Tag: CHOICES

CISM Certified Information Security Manager – Question0967

Which of the following BEST indicates senior management support for an information security program?

A. Detailed information security policies are established and regularly reviewed.
B. The information security manager meets regularly with the lines of business.
C. Key performance indicators (KPIs) are defined for the information security program.
D. Risk assessments are conducted frequently by the information security team.

Correct Answer: C

CISM Certified Information Security Manager – Question0966

Information security policies should:

A. address corporate network vulnerabilities.
B. address the process for communicating a violation.
C. be straightforward and easy to understand.
D. be customized to specific groups and roles.

Correct Answer: C

Explanation:

Explanation:
As high-level statements, information security policies should be straightforward and easy to understand. They arc high-level and, therefore, do not address network vulnerabilities directly or the process for communicating a violation. As policies, they should provide a uniform message to all groups and user roles.

CISM Certified Information Security Manager – Question0965

To help ensure that contract personnel do not obtain unauthorized access to sensitive information, an information security manager should PRIMARILY:

A. set their accounts to expire in six months or less.
B. avoid granting system administration roles.
C. ensure they successfully pass background checks.
D. ensure their access is approved by the data owner.

Correct Answer: B

Explanation:

Explanation:
Contract personnel should not be given job duties that provide them with power user or other administrative roles that they could then use to grant themselves access to sensitive files. Setting expiration dates, requiring background checks and having the data owner assign access are all positive elements, but these will not prevent contract personnel from obtaining access to sensitive information.

CISM Certified Information Security Manager – Question0964

The return on investment of information security can BEST be evaluated through which of the following?

A. Support of business objectives
B. Security metrics
C. Security deliverables
D. Process improvement models

Correct Answer: A

Explanation:

Explanation:
One way to determine the return on security investment is to illustrate how information security supports the achievement of business objectives. Security metrics measure improvement and effectiveness within the security practice but do not tie to business objectives. Similarly, listing deliverables and creating process improvement models does not necessarily tie into business objectives.

CISM Certified Information Security Manager – Question0963

Which of the following represents a PRIMARY area of interest when conducting a penetration test?

A. Data mining
B. Network mapping
C. Intrusion Detection System (IDS)
D. Customer data

Correct Answer: B

Explanation:

Explanation:
Network mapping is the process of determining the topology of the network one wishes to penetrate. This is one of the first steps toward determining points of attack in a network. Data mining is associated with ad hoc reporting and. together with customer data, they are potential targets after the network is penetrated. The intrusion detection mechanism in place is not an area of focus because one of the objectives is to determine how effectively it protects the network or how easy it is to circumvent.

CISM Certified Information Security Manager – Question0962

Which of the following will BEST protect against malicious activity by a former employee?

A. Preemployment screening
B. Close monitoring of users
C. Periodic awareness training
D. Effective termination procedures

Correct Answer: D

Explanation:

Explanation:
When an employee leaves an organization, the former employee may attempt to use their credentials to perform unauthorized or malicious activity. Accordingly, it is important to ensure timely revocation of all access at the time an individual is terminated. Security awareness training, preemployment screening and monitoring are all important, but are not as effective in preventing this type of situation.

CISM Certified Information Security Manager – Question0961

The PRIMARY objective of security awareness is to:

A. ensure that security policies are understood.
B. influence employee behavior.
C. ensure legal and regulatory compliance
D. notify of actions for noncompliance.

Correct Answer: B

Explanation:

Explanation:
It is most important that security-conscious behavior be encouraged among employees through training that influences expected responses to security incidents. Ensuring that policies are read and understood, giving employees fair warning of potential disciplinary action, or meeting legal and regulatory requirements is important but secondary.

CISM Certified Information Security Manager – Question0960

A security awareness program should:

A. present top management's perspective.
B. address details on specific exploits.
C. address specific groups and roles.
D. promote security department procedures.

Correct Answer: C

Explanation:

Explanation:
Different groups of employees have different levels of technical understanding and need awareness training that is customized to their needs; it should not be presented from a specific perspective. Specific details on technical exploits should be avoided since this may provide individuals with knowledge they might misuse or it may confuse the audience. This is also not the best forum in which to present security department procedures.