursement staff picks up the files for payment processing. This manual intervention will be automated some months later, thus cost-efficient controls are sought to protect against file alterations. Which of the following would be the BEST solution?

A

Set role-based access permissions on the shared folder

143
Q

Which of the following BEST ensures that security risks will be reevaluated when modifications in application developments are made?

A

A change control process

144
Q

Which is the BEST way to measure and prioritize aggregate risk deriving from a chain of linked system vulnerabilities?

A

Penetration tests

145
Q

In which of the following system development life cycle (SDLC) phases are access control and encryption algorithms chosen?

A

System design specifications

146
Q

Which of the following is generally considered a fundamental component of an information security program?

A

Security awareness training

147
Q

How would an organization know if its new information security program is accomplishing its goals?

A

Key metrics indicate a reduction in incident impacts.ing program, but are not as significant as the key metrics indicator. An immediate reduction in reported incidents, in contrast, may indicate that it is not successful.

148
Q

A benefit of using a full disclosure (white box) approach as compared to a blind (black box) approach to penetration testing is that:

A

less time is spent on reconnaissance and information gathering.

149
Q

Which of the following is the BEST method to reduce the number of incidents of employees forwarding spam and chain e-mail messages?

A

User awareness training

150
Q

Which of the following is the BEST approach to mitigate online brute-force attacks on user accounts?

A

Implementation of lock-out policies

151
Q

Which of the following measures is the MOST effective deterrent against disgruntled stall abusing their privileges?

A

Signed acceptable use policy

152
Q

The advantage of sending messages using steganographic techniques, as opposed to utilizing encryption, is that:

A

the existence of messages is unknown.

153
Q

As an organization grows, exceptions to information security policies that were not originally specified may become necessary at a later date. In order to ensure effective management of business risks, exceptions to such policies should be:

A

formally managed within the information security framework.

154
Q

There is reason to believe that a recently modified web application has allowed unauthorized access. Which is the BEST way to identify an application backdoor?

A

Source code review

155
Q

Simple Network Management Protocol v2 (SNMP v2) is used frequently to monitor networks. Which of the following vulnerabilities does it always introduce?

A

Clear text authentication

156
Q

Which of the following is the FIRST phase in which security should be addressed in the development cycle of a project?

A

Feasibility

CISM Study Questions C (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions