100% Pass Your CISM Exam Dumps at First Attempt with BootcampPDF
Penetration testers simulate CISM exam PDF
NEW QUESTION 201
When the computer incident response team (CIRT) finds clear evidence that a hacker has penetrated the corporate network and modified customer information, an information security manager should FIRST notify:
- A. the information security steering committee.
- B. data owners who may be impacted.
- C. customers who may be impacted.
- D. regulatory- agencies overseeing privacy.
Answer: B
Explanation:
The data owners should be notified first so they can take steps to determine the extent of the damage and coordinate a plan for corrective action with the computer incident response team. Other parties will be notified later as required by corporate policy and regulatory requirements.
NEW QUESTION 202
An information security manager has been asked to integrate security into the software development life cycle (SDLC) after requirements have already been gathered. In this situation during which phase would integration be MOST effectrve?
- A. Code review
- B. Quality assurance analysis
- C. Penetration testing
- D. User acceptance testing
Answer: B
NEW QUESTION 203
Which of the following if the MOST significant advantage of developing a well-defined information security strategy?
- A. Support for buy-in from organizational employees
- B. Prevention of deviations from risk tolerance thresholds
- C. Allocation of resources to highest priorities
- D. Increased maturity of incident response processes
Answer: B
Explanation:
Section: INFORMATION SECURITY PROGRAM DEVELOPMENT
NEW QUESTION 204
Which of the following is the BEST justification to convince management to invest in an information security program?
- A. Increased business value
- B. Compliance with company policies
- C. Protection of business assets
- D. Cost reduction
Answer: A
Explanation:
Investing in an information security program should increase business value and confidence. Cost reduction by itself is rarely the motivator for implementing an information security program. Compliance is secondary to business value. Increasing business value may include protection of business assets.
NEW QUESTION 205
An information security manager has discovered that a business unit is planning on implementing a new application and has not engaged anyone from the information security department. Which of the following is the BEST course of action?
- A. Review and update the change management process.
- B. Discuss the issue with senior leadership.
- C. Recommend involvement with the change manager.
- D. Block the application from going into production.
Answer: B
NEW QUESTION 206
Which of the following will BEST protect an organization from internal security attacks?
- A. Employee awareness certification program
- B. Internal address translation
- C. Static IP addressing
- D. Prospective employee background checks
Answer: D
Explanation:
Explanation
Because past performance is a strong predictor of future performance, background checks of prospective employees best prevents attacks from originating within an organization. Static IP addressing does little to prevent an internal attack. Internal address translation using non-routable addresses is useful against external attacks but not against internal attacks. Employees who certify that they have read security policies are desirable, but this does not guarantee that the employees behave honestly.
NEW QUESTION 207
How would an organization know if its new information security program is accomplishing its goals?
- A. Key metrics indicate a reduction in incident impacts.
- B. Senior management has approved the program and is supportive of it.
- C. There is an immediate reduction in reported incidents.
- D. Employees are receptive to changes that were implemented.
Answer: A
Explanation:
Explanation/Reference:
Explanation:
Option A is correct since an effective security program will show a trend in impact reduction. Options B and C may well derive from a performing program, but are not as significant as option A.
Option D may indicate that it is not successful.
NEW QUESTION 208
Which of the following is the MOST important consideration when designing information security architecture?
- A. The information security architecture is aligned with industry standards.
- B. Risk management parameters for the organization are defined.
- C. The existing threat landscape is monitored.
- D. The level of security supported is based on business decisions.
Answer: D
Explanation:
Section: INFORMATION SECURITY PROGRAM DEVELOPMENT
NEW QUESTION 209
Which of the following represents a PRIMARY area of interest when conducting a penetration test?
- A. Customer data
- B. Network mapping
- C. Data mining
- D. Intrusion Detection System (IDS)
Answer: B
Explanation:
Explanation
Network mapping is the process of determining the topology of the network one wishes to penetrate. This is one of the first steps toward determining points of attack in a network. Data mining is associated with ad hoc reporting and. together with customer data, they are potential targets after the network is penetrated. The intrusion detection mechanism in place is not an area of focus because one of the objectives is to determine how effectively it protects the network or how easy it is to circumvent.
