Domain by Domain Review
Domain by Domain Review
CISM Review
Questions
Isaca CISM Exam
Topic 1, INFORMATION SECURITY GOVERNANCE
QUESTION NO: 1
Which of the following should be the FIRST step in developing an information security plan?
A. Perform a technical vulnerabilities assessment
B. Analyze the current business strategy
C. Perform a business impact analysis
D. Assess the current levels of security awareness
QUESTION NO: 2
Senior management commitment and support for information security can BEST be obtained
through presentations that:
A. use illustrative examples of successful attacks.
B. explain the technical risks to the organization.
C. evaluate the organization against best security practices.
D. tie security risks to key business objectives.
QUESTION NO: 3
The MOST appropriate role for senior management in supporting information security is the:
A. evaluation of vendors offering security products.
B. assessment of risks to the organization.
C. approval of policy statements and funding.
D. monitoring adherence to regulatory requirements.
QUESTION NO: 4
Which of the following would BEST ensure the success of information security governance within
an organization?
A. Steering committees approve security projects
B. Security policy training provided to all managers
C. Security training available to all employees on the intranet
D. Steering committees enforce compliance with laws and regulations
Isaca CISM Exam
QUESTION NO: 5
Information security governance is PRIMARILY driven by:
A. technology constraints.
B. regulatory requirements.
C. litigation potential.
D. business strategy.
QUESTION NO: 6
Which of the following represents the MAJOR focus of privacy regulations?
A. Unrestricted data mining
B. Identity theft
C. Human rights protection D.
D. Identifiable personal data
QUESTION NO: 7
Investments in information security technologies should be based on:
A. vulnerability assessments.
B. value analysis.
C. business climate.
D. audit recommendations.
QUESTION NO: 8
Retention of business records should PRIMARILY be based on:
A. business strategy and direction.
B. regulatory and legal requirements.
C. storage capacity and longevity.
D. business ease and value analysis.
QUESTION NO: 9
Which of the following is characteristic of centralized information security management?
A. More expensive to administer
B. Better adherence to policies
Isaca CISM Exam
C. More aligned with business unit needs
D. Faster turnaround of requests
QUESTION NO: 10
Successful implementation of information security governance will FIRST require:
A. security awareness training.
B. updated security policies.
C. a computer incident management team.
D. a security architecture.
QUESTION NO: 11
Which of the following individuals would be in the BEST position to sponsor the creation of an
information security steering group?
A. Information security manager
B. Chief operating officer (COO)
C. Internal auditor
D. Legal counsel
QUESTION NO: 12
The MOST important component of a privacy policy is:
A. notifications.
B. warranties.
C. liabilities.
D. geographic coverage.
QUESTION NO: 13
The cost of implementing a security control should not exceed the:
A. annualized loss expectancy.
B. cost of an incident.
C. asset value.
D. implementation opportunity costs.
Isaca CISM Exam
QUESTION NO: 14
When a security standard conflicts with a business objective, the situation should be resolved by:
A. changing the security standard.
B. changing the business objective.
C. performing a risk analysis.
D. authorizing a risk acceptance.
QUESTION NO: 15
Minimum standards for securing the technical infrastructure should be defined in a security:
A. strategy.
B. guidelines.
C. model.
D. architecture.
QUESTION NO: 16
8
Which of the following is MOST appropriate for inclusion in an information security strategy?
A. Business controls designated as key controls
B. Security processes, methods, tools and techniques
C. Firewall rule sets, network defaults and intrusion detection system (IDS) settings
D. Budget estimates to acquire specific security tools
QUESTION NO: 17
Senior management commitment and support for information security will BEST be attained by an
information security manager by emphasizing:
A. organizational risk.
B. organization wide metrics.
C. security needs.
D. the responsibilities of organizational units.
QUESTION NO: 18
Isaca CISM Exam
9
Which of the following roles would represent a conflict of interest for an information security
manager?
A. Evaluation of third parties requesting connectivity
B. Assessment of the adequacy of disaster recovery plans
C. Final approval of information security policies
D. Monitoring adherence to physical security controls
QUESTION NO: 19
Which of the following situations must be corrected FIRST to ensure successful information
security governance within an organization?
A. The information security department has difficulty filling vacancies.
B. The chief information officer (CIO) approves security policy changes.
C. The information security oversight committee only meets quarterly.
D. The data center manager has final signoff on all security projects.
QUESTION NO: 20
Which of the following requirements would have the lowest level of priority in information security?
