ISACA Certified Information Security Manager (CISM) Prep correctly answered

ISACA Certified Information Security Manager (CISM) Prep correctly answeredWhich of the following is the primary step in control implementation for a new business application? D. Risk assessment When implementing an information security program, in which phase of the implementation should metrics be established to assess the effectiveness of the program over time?" Either B. Initiation C. Design 00:34 01:17 Data owners are concerned and responsible for who has access to their resources and therefore need to be concerned with the strategy of how to mitigate risk of data resource usage. Which of the following actions facilitates that responsibility? B. Entitlement changes Which of the following is the best method to determine the effectiveness of the incident response process? C. Post-incident review When properly implemented, a risk management program should be designed to reduce an organization's risk to: C. A level at which the organization is willing to accept What controls the process of introducing changes to systems to ensure that unintended changes are not introduced? C. Change management All actions dealing with incidents must be worked with cyclical consideration. What is the primary post-incident review takeaway? Either A. Pursuit of legal action B. Identify personnel failures D. Derive ways to improve the response process If a forensics copy of a hard drive is required for legal matters, which of the following options provide the best solid defense for preservation of evidence? C. A bit-by-bit copy of all data What is the preferred step an ISM should take to ensure the disaster recovery plan is adequate and remains current? A. Quarterly reviews of recovery plan information Which of the following would prove to be the best protection and recovery procedures if an intruder has gained root access to a system? Either A. Use system recovery to restore the last known good image C. Rebuild the system and its OS and applications using the original vendor media D. Have all users change passwords As the increased use of regulation and compliance in the Information Security arena expands, information security managers must work to put tasks into perspective. To do this, ISMs should involve affected organizations and view "regulations" as a? Either A. Risk B. Legal interpretation Which of the following is the most significant challenge when developing an incident management plan? D. Lack of management and leadership buy-in 00:02 01:17 Resource allocation is crucial during incident triage as it assists in prioritization and categorization. Why would this be critical for most organizations when conducting triage? A. Most organizations have limited incident handling resources As part of the Risk Management process, assessments must be performed on the information systems and resources of an organization. If there are vulnerabilities disclosed during an assessment, those vulnerabilities should be: d. Evaluated and prioritized based on credible threat and impact if exploited and and mitigation cost A security strategy is important for an organization, and along with the creation of supporting policies. What should the overall planning effort cover? Either A. The logical security architecture for the organization B. The intent and direction and expectations of management D. Assist in FISMA audits What is the most important security objective in creating good procedures to meet the requirements of a relevant policy? A. Being comprehensive and unambiguous Along with attention to detail, what is an additional quality required of an incident handler? D. Ability to handle stress When contracting with an outsourced party to provide security administrators, which is the most important contractual element? c. Service Level Agreement (SLA) To address the ever changing risk and threat, an effective risk management program should: A. Ensure the establishment of continuous monitoring processes When designing an intrusion detection system, where should the information security manager recommend that it be placed? C. On a screened subnet The following statement "risk = value x vulnerability x threat" indicates which of the following: c. Risk levels are greater when increased threats meet increased vulnerabilities what should a successful risk management program attempt to achieve? Either A. A breakeven point of risk reduction and cost B. Separation of risk and BCP efforts C. Mitigation of all man-made internal threats Which of the following is NOT an information security management framework? Either A. COBIT 5 B. Capability Maturity Model C. ISO/IEC 27001 Because risks, both internal and external, are continuously changing, how often should a risk assessment should be conducted? D. Annually or whenever there is a significant change A well-organized information security awareness course provides employees with current security policies, an information protection overview, and the steps for reporting any possible security incidents appropriately. Which of the following is the most probable result in the organization upon course completion? A. Increased reporting of security incidents to the incident response group Along with cataloging and assigning value to their information, this individual holds the proper role for review and confirmation of individuals on an access list? A. The Data Owner A bottom up approach to information security activities is rarely successful. To achieve senior management commitment and support for information security, your approach should be based on Regulation, Compliance Requirements, and also by presenting ideas D. Align security objectives with key business objectives When developing a security policy it is important to prioritize risk based on the potential impact to the business. This can be completed through? A. Creation of a threat profile Which of the following aspects has the highest impact on the implementation of an organization's information security governance model? Either A. Employees assigned to teams C. Organizational structure Consistency and continuity of information is an important factor in incident responses. Which of the following resources should be contained within a computer incident response team (CIRT) manual? A. Incident severity criteria Decisions to build an alternate facility or outsource to a hot site must be business decisions and take into consideration similar risks. Which of the following facilitates this decision? C. The location and cost of commercial recovery facilities At the conclusion of the risk assessment process, which of the following would prove most beneficial to understand in assisting the risk management decision making? Either A. Control risk C. Risk exposure D. Residual risk