stud
bud
Sign up
Log in
Home
Library
Explore
SAT
More
CISM - Domain 2 Flashcards | StudBud
Explore
/
CISM - Domain 2
CISM - Domain 2
50 terms
·
StudBud Administration
·
174 plays
Imported from external platform
Flashcards
50 cards
F
Practice quiz
P
Host live
L
Questions
50
Answers
1
At what interval should a risk assessment
TYPICALLY
be conducted?
Annually or whenever there is a significant change
Every three to six months for critical business processes
On a continuous basis
Once a year for each business process and subprocess
2
A cost-benefit analysis is performed on any proposed control to:
define budget limitations.
demonstrate the costs are justified by the reduction in risk.
verify that the cost of implementing the control is within security budget.
demonstrate due diligence to the budget committee.
3
Which of the following is the
BEST
method to determine classification of data?
Compliance requirements defined in the information security policy
Assessment of impact associated with compromise of data by the data owner
Assessment of risk of data loss by the information security manager
Requirements based on protection level implemented for different datasets
4
Under what circumstances is it
MOST
appropriate to reduce control strength?
Assessed risk is below acceptable levels.
The control is not effective.
Risk cannot be determined.
The control cost is high.
5
Which of the following processes is
CRITICAL
for deciding prioritization of actions in a business continuity plan?
Business impact analysis
Risk assessment
Vulnerability assessment
Business process mapping
6
When a proposed system change violates an existing security standard, the conflict would be
BEST
resolved by:
enforcing the security standard.
implementing mitigating controls.
calculating the risk.
redesigning the system change.
7
Which of the following attacks is
BEST
mitigated by using strong passwords?
Root kit
Brute force attack
Man-in-the-middle attack
Remote buffer overflow
8
A permissive controls policy would be reflected in which one of the following implementations?
IT systems are configured to fail closed.
Access is allowed unless explicitly denied.
Control variations are permitted within defined limits.
Individuals can delegate privileges.
9
Which of the following would
BEST
address the risk of data leakage?
Acceptable use policies
Incident response procedures
File backup procedures
Database integrity checks
10
The
PRIMARY
reason for classifying information resources according to sensitivity and criticality is to:
determine the overall budget of the information security program.
define the appropriate level of access controls.
justify the costs of each information resource.
determine inclusion of the resource in the information security program.
11
What is the
BEST
means to standardize security configurations in similar devices?
Policies
Baselines
Procedures
Technical guides
12
Monitoring has flagged a security noncompliance. What is the
MOST
appropriate action?
Validate the noncompliance.
Fine-tune the key risk indicator threshold.
Update the risk register.
Escalate the noncompliance to management.
13
What is a reasonable approach to determine control effectiveness?
Assess and quantify the control's reliability.
Review the control's capability of providing notification of failure.
Confirm the control's ability to meet intended objectives.
Determine whether the control is preventive, detective or corrective.
14
What are the essential elements of risk?
Likelihood and consequence
Impact and threat
Sensitivity and exposure
Threat and exposure
15
Asset classification should be
MOSTLY
based on:
initial cost.
business value.
replacement cost.
book value.
16
Which of the following is the
MOST
useful indicator of control effectiveness?
The extent to which the control provides defense in depth
How often the control has failed
Whether the control fails open or closed
The extent to which control objectives are achieved
17
The
BEST
process for assessing an existing risk level is a(n):
impact analysis.
threat analysis.
vulnerability assessment.
security review.
18
To be effective, risk management should be applied to:
any area that exceeds acceptable risk levels.
only those areas that have potential impact.
those elements identified by a risk assessment.
all organizational activities.
19
The
PRIMARY
purpose of risk evaluation is to:
ensure that controls are deployed to mitigate risk.
provide a means of targeting assessment activities.
ensure that risk responses align with control objectives.
provide a basis on which to select risk responses.
20
The classification level of an asset must be
PRIMARILY
based on which of the following choices?
Likelihood and impact
Valuation and replacement cost
Threat vector and exposure
Criticality and sensitivity
21
Which of the following is the
PRIMARY
prerequisite to implementing data classification within an organization?
Establishing data retention policies
Performing a risk assessment
Identifying data owners
Defining job roles
22
Which of the following is the
MAIN
reason for performing risk assessment on a continuous basis?
Management needs to be continually informed about emerging risk.
Justification of the security budget must be continually made.
New vulnerabilities are discovered every day.
The risk environment is constantly changing.
23
Which of the following considerations is the
MOST
important one in the use of a vulnerability scanning tool?
Multiple functions
Regular updates
Graphical user interface
Real-time virus deletion
24
Addressing risk at various life cycle stages is
BEST
supported by:
release management.
incident management.
configuration management.
change management.