A. Technical
B. Regulatory
C. Privacy
D. Business
QUESTION NO: 21
When an organization hires a new information security manager, which of the following goals
should this individual pursue FIRST?
A. Develop a security architecture
B. Establish good communication with steering committee members
C. Assemble an experienced staff
D. Benchmark peer organizations
Isaca CISM Exam
QUESTION NO: 22
It is MOST important that information security architecture be aligned with which of the following?
QUESTION NO: 23
Which of the following is MOST likely to be discretionary?
A. Policies
B. Procedures
C. Guidelines
D. Standards
QUESTION NO: 24
Security technologies should be selected PRIMARILY on the basis of their:
A. ability to mitigate business risks.
B. evaluations in trade publications.
C. use of new and emerging technologies.
D. benefits in comparison to their costs.
QUESTION NO: 25
Which of the following are seldom changed in response to technological changes?
A. Standards
B. Procedures
C. Policies
D. Guidelines
QUESTION NO: 26
The MOST important factor in planning for the long-term retention of electronically stored business
records is to take into account potential changes in:
Isaca CISM Exam
A. storage capacity and shelf life.
B. regulatory and legal requirements.
C. business strategy and direction.
D. application systems and media.
QUESTION NO: 27
Which of the following is characteristic of decentralized information security management across a
geographically dispersed organization?
A. More uniformity in quality of service
B. Better adherence to policies
C. Better alignment to business unit needs
D. More savings in total operating costs
QUESTION NO: 28
Which of the following is the MOST appropriate position to sponsor the design and implementation
of a new security infrastructure in a large global enterprise?
A. Chief security officer (CSO)
B. Chief operating officer (COO)
C. Chief privacy officer (CPO)
D. Chief legal counsel (CLC)
QUESTION NO: 29
Which of the following would be the MOST important goal of an information security governance
program?
A. Review of internal control mechanisms
B. Effective involvement in business decision making
C. Total elimination of risk factors
D. Ensuring trust in data
QUESTION NO: 30
Relationships among security technologies are BEST defined through which of the following?
A. Security metrics
Isaca CISM Exam
B. Network topology
C. Security architecture
D. Process improvement models
Isaca CISM Exam
A. zero.
B. an acceptable level.
C. an acceptable percent of revenue.
D. an acceptable probability of occurrence.
A. original cost.
B. net cash flow.
C. net present value.
D. replacement cost.
A. of recovery.
B. to recreate.
C. if unavailable.
D. of emergency operations.
A. Feasibility
B. Design
C. Development
D. Testing
The MOST effective way to incorporate risk management practices into existing production
systems is through:
A. policy development.
B. change management.
C. awareness training.
D. regular monitoring.
A. Gap analysis
B. Regression analysis
C. Risk analysis
D. Business impact analysis
The recovery time objective (RTO) is reached at which of the following milestones?
A. Disaster declaration
B. Recovery of the backups
C. Restoration of the system
D. Return to business as usual processing
A. Control risk
B. Inherent risk
C. Risk exposure
D. Residual risk
QUESTION NO: 156
The decision on whether new risks should fall under periodic or event-driven reporting should be
based on which of the following?
A. Mitigating controls
B. Visibility of impact
C. Likelihood of occurrence
Isaca CISM Exam
D. Incident frequency
A. Assessment
B. Mitigation
C. Evaluation
D. Monitoring
A. Static IP addressing
B. Network address translation
C. Background checks for temporary employees
D. Securing and analyzing system access logs
Isaca CISM Exam
QUESTION NO: 163
In performing a risk assessment on the impact of losing a server, the value of the server should be
calculated using the:
A. Disaster declaration
B. Before-image restoration
C. System restoration
D. After-image processing
Isaca CISM Exam
Topic 3, Information Security Program Development
QUESTION NO: 275
Who can BEST advocate the development of and ensure the success of an information security
program?
A. Internal auditor
B. Chief operating officer (COO)
C. Steering committee
D. IT management
CISM Review
Answers and
Explanations
Isaca CISM Exam
QUESTION NO: 2
Answer: D
Explanation:
Senior management seeks to understand the business justification for investing in security. This can
best be accomplished by tying security to key business objectives. Senior management will not be
as interested in technical risks or examples of successful attacks if they are not tied to the impact on
business environment and objectives. Industry best practices are important to senior management
but, again, senior management will give them the right level of importance when they
are presented in terms of key business objectives.
