2024 Best CISM Exam Preparation Material with New Dumps Questions [Q318-Q336]

4/5 - (1 vote)

2024 Best CISM Exam Preparation Material with New Dumps Questions

Free CISM Exam Files Verified & Correct Answers Downloaded Instantly

ISACA Certified Information Security Manager CISM Exam

ISACA Certified Information Security Manager CISM Exam is related to Certified Information Security Manager CISM certification. This CISM Exam validates the ability to maintain and establish an information security governance framework and supporting processes to ensure that the information security strategy is aligned with organizational goals and objectives. Candidate must have the ability to manage information risk appropriately and program resources are managed responsibly. It also deals with the ability to ensure that organizational goals and objectives are supported by the information security program communicate managements directives and guide the development of standards, procedures, and guidelines and develop business cases to support investments in information security. Security Managers Industry Leaders and Industry Practitioners usually hold or pursue this certification and you can expect the same job roles after completion of this certification.

The CISM exam is a four-hour exam consisting of 150 multiple-choice questions. CISM exam is administered at Prometric testing centers around the world. Candidates must score at least 450 out of 800 to pass the exam. CISM exam is available in English, Chinese Simplified, French, German, Hebrew, Italian, Japanese, Korean, Portuguese, Spanish, and Turkish.

NEW QUESTION 318
An operating system (OS) noncritical patch to enhance system security cannot be applied because a critical application is not compatible with the change. Which of the following is the BEST solution?

Rewrite the application to conform to the upgraded operating system

Compensate for not installing the patch with mitigating controls

Alter the patch to allow the application to run in a privileged state

Run the application on a test platform; tune production to allow patch and application

Explanation/Reference:
Explanation:
Since the operating system (OS) patch will adversely impact a critical application, a mitigating control should be identified that will provide an equivalent level of security . Since the application is critical, the patch should not be applied without regard for the application; business requirements must be considered.
Altering the OS patch to allow the application to run in a privileged state may create new security weaknesses. Finally, running a production application on a test platform is not an acceptable alternative since it will mean running a critical production application on a platform not subject to the same level of security controls.

NEW QUESTION 319
Relying on which of the following methods when detecting new threats using IDS should be of MOST concern?

Statistical pattern recognition

Attack signatures

Heuristic analysis

Traffic analysis

Section: INFORMATION SECURITY PROGRAM MANAGEMENT
Explanation

NEW QUESTION 320
When recommending a preventive control against cross-site scripting in web applications, an information security manager is MOST likely to suggest:

using https in place of http

coding standards and code review

consolidating multiple sites into a single portal

hardening of the web server’s operating system

Section: INFORMATION SECURITY PROGRAM MANAGEMENT

NEW QUESTION 321
Which of the following terms and conditions represent a significant deficiency if included in a commercial hot site contract?

A hot site facility will be shared in multiple disaster declarations

All equipment is provided “at time of disaster, not on floor”

The facility is subject to a “first-come, first-served” policy

Equipment may be substituted with equivalent model

Explanation/Reference:
Explanation:
Equipment provided “at time of disaster (ATOD), not on floor” means that the equipment is not available but will be acquired by the commercial hot site provider ON a best effort basis. This leaves the customer at the mercy of the marketplace. If equipment is not immediately available, the recovery will be delayed.
Many commercial providers do require sharing facilities in cases where there are multiple simultaneous declarations, and that priority may be established on a first-come, first-served basis. It is also common for the provider to substitute equivalent or better equipment, as they are frequently upgrading and changing equipment.

NEW QUESTION 322
In addition to business alignment and security ownership, which of the following is MOST critical for information security governance?

Auditability of systems

Compliance with policies

Reporting of security metrics

Executive sponsorship

NEW QUESTION 323
When developing a tabletop test plan for incident response testing, the PRIMARY purpose of the scenario should be to:

give the business a measure of the organization’s overall readiness

provide participants with situations to ensure understanding of their roles

measure management engagement as part of an incident response team

challenge the incident response team to solve the problem under pressure

Section: INFORMATION SECURITY PROGRAM DEVELOPMENT
Explanations
Tabletop scenarios that need to be completed with one hour per scenario using full escalation as per decision trees to accurately simulate and evaluate responses of each team member and the processes within the playbooks.

NEW QUESTION 324
For an organization that provides web-based services, which of the following security events would MOST likely initiate an incident response plan and be escalated to management?

Multiple failed login attempts on an employee’s workstation

Suspicious network traffic originating from the demilitarized zone (DMZ)

Several port scans of the web server

Anti-malware alerts on several employees’ workstations

NEW QUESTION 325
Which of the following is the MOST important consideration m a bring your own device (BYOD) program to protect company data in the event of a loss?