NEW QUESTION 210
Which of the following should be the PRIMARY consideration for an information security manager when designing security conter for a newly acquired business application?
- A. The IT security architecture framework
- B. Known vulnerabilities in the application
- C. Cost-benefit analysis of current controls
- D. Business processes supported by the application
Answer: B
NEW QUESTION 211
Of the following, retention of business records should be PRIMARILY based on:
- A. past litigation.
- B. regulatory and legal requirements.
- C. periodic vulnerability assessment.
- D. device storage capacity and longevity.
Answer: B
Explanation:
Section: INFORMATION SECURITY PROGRAM MANAGEMENT
Explanation:
Retention of business records is a business requirement that must consider regulatory and legal requirements based on geographic location and industry. Options A and C are important elements for making the decision, but the primary driver is the legal and regulatory requirements that need to be followed by all companies. Record retention may take into consideration past litigation, but it should not be the primary decision factor.
NEW QUESTION 212
Based on the information provided, which of the following situations presents the GREATEST information security risk for an organization with multiple, but small, domestic processing locations?
- A. Change management procedures are poor
- B. Systems capacity management is not performed
- C. Systems operation procedures are not enforced
- D. Systems development is outsourced
Answer: A
Explanation:
Explanation/Reference:
Explanation:
The lack of change management is a severe omission and will greatly increase information security risk.
Since procedures are generally nonauthoritative, their lack of enforcement is not a primary concern.
Systems that are developed by third-party vendors are becoming commonplace and do not represent an increase in security risk as much as poor change management. Poor capacity management may not necessarily represent a security risk.
NEW QUESTION 213
Which of the following is the GREATEST benefit of integrating a security information and event management (SIEM) solution with traditional security tools such as IDS, anti-malware. and email screening solutions?
- A. The consolidation of tools into a single console
- B. The elimination of false positive detections
- C. A reduction in operational costs
- D. An increase in visibility into patterns of potential threats
Answer: D
NEW QUESTION 214
Which of the following should an information security manager establish FIRST to ensure security-related activities are adequately monitored?
- A. Internal reporting channels
- B. Scheduled security assessments
- C. Regular reviews of computer system logs
- D. Accountability for security functions
Answer: A
Explanation:
Section: INFORMATION SECURITY PROGRAM DEVELOPMENT
NEW QUESTION 215
What is the MOS T cost-effective means of improving security awareness of staff personnel?
- A. User education and training
- B. Reporting of security infractions
- C. A zero-tolerance security policy
- D. Employee monetary incentives
Answer: A
Explanation:
User education and training is the most cost-effective means of influencing staff to improve security since personnel are the weakest link in security. Incentives perform poorly without user education and training. A zero-tolerance security policy would not be as good as education and training. Users would not have the knowledge to accurately interpret and report violations without user education and training.
NEW QUESTION 216
An organization has a process in place that involves the use of a vendor. A risk assessment was completed during the development of the process. A year after the implementation a monetary decision has been made to use a different vendor. What, if anything, should occur?
- A. Nothing, since a risk assessment was completed during development.
- B. A vulnerability assessment should be conducted.
- C. A new risk assessment should be performed.
- D. The new vendor's SAS 70 type II report should be reviewed.
Answer: C
Explanation:
The risk assessment process is continual and any changes to an established process should include a new- risk assessment. While a review of the SAS 70 report and a vulnerability assessment may be components of a risk assessment, neither would constitute sufficient due diligence on its own.
Topic 3, INFORMATION SECURITY PROGRAM DEVELOPMENT
NEW QUESTION 217
An organization wants to ensure its confidential data is isolated in a multi-tenanted environment at a well- known cloud service provider. Which of the following is the BEST way to ensure the data is adequately protected?