QUESTION NO: 3
Answer: C
Explanation:
Since the members of senior management are ultimately responsible for information security, they
are the ultimate decision makers in terms of governance and direction. They are responsible
forapproval of major policy statements and requests to fund the information security practice.
Evaluation of vendors, assessment of risks and monitoring compliance with regulatory requirements
are day-to-day responsibilities of the information security manager; in some organizations, business
management is involved in these other activities, though their primary role
is direction and governance.
QUESTION NO: 4
Answer: A
Explanation:
The existence of a steering committee that approves all security projects would be an indication of
the existence of a good governance program. Compliance with laws and regulations is part of the
responsibility of the steering committee but it is not a full answer. Awareness training is important at
all levels in any medium, and also an indicator of good governance. However, it must be guided and
approved as a security project by the steering committee.
QUESTION NO: 5
Answer: D
Explanation:
Governance is directly tied to the strategy and direction of the business. Technology constraints,
regulatory requirements and litigation potential are all important factors, but they are necessarily
inline with the business strategy.
QUESTION NO: 6
Isaca CISM Exam
Answer: D
Explanation:
Protection of identifiable personal data is the major focus of recent privacy regulations such as the
Health Insurance Portability and Accountability Act (HIPAA). Data mining is an accepted tool for
ad hoc reporting; it could pose a threat to privacy only if it violates regulator)' provisions. Identity
theft is a potential consequence of privacy violations but not the main focus of many regulations.
Human rights addresses privacy issues but is not the main focus of regulations.
QUESTION NO: 7
Answer: B
Explanation:
Investments in security technologies should be based on a value analysis and a sound business
case. Demonstrated value takes precedence over the current business climate because it is ever
changing. Basing decisions on audit recommendations would be reactive in nature and might not
address the key business needs comprehensively. Vulnerability assessments are useful, but they do
not determine whether the cost is justified.
QUESTION NO: 8
Answer: B
Explanation:
Retention of business records is generally driven by legal and regulatory requirements. Business
strategy and direction would not normally apply nor would they override legal and regulatory
requirements. Storage capacity and longevity are important but secondary issues. Business case
and value analysis would be secondary to complying with legal and regulatory requirements.
QUESTION NO: 9
Answer: B
Explanation:
Centralization of information security management results in greater uniformity and better adherence
to security policies. It is generally less expensive to administer due to the economics of scale.
However, turnaround can be slower due to the lack of alignment with business units.
QUESTION NO: 10
Answer: B
Explanation:
Updated security policies are required to align management objectives with security procedures;
management objectives translate into policy, policy translates into procedures. Security
procedures will necessitate specialized teams such as the computer incident response and
management group as well as specialized tools such as the security mechanisms that comprise
the security architecture. Security awareness will promote the policies, procedures and
appropriate use of the security mechanisms.
QUESTION NO: 11
Answer: B
Explanation:
The chief operating officer (COO) is highly-placed within an organization and has the most
knowledge of business operations and objectives. The chief internal auditor and chief legal counsel
are appropriate members of such a steering group. However, sponsoring the creation of the steering
committee should be initiated by someone versed in the strategy and direction of the business. Since
a security manager is looking to this group for direction, they are not in the best position to oversee
formation of this group.
QUESTION NO: 12
Answer: A
Explanation:
Privacy policies must contain notifications and opt-out provisions: they are a high-level
management statement of direction. They do not necessarily address warranties, liabilities or
geographic coverage, which are more specific.
QUESTION NO: 13
Answer: C
Explanation:
Isaca CISM Exam
The cost of implementing security controls should not exceed the worth of the asset. Annualized loss
expectancy represents the losses drat are expected to happen during a single calendar year. A
security mechanism may cost more than this amount (or the cost of a single incident) and still be
considered cost effective. Opportunity costs relate to revenue lost by forgoing the acquisition of an
item or the making of a business decision.
QUESTION NO: 14
Answer: C
Explanation:
Conflicts of this type should be based on a risk analysis of the costs and benefits of allowing or
disallowing an exception to the standard. It is highly improbable that a business objective could be
changed to accommodate a security standard, while risk acceptance* is a process that derives from
the risk analysis.