The ability to restrict unapproved applications

The ability to classify types of devices

The ability to remotely locate devices

The ability to centrally manage devices

NEW QUESTION 326
An information security manager notes that security incidents are not being appropriately escalated by the help desk after tickets are logged.
Which of the following is the BEST automated control to resolve this issue?

Integrating automated service level agreement (SLA) reporting into the help desk ticketing system

Integrating incident response workflow into the help desk ticketing system

Implementing automated vulnerability scanning in the help desk workflow

Changing the default setting for all security incidents to the highest priority

NEW QUESTION 327
Primary direction on the impact of compliance with new regulatory requirements that may lead to major application system changes should be obtained from the:

corporate internal auditor.

System developers/analysts.

key business process owners.

corporate legal counsel.

Section: INFORMATION SECURITY PROGRAM DEVELOPMENT
Explanation:
Business process owners are in the best position to understand how new regulatory requirements may affect their systems. Legal counsel and infrastructure management, as well as internal auditors, would not be in as good a position to fully understand all ramifications.

NEW QUESTION 328
An organizations ability to prevent a security incident In a Software as a Service (SaaS) cloud-com puling environment is MOST dependent on the:

ability to implement a web application firewall.

ability to monitor and analyze system logs

configuration and sensitivity of an intrusion detection system (IDS)

granularity with which access rights can be configured

NEW QUESTION 329
An organization is concerned with the potential for exploitation of vulnerabilities in its server systerns. Which of the following is the BEST control to mitigate the associated risk?

Enforcing configurations for secure logging and audit trails on server systems

Enforcing standard system configurations based on secure configuration benchmarks

Implementing network and system-based anomaly monitoring software for server systems.

Implementing host-based intrusion detection systems (IDS) on server systems

NEW QUESTION 330
What task should be performed once a security incident has been verified?

Identify the incident.

Contain the incident.

Determine the root cause of the incident.

Perform a vulnerability assessment.

Identifying the incident means verifying whether an incident has occurred and finding out more details about the incident. Once an incident has been confirmed (identified), the incident management team should limit further exposure. Determining the root cause takes place after the incident has been contained. Performing a vulnerability assessment takes place after the root cause of an incident has been determined, in order to find new vulnerabilities.

NEW QUESTION 331
Which of the following is MOST likely to be discretionary?

Policies

Procedures

Guidelines

Standards

Explanation/Reference:
Explanation:
Policies define security goals and expectations for an organization. These are defined in more specific terms within standards and procedures. Standards establish what is to be done while procedures describe how it is to be done. Guidelines provide recommendations that business management must consider in developing practices within their areas of control; as such, they are discretionary.

NEW QUESTION 332
Which of the following is the BEST way to ensure the organization’s security objectives are embedded in business operations?

Publish adopted information security standards.

Perform annual information security compliance reviews.

Implement an information security governance framework.

Define penalties for information security noncompliance.

NEW QUESTION 333
Which of the following is the MAIN reason for performing risk assessment on a continuous basis’?

Justification of the security budget must be continually made.

New vulnerabilities are discovered every day.

The risk environment is constantly changing.

Management needs to be continually informed about emerging risks.

Explanation/Reference:
Explanation:
The risk environment is impacted by factors such as changes in technology, and business strategy. These changes introduce new threats and vulnerabilities to the organization. As a result, risk assessment should be performed continuously. Justification of a budget should never be the main reason for performing a risk assessment. New vulnerabilities should be managed through a patch management process. Informing management about emerging risks is important, but is not the main driver for determining when a risk assessment should be performed.

NEW QUESTION 334
Which of the following is generally used to ensure that information transmitted over the Internet is authentic and actually transmitted by the named sender?

Biometric authentication

Embedded steganographic

Two-factor authentication

Embedded digital signature

Digital signatures ensure that transmitted information can be attributed to the named sender; this provides nonrepudiation. Steganographic techniques are used to hide messages or data within other files. Biometric and two-factor authentication is not generally used to protect internet data transmissions.

NEW QUESTION 335
Which of the following BEST ensures that information transmitted over the Internet will remain confidential?

Virtual private network (VPN)

Firewalls and routers

Biometric authentication

Two-factor authentication

Explanation
Encryption of data in a virtual private network (VPN) ensures that transmitted information is not readable, even if intercepted. Firewalls and routers protect access to data resources inside the network and do not protect traffic in the public network. Biometric and two-factor authentication, by themselves, would not prevent a message from being intercepted and read.

NEW QUESTION 336
An information security manager learns users of an application are frequently using emergency elevated access privileges to process transactions.
Which of the following should be done FIRST?

Request justification from the user’s managers for emergency access.

Request the application administrator block all emergency access profiles.

Update the frequency and usage of the emergency access profile in the policy.

Review the security architecture of the application and recommend changes.

Section: INFORMATION SECURITY PROGRAM MANAGEMENT

Loading …