CISM Pre assessment

Which of the following reasons is the MOST important to develop a strategy before implementing an information security program

• To justify program development costs

• To integrate development activities

• To gain management support for an information security program

• To comply with international standards

How does knowledge of risk appetite help to increase security control effectiveness?

• It shows senior management that you understand their needs

• It provides a basis for redistributing resources to mitigate risk above the risk appetite

• It requires continuous monitoring because the entire risk environment is constantly changing

• It facilitates communication with management about the importance of security

When an organization is setting up a relationship with a third-party IT service provider, which of the following is one of the MOST important topics to include in the contract from a security standpoint?

• Compliance with international security standards

• Use of a two-factor authentication system

• Existence of an alternate hot site in case of business disruption

• Compliance with the organization’s information security requirements

Which of the following choices is MOST important to verify to ensure the availability of key business processes at an alternate site?

• Recovery time objective

• Functional delegation matrix

• Staff availability to the site

• End-to-end transaction flow

Which of the following steps should be FIRST in developing an information security plan?

• Perform a technical vulnerabilities assessment.

• Analyze the current business strategy.

• Perform a business impact analysis

• Assess the current levels of security awareness

Information security governance is PRIMARILY driven by:

• technology constraints

• regulatory requirements.

• litigation potential.

• business strategy.

The FIRST step to create an internal culture that embraces information security is to:

• implement stronger controls.

• conduct periodic awareness training.

• actively monitor operations

• gain endorsement from executive management.

The purpose of an information security strategy is to:

• express the goals of an information security program and the plan to achieve them.

• outline the intended configuration of information system security controls.

• mandate the behavior and acceptable actions of all information system users.

• authorize the steps and procedures necessary to protect critical information systems.

Senior management commitment and support for information security can BEST be obtained through presentations that:

• use illustrative examples of successful attacks.

• explain the technical risk to the organization.

• evaluate the organization against good security practices.

• tie security risk to key business objectives.

A security manager is preparing a report to obtain the commitment of executive management to a security program. Inclusion of which of the following items would be of MOST value?

• Examples of genuine incidents at similar organizations

• Statement of generally accepted good practices

• Associating realistic threats to corporate objectives

• Analysis of current technological exposures