QUESTION NO: 15
Answer: D
Explanation:
Minimum standards for securing the technical infrastructure should be defined in a security
architecture document. This document defines how components are secured and the security
services that should be in place. A strategy is a broad, high-level document. A guideline is advisory
in nature, while a security model shows the relationships between components.
QUESTION NO: 16
Answer: B
Explanation:
A set of security objectives, processes, methods, tools and techniques together constitute a
security strategy. Although IT and business governance are intertwined, business controls may not
be included in a security strategy. Budgets will generally not be included in an information security
strategy. Additionally, until information security strategy is formulated and implemented, specific
tools will not be identified and specific cost estimates will not be available. Firewall rule sets, network
defaults and intrusion detection system (IDS) settings are technical details subject to
periodic change, and are not appropriate content for a strategy document.
QUESTION NO: 17
Answer: A
Explanation:
Information security exists to help the organization meet its objectives. The information security
manager should identify information security needs based on organizational needs. Organizational
or business risk should always take precedence. Involving each organizational unit in information
security and establishing metrics to measure success will be viewed favorably by senior
management after the overall organizational risk is identified.
QUESTION NO: 18
Answer: C
Explanation:
Since management is ultimately responsible for information security, it should approve information
security policy statements; the information security manager should not have final approval.
Evaluation of third parties requesting access, assessment of disaster recovery plans and monitoring
of compliance with physical security controls are acceptable practices and do not present any
conflicts of interest.
QUESTION NO: 19
Answer: D
Explanation:
A steering committee should be in place to approve all security projects. The fact that the data center
manager has final signoff for all security projects indicates that a steering committee is not being
used and that information security is relegated to a subordinate place in the organization. This would
Isaca CISM Exam
indicate a failure of information security governance. It is not inappropriate for an oversight or
steering committee to meet quarterly. Similarly, it may be desirable to have the chief information
officer (CIO) approve the security policy due to the size of the organization and frequency of
updates. Difficulty in filling vacancies is not uncommon due to the shortage of good, qualified
information security professionals.
QUESTION NO: 20
Answer: A
Explanation:
Information security priorities may, at times, override technical specifications, which then must be
rewritten to conform to minimum security standards. Regulatory and privacy requirements are
government-mandated and, therefore, not subject to override. The needs of the business should
always take precedence in deciding information security priorities.
QUESTION NO: 21
Answer: B
Explanation:
New information security managers should seek to build rapport and establish lines of
communication with senior management to enlist their support. Benchmarking peer organizations is
beneficial to better understand industry best practices, but it is secondary to obtaining senior
management support. Similarly, developing a security architecture and assembling an experienced
staff are objectives that can be obtained later.
QUESTION NO: 22
Answer: D
Explanation:
Information security architecture should always be properly aligned with business goals and
objectives. Alignment with IT plans or industry and security best practices is secondary by
comparison.
QUESTION NO: 23
Answer: C
Explanation:
Policies define security goals and expectations for an organization. These are defined in more
specific terms within standards and procedures. Standards establish what is to be done while
procedures describe how it is to be done. Guidelines provide recommendations that business
management must consider in developing practices within their areas of control; as such, they are
discretionary.
QUESTION NO: 24
Answer: A
Explanation:
The most fundamental evaluation criterion for the appropriate selection of any security technology is
its ability to reduce or eliminate business risks. Investments in security technologies should be based
on their overall value in relation to their cost; the value can be demonstrated in terms of risk
mitigation. This should take precedence over whether they use new or exotic technologies or how
they are evaluated in trade publications.
QUESTION NO: 25
Answer: C
Explanation:
Policies are high-level statements of objectives. Because of their high-level nature and statement of
broad operating principles, they are less subject to periodic change. Security standards and
procedures as well as guidelines must be revised and updated based on the impact of technology
changes.
Isaca CISM Exam
QUESTION NO: 26
Answer: D
Explanation:
Long-term retention of business records may be severely impacted by changes in application
systems and media. For example, data stored in nonstandard formats that can only be read and
interpreted by previously decommissioned applications may be difficult, if not impossible, to recover.
Business strategy and direction do not generally apply, nor do legal and regulatory requirements.
Storage capacity and shelf life are important but secondary issues.