25
Which program element should be implemented
FIRST
in asset classification and control?
Risk assessment
Classification
Valuation
Risk mitigation
26
IT-related risk management activities are
MOST
effective when they are:
conducted by the IT department.
treated as a distinct process.
communicated to all employees.
integrated within business processes.
27
Of the following, what does a network vulnerability assessment expect to identify?
Security design flaws
Zero-day vulnerabilities
Malicious software and spyware
Misconfiguration and missing updates
28
Which of the following is the
BEST
approach to deal with inadequate funding of the information security program?
Reduce monitoring and compliance enforcement activities.
Eliminate low-priority security services.
Use third-party providers for low-risk activities.
Require management to accept the increased risk.
29
Which of the following is the
MOST
supportable basis for prioritizing risk for treatment?
Frequency and impact
Cost and asset value
Cost and effort
Frequency and scope
30
What is the result of segmenting a highly sensitive database?
It reduces threat.
It reduces sensitivity.
It reduces criticality.
It reduces exposure.
31
High risk volatility would be a basis for the information security manager to:
raise the assessed risk level and increase remediation priority.
base mitigation measures solely on assessed impact.
disregard volatility as irrelevant to assessed risk level.
perform another risk assessment to validate results.
32
Why is asset classification important to a successful information security program?
It determines how protection levels compare to peer organizations.
It determines the amount of insurance needed in case of loss.
It determines the priority and extent of risk mitigation efforts.
It determines the appropriate level of protection to the asset.
33
In a business impact analysis, the value of an information system should be based on the overall:
cost of emergency operations.
cost to recreate.
opportunity cost.
cost of recovery.
34
Which of the following is
MOST
effective in preventing disruptions to production systems?
Change management
Security baselines
Virus detection
Patch management
35
Which of the following types of risk is
BEST
assessed using quantitative risk assessment techniques?
Loss of the software development team
An electrical power outage
Stolen customer data
A defaced web site
36
Phishing is
BEST
mitigated by which of the following?
Two-factor authentication
User awareness
Security monitoring software
Encryption
37
Which of the following is the
BEST
basis for determining the criticality and sensitivity of information assets?
A threat assessment
A vulnerability assessment
An impact assessment
A resource dependency assessment
38
The
MOST
effective use of a risk register is to:
identify threats and probabilities.
facilitate a thorough review of all IT-related risk on a periodic basis.
record the annualized financial amount of expected losses due to risk.
identify risks and assign roles and responsibilities for mitigation.
39
Which of the following is the
PRIMARY
reason for implementing a risk management program? A risk management program:
assists in increasing the return on investment.
is a necessary part of management's due diligence.
satisfies audit and regulatory requirements.
allows the organization to eliminate risk.
40
Which of the following
BEST
helps calculate the impact of losing frame relay network connectivity for 18–24 hours?
Financial losses incurred by affected business units
Aggregate compensation of all affected business users
Hourly billing rate charged by the carrier
Value of the data transmitted over the network
41
A risk management process is
MOST
effective in achieving organizational objectives if:
the process is overseen by a steering committee.
asset owners perform risk assessments.
the risk register is updated regularly.
risk activities are embedded in business processes.
42
The output of the risk management process is an input for making:
audit charters.
business plans.
software design decisions.
security policy decisions.
43
When performing a qualitative risk analysis, which of the following will
BEST
produce reliable results?
Value of information assets
Possible scenarios with threats and impacts
Vulnerability assessment
Estimated productivity losses
44
Reducing exposure of a critical asset is an effective mitigation measure because it reduces:
the impact of a compromise.
the vulnerability of the asset.
the time needed for recovery.
the likelihood of being exploited.
45
Which of the following
BEST
assists the information security manager in identifying new threats to information security?
Developing more realistic information security risk scenarios
Understand the flow and classification of information by the organization
A process to monitor postincident review reports prepared by IT staff
Performing more frequent reviews of the organization's risk factors
46
The
MOST
direct way to accurately determine the control baseline in an IT system is to do which of the following ?
Review system and server logs for anomalies.
Perform internal and external penetration tests.
Sample hardware and software configurations.
Review standards and system compliance.
47
Which of the following factors will
MOST
affect the extent to which controls should be layered?
The total cost of ownership for existing controls
The extent to which controls fail in a closed condition
The extent to which controls are procedural
The extent to which controls are subject to the same threat
48
The aspect of governance that is
MOST
relevant to setting security baselines is:
standards.
acceptable risk.
policies.
impacts.
49
Which of the following
BEST
supports the principle of security proportionality?
Asset classification
Release management
Ownership schema
Resource dependency analysis
50
Which of the following choices would be the
MOST
useful in determining the possible consequences of a major compromise?
Penetration testing
Risk assessment
Asset valuation
Architectural review
