stud
bud
Sign up
Log in
Home
Library
Explore
SAT
More
CISM - Domain 3 Flashcards | StudBud
Explore
/
CISM - Domain 3
CISM - Domain 3
50 terms
·
StudBud Administration
·
161 plays
Imported from external platform
Flashcards
50 cards
F
Practice quiz
P
Host live
L
Questions
50
Answers
1
Which of the following is the
MOST
effective security measure to protect data held on mobile computing devices?
Encryption of stored data
Biometric access control
Power-on passwords
Protection of data being transmitted
2
Which of the following conditions is
MOST
likely to require that a corporate standard be modified?
Control objectives are not being met.
The standard does not conform to procedures.
IT staff does not understand the standard.
The standard is inconsistent with guidelines.
3
Which is the
MOST
important process that an information security manager needs to negotiate with a service provider?
The right to conduct independent security reviews
Encryption between the organization and the provider
A joint risk assessment of the system
A legally binding data protection agreement
4
SOD principle is violated if which of the following individuals has update rights to the database access control list?
Data custodian
Systems programmer
Data owner
Security administrator
5
Which of the following presents the
GREATEST
threat to the security of an enterprise resource planning (ERP) system?
User ad hoc reporting is not logged
Network traffic is through a single switch
Database security defaults to ERP settings
Operating system security patches have not been applied
6
What is the purpose of a corrective control?
To reduce adverse events
To mitigate impact
To identify a compromise
To ensure compliance
7
Which of the following would raise security awareness among an organization's employees?
Continually reinforcing the security policy
Encouraging employees to behave in a more conscious manner
Distributing industry statistics about security incidents
Monitoring the magnitude of incidents
8
What is the
PRIMARY
basis for the prioritization of security spending and budgeting?
An increased cost of services
Industry trends
The allocated revenue of the enterprise
The identified levels of risk
9
Which is the
MOST
relevant metric to include in an information security quarterly report to the executive committee?
Percentage of security compliant servers
Number of security patches applied
Security compliant servers trend report
Security patches applied trend report
10
Which of the following is the
MOST
likely outcome of a well-designed information security awareness course?
Decreased reporting of security incidents to the incident response function
Increase in the number of identified system vulnerabilities
Increased reporting of security incidents to the incident response function
Decrease in the number of password resets
11
What is the
GREATEST
benefit of decentralized security management?
Better alignment of security to business needs
Easier administration
Reduction of the total cost of ownership
Improved compliance with organizational policies and standards
12
When securing wireless access points, which of the following controls would
BEST
assure confidentiality?
Implementing wired equivalent privacy authentication
Not broadcasting the service set identifier
Enforcing a virtual private network over wireless
Implementing wireless intrusion prevention systems
13
What is the
BEST
defense against a Structured Query Language injection attack?
An intrusion detection system
A properly configured firewall
Strict controls on input fields
Regularly updated signature files
14
Which of the following is the
MOST
important risk associated with middleware in a client-server environment?
End-user sessions may be hijacked
System backups may be incomplete
Data integrity may be affected
Server patching may be prevented
15
Obtaining another party's public key is required to initiate which of the following activities?
Nonrepudiation
Digital signing
Authentication
Authorization
16
What is the
MAIN
drawback of emailing password-protected zip files across the Internet?
They may be corrupted by the receiving mail server.
They are decrypted by the firewall.
They all use weak encryption.
They may be quarantined by mail filters.
17
What is the
MOST
important reason for conducting security awareness programs throughout an organization?
Reducing the human risk
Maintaining evidence of training records to ensure compliance
Training personnel in security incident response
Informing business units about the security strategy
18
What is the
MAIN
objective of integrating the information security process into the system development life cycle?
It ensures audit compliance.
It delineates roles and responsibilities.
It establishes the foundation for development or acquisition.
It ensures that appropriate controls are implemented.
19
What provides the linkage to ensure that procedures are correctly aligned with information security policy requirements?
Standards
Gap analysis
Security metrics
Guidelines
20
"All desktops are required to use Windows 7 SP 1, and all servers are required to use Windows Server 2008 R2 SP 1."
The statement is a guideline.
The statement is a policy.
The statement is a procedure.
The statement is a standard.
21
What is the
MOST
important action prior to having a third party perform an attack and penetration test?
Ensure that technical staff has been briefed on what to expect.
Ensure that the third party provides a demonstration on a test system.
Ensure that goals and objectives are clearly defined.