QUESTION NO: 27
Answer: C
Explanation:
Decentralization of information security management generally results in better alignment to
business unit needs. It is generally more expensive to administer due to the lack of economies of
scale. Uniformity in quality of service tends to vary from unit to unit.
QUESTION NO: 28
Answer: B
Explanation:
The chief operating officer (COO) is most knowledgeable of business operations and objectives. The
chief privacy officer (CPO) and the chief legal counsel (CLC) may not have the knowledge of the
day- to-day business operations to ensure proper guidance, although they have the same influence
within the organization as the COO. Although the chief security officer (CSO) is knowledgeable of
what is needed, the sponsor for this task should be someone with far-reaching influence across the
organization.
QUESTION NO: 29
Answer: D
Explanation:
The development of trust in the integrity of information among stakeholders should be the primary
goal of information security governance. Review of internal control mechanisms relates more to
auditing, while the total elimination of risk factors is not practical or possible. Proactive involvement
in business decision making implies that security needs dictate business needs when, in fact, just
the opposite is true. Involvement in decision making is important only to ensure business data
integrity so that data can be trusted.
QUESTION NO: 30
Answer: C
Explanation:
Security architecture explains the use and relationships of security mechanisms. Security metrics
measure improvement within the security practice but do not explain the use and relationships of
security technologies. Process improvement models and network topology diagrams also do not
describe the use and relationships of these technologies.
Isaca CISM Exam
Topic 2 INCIDENT Risk Management
QUESTION NO: 140
Answer: B
Explanation:
Acceptance of a risk is an alternative to be considered in the risk mitigation process. Assessment.
evaluation and risk quantification are components of the risk analysis process that are completed
prior to determining risk mitigation solutions.
Answer: B
Explanation:
Risk should be reduced to an acceptable level based on the risk preference of the organization.
Reducing risk to zero is impractical and could be cost-prohibitive. Tying risk to a percentage of
revenue is inadvisable since there is no direct correlation between the two. Reducing the
probability of risk occurrence may not always be possible, as in the ease of natural disasters. The
focus should be on reducing the impact to an acceptable level to the organization, not reducing the
Answer: B
Explanation:
Risks are constantly changing. A previously conducted risk assessment may not include
measured risks that have been introduced since the last assessment. Although an assessment
can never be perfect and invariably contains some errors, this is not the most important reason for
periodic reassessment. The fact that controls can be made more efficient to reduce costs is not
sufficient. Finally, risk assessments should not be performed merely to justify the existence of the
security function.
QUESTION NO: 143
Answer: C
Explanation:
A successful risk management practice minimizes the residual risk to the organization. Choice A is
incorrect because the fact that overall risk has been quantified does not necessarily indicate the
existence of a successful risk management practice. Choice B is incorrect since it is virtually
impossible to eliminate inherent risk. Choice D is incorrect because, although the tying of control
risks to business may improve accountability, this is not as desirable as minimizing residual risk.
Isaca CISM Exam
Answer: C
Explanation:
Although the theft of software, interruption of utility services and internal frauds are all significant,
the loss of customer confidence is the most damaging and could cause the business to fail.
81
Isaca CISM Exam
Answer: A
Explanation:
Residual risk is the risk that remains after putting into place an effective risk management
program; therefore, acceptable risk is achieved when this amount is minimized. Transferred risk is
risk that has been assumed by a third party and may not necessarily be equal to the minimal form
of residual risk. Control risk is the risk that controls may not prevent/detect an incident with a
measure of control effectiveness. Inherent risk cannot be minimized.
Answer: A
Explanation:
Individual business managers are in the best position to determine the value of information assets
since they are most knowledgeable of the assets' impact on the business. Business systems
developers and information security managers are not as knowledgeable regarding the impact on
the business. Peer companies' industry averages do not necessarily provide detailed enough
information nor are they as relevant to the unique aspects of the business.
Answer: B
Explanation:
Change is a process in which new risks can be introduced into business processes and systems. For this reason, risk
management should be an integral component of the change management process. Policy development, awareness
training and regular monitoring, although all worthwhile activities, are not as effective as change management.
Than the RTO. RTO is an "objective," and full restoration may or may not coincide with the
RTO. RTO can be the minimum acceptable operational level, far short of normal operations.
