[Apr-2023] CISM Pre-Exam Practice Tests | Exam Questions and Answers for Isaca Certification Study Guide
Certified Information Security Manager Certification Sample Questions
NEW QUESTION # 125
Which of the following is the MOST important reason to develop an organizational threat profile?
- A. To support risk treatment decisions
- B. To implement a proactive approach for threat management
- C. To support business cases for information security investments
- D. To develop threat briefings for senior management
Answer: A
NEW QUESTION # 126
Which of the following is the MOST important item to consider when evaluating products to monitor security across the enterprise?
- A. Available support
- B. Ease of installation
- C. Product documentation
- D. System overhead
Answer: D
Explanation:
Explanation/Reference:
Explanation:
Monitoring products can impose a significant impact ON system overhead for servers and networks.
Product documentation, telephone support and ease of installation, while all important, would be secondary.
NEW QUESTION # 127
The PRIMARY reason for involving information security at each stage in the systems development life cycle (SDLC) is to identify the security implications and potential solutions required for:
- A. sustaining the organization's security posture.
- B. identifying vulnerabilities in the system.
- C. the existing systems that will be affected.
- D. complying with segregation of duties.
Answer: A
Explanation:
Explanation/Reference:
Explanation:
It is important to maintain the organization's security posture at all times. The focus should not be confined to the new system being developed or acquired, or to the existing systems in use. Segregation of duties is only part of a solution to improving the security of the systems, not the primary reason to involve security in the systems development life cycle (SDLC).
NEW QUESTION # 128
When conducting a post-incident review, the GREATEST benefit of collecting mean time to resolution (MTTR) data is the ability to:
- A. reduce the costs of future preventive controls.
- B. provide metrics for reporting to senior management
- C. learn of potential areas cf improvement
- D. verify compliance with the service level agreement (SLA).
Answer: D
NEW QUESTION # 129
The security responsibility of data custodians in an organization will include:
- A. ensuring security measures are consistent with policy.
- B. implementing security controls in products they install.
- C. determining data classification levels.
- D. assuming overall protection of information assets.
Answer: A
Explanation:
Explanation
Security responsibilities of data custodians within an organization include ensuring that appropriate security measures are maintained and are consistent with organizational policy. Executive management holds overall responsibility for protection of the information assets. Data owners determine data classification levels for information assets so that appropriate levels of controls can be provided to meet the requirements relating to confidentiality, integrity and availability. Implementation of information security in products is the responsibility of the IT developers.
NEW QUESTION # 130
Which of the following is the MOST important item to include when developing web hosting agreements with third-party providers?
- A. Privacy restrictions
- B. Termination conditions
- C. Liability limits
- D. Service levels
Answer: D
Explanation:
Explanation
Service levels are key to holding third parties accountable for adequate delivery of services. This is more important than termination conditions, privacy restrictions or liability limitations.
NEW QUESTION # 131
Which of the following BEST provides message integrity, sender identity authentication and nonrepudiation?
- A. Public key infrastructure (PKI)
- B. Message hashing
- C. Message authentication code
- D. Symmetric cryptography
Answer: A
Explanation:
Public key infrastructure (PKI) combines public key encryption with a trusted third party to publish and revoke digital certificates that contain the public key of the sender. Senders can digitally sign a message with their private key and attach their digital certificate (provided by the trusted third party). These characteristics allow senders to provide authentication, integrity validation and nonrepudiation. Symmetric cryptography provides confidentiality. Mashing can provide integrity and confidentiality. Message authentication codes provide integrity.
NEW QUESTION # 132
Which of the following is a potential indicator of inappropriate Internet use by staff?
- A. Increased number of weaknesses from vulnerability scans
- B. Increased help desk calls for password resets
- C. Reduced number of pings on firewalls
- D. Increased reports of slow system performance
Answer: D
NEW QUESTION # 133
The impact of losing frame relay network connectivity for 18-24 hours should be calculated using the:
- A. financial losses incurred by affected business units.
- B. aggregate compensation of all affected business users.
- C. hourly billing rate charged by the carrier.
- D. value of the data transmitted over the network.
Answer: A
Explanation:
Section: INFORMATION RISK MANAGEMENT
Explanation:
The bottom line on calculating the impact of a loss is what its cost will be to the organization. The other choices are all factors that contribute to the overall monetary impact.
NEW QUESTION # 134
An information security manager discovers that the organization's new information security policy is not being followed across all departments. Which of the following should be of GREATEST concern to the information security manager?
- A. The wording of the policy is not tailored to the audience.
- B. Business unit management has not emphasized the importance of the new policy.
