Tag: CHOICES

CISM Certified Information Security Manager – Question1069

Which of the following provides the linkage to ensure that procedures are correctly aligned with information security policy requirements?

A. Standards
B. Guidelines
C. Security metrics
D. IT governance

Correct Answer: A

Explanation:

Explanation:
Standards are the bridge between high-level policy statements and the “how to” detailed formal of procedures. Security metrics and governance would not ensure correct alignment between policies and procedures. Similarly, guidelines are not linkage documents but rather provide suggested guidance on best practices.

CISM Certified Information Security Manager – Question1068

Which of the following presents the GREATEST exposure to internal attack on a network?

A. User passwords are not automatically expired
B. All network traffic goes through a single switch
C. User passwords are encoded but not encrypted
D. All users reside on a single internal subnet

Correct Answer: C

Explanation:

Explanation:
When passwords are sent over the internal network in an encoded format, they can easily be converted to clear text. All passwords should be encrypted to provide adequate security. Not automatically expiring user passwords does create an exposure, but not as great as having unencrypted passwords. Using a single switch or subnet does not present a significant exposure.

CISM Certified Information Security Manager – Question1067

Which of the following is the BEST way to ensure that a corporate network is adequately secured against external attack?

A. Utilize an intrusion detection system.
B. Establish minimum security baselines.
C. Implement vendor recommended settings.
D. Perform periodic penetration testing.

Correct Answer: D

Explanation:

Explanation:
Penetration testing is the best way to assure that perimeter security is adequate. An intrusion detection system (IDS) may detect an attempted attack, hut it will not confirm whether the perimeter is secured. Minimum security baselines and applying vendor recommended settings are beneficial, but they will not provide the level of assurance that is provided by penetration testing.

CISM Certified Information Security Manager – Question1065

A recent audit has identified that security controls by the organization’s policies have not been implemented for a particular application. What should the information security manager do NEXT to address this issue?

A. Discuss the issue with the data owners to determine the reason for the exception
B. Discuss the issue with data custodians to determine the reason for the exception
C. Report the issue to senior management and request funding to fix the issue
D. Deny access to the application until the issue is resolved

Correct Answer: A

CISM Certified Information Security Manager – Question1064

The MOST important reason that security risk assessments should be conducted frequently throughout an organization is because:

A. control effectiveness may weaken
B. compliance with legal and regulatory standards should be reassessed
C. controls should be regularly tested
D. threats to the organization may change

Correct Answer: D

CISM Certified Information Security Manager – Question1063

An information security manager is concerned that executive management does not support information security initiatives. Which of the following is the BEST way to address this situation?

A. Report the risk and status of the information security program to the board
B. Revise the information security strategy to meet executive management’s expectations
C. Escalate noncompliance concerns to the internal audit manager
D. Demonstrate alignment of the information security function with business needs

Correct Answer: D

CISM Certified Information Security Manager – Question1061

The GREATEST benefit of using a maturity model when providing security reports to management is that it presents the:

A. security program priorities to achieve an accepted risk level
B. level of compliance with internal policy
C. assessed level of security risk at a particular point in time
D. current and target security state for the business

Correct Answer: D