Answer: D
Explanation:
Residual risk provides management with sufficient information to decide to the level of risk that an
organization is willing to accept. Control risk is the risk that a control may not succeed in
preventing an undesirable event. Risk exposure is the likelihood of an undesirable event occurring.
Inherent risk is an important factor to be considered during the risk assessment.
Answer: B
Explanation:
Visibility of impact is the best measure since it manages risks to an organization in the timeliest
manner. Likelihood of occurrence and incident frequency are not as relevant. Mitigating controls is
not a determining factor on incident reporting.
QUESTION NO: 157
Answer: B
Explanation:
Risk acceptance is one of the alternatives to be considered in the risk mitigation process.
Assessment and evaluation are components of the risk analysis process. Risk acceptance is not a
component of monitoring.
83
Isaca CISM Exam
Answer: B
Explanation:
A risk management program should minimize the amount of risk that cannot be otherwise
eliminated or transferred; this is the residual risk to the organization. Quantifying overall risk is
important but not as critical as the end result. Eliminating inherent risk is virtually impossible.
Maximizing the sum of all ALEs is actually the opposite of what is desirable.
QUESTION NO: 161
Answer: C
Explanation:
A permanent decline in customer confidence does not lend itself well to measurement by
quantitative techniques. Qualitative techniques are more effective in evaluating things such as
customer loyalty and goodwill. Theft of software, power outages and temporary loss of e-mail can
be quantified into monetary amounts easier than can be assessed with quantitative techniques.
The value of the server should be based on its cost of replacement. The original cost may be
significantly different from the current cost and, therefore, not as relevant. The value of the
software is not at issue because it can be restored from backup media. The ALE for all risks
related to the server does not represent the server's value.
84
Isaca CISM Exam
Answer: B
Explanation:
A business impact analysis (BIA) is the best tool for calculating the priority of restoration for
applications. It is not used to determine total cost of ownership, annualized loss expectancy (ALE)
or residual risk to the organization.
Answer: A
Explanation:
Since residual risk is the risk that remains after putting into place an effective risk management
program, it is probable that the organization will decide that it is an acceptable risk if sufficiently
minimized. Transferred risk is risk that has been assumed by a third party, therefore its magnitude
is not relevant. Accordingly, choices B and D are incorrect since transferred risk does not
necessarily indicate whether risk is at an acceptable level. Minimizing residual risk will not reduce
control risk.
86
The recovery point objective (RPO) is the point in the processing flow at which
system recovery should occur. This is the predetermined state of the application
processing and data used to restore the system and to continue the processing flow.
Disaster declaration is independent of this
processing checkpoint. Restoration of the system can occur at a later date, as does
the return to normal, after-image processing.
TOPIC 3 Information Security Program Development
QUESTION NO: 275
Answer: C
Explanation:
Senior management represented in the security steering committee is in the best
position to advocate the establishment of and continued support for an information
security program. The chief operating officer (COO) will be a member of that committee.
An internal auditor is a good advocate but is secondary to the influence of senior
management. IT management has a lesser degree of influence and would also be part
of the steering committee.
Answer: A
Explanation:
Encryption of data in a virtual private network (VPN) ensures that transmitted
information is not readable, even if intercepted. Firewalls and routers protect access to
data resources inside the network and do not protect traffic in the public network.
Biometric and two-factor authentication, by themselves, would not prevent a message
from being intercepted and read.
Answer: C
Explanation:
The ratio of false positives to false negatives will indicate whether an intrusion detection
system (IDS) is properly tuned to minimize the number of false alarms while, at the
same time, minimizing the number of omissions. The number of attacks detected,
successful attacks or the ratio of successful to unsuccessful attacks would not indicate
whether the IDS is properly configured.
Answer: B
Explanation:
Information security should check the intrusion detection system (IDS) logs and
continue to monitor the situation. It would be inappropriate to take any action beyond
that. In fact, updating the IDS could create a temporary exposure until the new version
can be properly tuned. Rebooting the router and enabling server trace routing would not
be warranted.
1. Which of the following application systems should have the shortest recovery time objective (RTO)?
A. Contractor payroll
B. Change management
2. Which of the following would BEST ensure the success of information security governance within an
organization?
4. Which of the following BEST indicates the probability that a successful attack will occur?
A. external auditors.
B. stockholders.
C. senior management.
D. peer organizations.
6. The GREATEST reduction in overhead costs for security administration would be provided by:
A. Standards
B. Procedures
C. Policies
D. Guidelines
8. Which of the following will BEST protect against deletion of data files by a former employee?
A. Preemployment screening
9. Which of the following is the MOST important element to ensure the success of a disaster recovery
test at a vendor-provided hot site?