- C. The corresponding controls are viewed as prohibitive to business operations.
- D. Different communication methods may be required for each business unit.
Answer: C
Explanation:
Section: INFORMATION SECURITY GOVERNANCE
NEW QUESTION # 135
An information security manager determines there are a significant number of exceptions to a newly released industry-required security standard. Which of the following should be done NEXT?
- A. Document risk acceptances.
- B. Assess the consequences of noncompliance.
- C. Revise the organization's security policy.
- D. Conduct an information security audit.
Answer: B
NEW QUESTION # 136
Which of the following is the STRONGEST indicator of effective alignment between corporate governance and information security governance?
- A. Information security initiatives meet scope, schedule, and budget.
- B. Senior management requests periodic information security updates.
- C. Senior management sponsors information security efforts.
- D. Key performance indicators (KPIs) for controls trend positively.
Answer: C
NEW QUESTION # 137
When determining an acceptable risk level, which of the following is the MOST important consideration?
- A. Risk matrices
- B. Threat profile
- C. Vulnerability scores
- D. System criticality
Answer: A
NEW QUESTION # 138
Who should be responsible for determining the classification of data within a database used in conjunction with an enterprise application?
- A. Database architect
- B. Database administrator
- C. Information security manager
- D. Data owner
Answer: D
NEW QUESTION # 139
Which of the following authentication methods prevents authentication replay?
- A. HTTP Basic Authentication
- B. Password hash implementation
- C. Challenge/response mechanism
- D. Wired Equivalent Privacy (WEP) encryption usage
Answer: C
Explanation:
A challenge response mechanism prevents replay attacks by sending a different random challenge in each authentication event. The response is linked to that challenge. Therefore, capturing the authentication handshake and replaying it through the network will not work. Using hashes by itself will not prevent a replay. A WEP key will not prevent sniffing (it just takes a few more minutes to break the WEP key if the attacker does not already have it) and therefore will not be able to prevent recording and replaying an authentication handshake. HTTP Basic Authentication is clear text and has no mechanisms to prevent replay.
NEW QUESTION # 140
When an information security manager is developing a strategic plan for information security, the timeline for the plan should be:
- A. based on the current rate of technological change.
- B. aligned with the business strategy.
- C. three-to-five years for both hardware and software.
- D. aligned with the IT strategic plan.
Answer: B
Explanation:
Explanation/Reference:
Explanation:
Any planning for information security should be properly aligned with the needs of the business.
Technology should not come before the needs of the business, nor should planning be done on an artificial timetable that ignores business needs.
NEW QUESTION # 141
Which of the following BEST provides message integrity, sender identity authentication and nonrepudiation?
- A. Public key infrastructure (PKI)
- B. Message hashing
- C. Message authentication code
- D. Symmetric cryptography
Answer: A
Explanation:
Section: INFORMATION SECURITY PROGRAM DEVELOPMENT
Explanation:
Public key infrastructure (PKI) combines public key encryption with a trusted third party to publish and revoke digital certificates that contain the public key of the sender. Senders can digitally sign a message with their private key and attach their digital certificate (provided by the trusted third party). These characteristics allow senders to provide authentication, integrity validation and nonrepudiation. Symmetric cryptography provides confidentiality. Mashing can provide integrity and confidentiality. Message authentication codes provide integrity.
NEW QUESTION # 142
Which of the following is the MOST effective solution for preventing internal users from modifying sensitive and classified information?
- A. Exit routines
- B. Baseline security standards
- C. Role-based access controls
- D. System access violation logs
Answer: C
Explanation:
Section: INFORMATION SECURITY PROGRAM DEVELOPMENT
Explanation:
Role-based access controls help ensure that users only have access to files and systems appropriate for their job role. Violation logs are detective and do not prevent unauthorized access. Baseline security standards do not prevent unauthorized access. Exit routines are dependent upon appropriate role-based access.
NEW QUESTION # 143
Which of the following is the PRIMARY reason for implementing a risk management program?
- A. Satisfies audit and regulatory requirements
- B. Allows the organization to eliminate risk
- C. Is a necessary part of management's due diligence
- D. Assists in incrementing the return on investment (ROD
Answer: C
Explanation:
The key reason for performing risk management is that it is part of management's due diligence. The elimination of all risk is not possible. Satisfying audit and regulatory requirements is of secondary importance. A risk management program may or may not increase the return on investment (ROD.
NEW QUESTION # 144
......
ISACA Exam Practice Test To Gain Brilliante Result: https://passcollection.actual4labs.com/ISACA/CISM-actual-exam-dumps.html