- A. Obtain documentation of the encryption management practices.
- B. Verify the provider follows a cloud service framework standard.
- C. Review the provider's information security policies and procedures.
- D. Ensure an audit of the provider is conducted to identify control gaps.
Answer: B
Explanation:
Section: INFORMATION SECURITY PROGRAM MANAGEMENT
NEW QUESTION 218
Which of the following is the BEST
- A. Provisioning users to access the operating system
- B. Logging unauthorized access to the operating system
- C. Managing user profiles for accessing the operating system
- D. Approving standards for accessing the operating system
Answer: C
NEW QUESTION 219
Senior management commitment and support for information security will BEST be attained by an information security manager by emphasizing:
- A. organizational risk.
- B. the responsibilities of organizational units.
- C. security needs.
- D. organization wide metrics.
Answer: A
Explanation:
Explanation/Reference:
Explanation:
Information security exists to help the organization meet its objectives. The information security manager should identify information security needs based on organizational needs. Organizational or business risk should always take precedence. Involving each organizational unit in information security and establishing metrics to measure success will be viewed favorably by senior management after the overall organizational risk is identified.
NEW QUESTION 220
Which of the following is the PRIMARY goal of an incident response team during a security incident?
- A. Ensure the attackers are detected and stopped.
- B. Shut down the affected systems to limit the business impact.
- C. Maintain a documented chain of evidence.
- D. Minimize disruption to business-critical operations.
Answer: D
NEW QUESTION 221
Within a security governance framework, which of the following is the MOST important characteristic of the information security committee? The committee:
- A. has established relationships with external professionals
- B. has a clearly defined charter and meeting protocols
- C. includes a mix of members from all levels of management
- D. conducts frequent reviews of the security policy
Answer: C
Explanation:
Section: INFORMATION SECURITY GOVERNANCE
NEW QUESTION 222
Which of the following BEST promotes stakeholder accountability in the management of information security risks?
- A. Regular reviews for noncompliance
- B. Establishment of information ownership
- C. Establishment of security baselines
- D. Targeted security procedures
Answer: B
Explanation:
Section: INFORMATION RISK MANAGEMENT
Explanation/Reference:
NEW QUESTION 223
Logging is an example of which type of defense against systems compromise?
- A. Reaction
- B. Detection
- C. Containment
- D. Recovery
Answer: B
Explanation:
Explanation
Detection defenses include logging as well as monitoring, measuring, auditing, detecting viruses and intrusion.
Examples of containment defenses are awareness, training and physical security defenses. Examples of reaction defenses are incident response, policy and procedure change, and control enhancement. Examples of recovery defenses are backups and restorations, failover and remote sites, and business continuity plans and disaster recovery plans.
NEW QUESTION 224
What is the GREATEST risk when there is an excessive number of firewall rules?
- A. Performance degradation of the whole network
- B. The firewall may show abnormal behavior and may crash or automatically shut down
- C. The firewall may not support the increasing number of rules due to limitations
- D. One rule may override another rule in the chain and create a loophole
Answer: D
Explanation:
Section: INFORMATION SECURITY PROGRAM MANAGEMENT
Explanation:
If there are many firewall rules, there is a chance that a particular rule may allow an external connection although other associated rules are overridden. Due to the increasing number of rules, it becomes complex to test them and. over time, a loophole may occur.
NEW QUESTION 225
An information security manager wants to justify the Investment required to integrate information security into business processes. What should be the FIRST course of action?
- A. Develop an information security policy
- B. Benchmark against peer organizations.
- C. Prepare a security budget including necessary changes.
- D. Conduct a risk assessment
Answer: D
NEW QUESTION 226
......
All CISM Dumps and Training Courses: https://www.bootcamppdf.com/CISM_exam-dumps.html
Help candidates to study and pass the Certified Information Security Manager Exams hassle-free: https://drive.google.com/open?id=1ADEsCuNju9yccjhqY5sIZTJKnn8eCAfS