10. Which of the following individuals would be in the BEST position to sponsor the creation of an
information security steering group?
12. Access to a sensitive intranet application by mobile users can BEST be accomplished through:
A. data encryption.
B. digital signatures.
C. strong passwords.
D. two-factor authentication.
13. Which of the following is MOST appropriate for inclusion in an information security strategy?
C. Firewall rule sets, network defaults and intrusion detection system (IDS) settings
15. A business unit intends to deploy a new technology in a manner that places it in violation of existing
information security standards. What immediate action should the information security manager take?
16. Which of the following is the BEST method for ensuring that security procedures and guidelines are
read and understood?
17. Which of the following is the MOST effective in preventing attacks that exploit weaknesses in
operating systems?
A. Patch management
B. Change management
C. Security baselines
D. Acquisition management
18. Which of the following is the MOST important to ensure a successful recovery?
A. Policies
B. Procedures
C. Guidelines
D. Standards
20. The BEST way to determine if an anomaly-based intrusion detection system (IDS) is properly installed
is to:
A. simulate an attack and review IDS performance.
21. Which of the following would be the MOST appropriate task for a chief information security officer
to perform?
22. The BEST way to ensure that security settings on each platform are in compliance with information
security policies and procedures is to:
23. Which of the following is the MOST important element in ensuring the success of a disaster recovery
test at a vendor provided hot site?
25. The MOST important reason for conducting the same risk assessment more than once is because:
27. Which of the following is the BEST indicator that security awareness training has been effective?
A. Have employees sign to confirm they have read the security policy.
A. Only materials taken from offsite storage or those predeployed at the hot site are used.
C. Hot site personnel are not informed in advance when the test is to be held.
D. Key systems are restored to identical operating system (OS) releases and hardware
configurations.
29. Which of the following would normally be covered in an insurance policy for computer equipment
coverage? Equipment:
30. A business continuity policy document should contain which of the following?
A. Telephone trees
B. Declaration criteria
31. Which of the following actions should be taken when an online trading company discovers a network
attack in progress?
32. Which of the following should management use to determine the amount of resources to devote to
mitigating exposures?
33. Which of the following will MOST likely reduce the likelihood of an unauthorized individual gaining
access to computing resources by pretending to be an authorized individual needing to have their
password reset?
34. Which of the following is MOST important when deciding whether to build an alternate facility or
subscribe to a hot site operated by a third party?
35. The MOST appropriate reporting base for the information security management function would be
to report to the:
A. head of IT.
B. infrastructure director.
C. network manager.
37. Which of the following is characteristic of decentralized information security management across a
geographically dispersed organization?
38. The BEST reason for an organization to have two discrete firewalls connected directly to the Internet
and to the same DMZ would be to:
40. When a minor security flaw is found in a new system that is about to be moved into production, this
should be reported to:
41. Which of the following is MOST indicative of the failure of information security governance within an
organization?
B. The chief information officer (CIO) approves changes to the security policy.
D. The data center manager has final sign-off on all security projects.
42. The decision on whether new risks should fall under periodic or event-driven reporting should be
based on:
43. What is the BEST way to ensure that a corporate network is adequately secured against external
attack?
44. When an organization hires a new information security manager, which of the following goals should
this individual pursue FIRST?
47. Which of the following are seldom changed in response to technological changes?
A. Standards
B. Procedures
C. Policies
D. Guidelines
48. The BEST way to integrate risk management into life cycle processes is through:
A. policy development.
B. change management.
C. awareness training.
D. regular monitoring.
49. Which of the following is the MOST effective solution for preventing internal users from modifying
sensitive and classified information?
2. A 27. B
3. C 28. A
4. C 29. A
5. C 30. B
6. B 31. C
7. C 32. A
8. D 33. B
9. D 34. C
10. B 35. D
11. C 36. A
12. D 37. C
13. B 38. C
14. B 39. C
15. C 40. A
16. C 41. D
17. A 42. B
18. A 43. D
19. C 44. B
20. A 45. A
21. D 46. B
22. B 47. C
23. D 48. B
24. B 49. C
25. B 50.D