Ensure that special backups of production servers are taken.
22
Which of the following is the
BEST
way to ensure that a corporate network is adequately secured against external attack?
Perform periodic penetration testing.
Establish minimum security baselines.
Implement vendor recommended settings.
Use an intrusion detection system.
23
How should an information security manager determine the selection of controls required to meet business objectives?
Focus on key controls.
Focus on automated controls.
Prioritize the use of role-based access controls.
Restrict controls to only critical applications.
24
Where should resource requirements for information security initially be identified?
In the architecture
In policies
In procedures
In the strategy
25
Which of the following is the
MOST
effective method to enhance information security awareness?
General online security awareness training for all staff
Security training from specialized external experts for key IT personnel
Role-specific awareness training
Timely emails that address actual security threats
26
When initially establishing an information security program, it is
MOST
important that managers:
examine and understand the culture within the organization.
analyze and understand the control system of the organization.
identify and evaluate the overall risk exposure of the organization.
examine and assess the security resources of the organization.
27
Which of the following is the
MOST
important information to include in an information security standard?
Initial draft approval date
Author name
Last review date
Creation date
28
What is the
BEST
time to perform a penetration test?
After an attempted penetration has occurred
After various infrastructure changes are made
After an audit has reported weaknesses in security controls
After a high turnover in systems staff
29
What is an advantage of sending messages using steganographic techniques as opposed to using encryption?
Traffic cannot be sniffed.
Required key sizes are smaller.
The existence of messages is unknown.
Reliability of the data is higher in transit.
30
Where should an intranet server generally be placed?
On the external router
On the primary domain controller
On the internal network
On the firewall server
31
Which of the following choices is the
WEAKEST
link in the authorized user registration process?
The registration authority's private key
A secured communication private key
The certificate authority’s private key
The relying party’s private key
32
BEST
method for detecting and monitoring a hacker's activities without exposing information assets to unnecessary risk:
Decoy files
Firewalls
Screened subnets
Bastion hosts
33
Which is the
BEST
way to mitigate the risk of the database administrator reading sensitive data from the database?
Install a database monitoring solution.
Log all access to sensitive data.
Employ application-level encryption.
Develop a data security policy.
34
Which of the following will
BEST
prevent an employee from using a USB drive to copy files from desktop computers?
Disable USB ports on all desktop devices
Establish strict access controls to sensitive information
Conduct frequent awareness training with noncompliance penalties
Restrict the available drive allocation on all personal computers
35
Which is
MOST
effective in preventing weaknesses from being introduced into existing production systems?
Virus detection
Change management
Security baselines
Patch management
36
Which of the following is the
MOST
important reason for an information security review of contracts?
To help ensure the right to audit is a requirement
To help ensure the parties to the agreement can perform
To help ensure confidential data are not included in the agreement
To help ensure appropriate controls are included
37
What is the
BEST
way to ensure that information security policies are followed?
Include escalating penalties for noncompliance.
Establish an anonymous hotline to report policy abuses.
Distribute printed copies to all employees.
Perform periodic reviews for compliance.
38
Which of the following project activities is the
MAIN
activity in developing an information security program?
Conceptual and logical architecture designs
Development of risk management objectives
Control design and deployment
Security organization development
39
Most standard frameworks for information security show the development of an information security program starting with
a risk assessment and control objectives.
an internal audit and remediation of findings.
resource identification and budgetary requirements.
policy development and implementation of process.
40
The
MOST
likely reason to segment a network by trust domains is to:
implement a data classification scheme.
limit consequences of a compromise.
reduce vulnerability to a breach.
facilitate automated network scanning.
41
Which of the following is
MOST
effective for securing wireless networks as a point of entry into a corporate network?
Intrusion detection system
Boundary router
Strong encryption
Internet-facing firewall
42
Which is the
MOST
important element of a third-party contract to outsource a sensitive business process?
A right to audit
Security service level agreements
Specific system requirements
Background checks for key personnel
43
Which is the
MOST
effective solution for preventing internal users from modifying sensitive and classified information?
Baseline security standards
System access violation logs
Role-based access controls
Exit routines
44
An advantage of using a cloud computing solution over a locally hosted solution is:
reduced requirements for training of users and managers.
the ability to obtain storage and bandwidth on demand.
increased security as a result of encrypting data in transit.
the opportunity to control changes to applications and data.
45
What practice should
FIRST
be applied to an emergency security patch that has been received via email? It should be:
copied onto write-once media to prevent tampering.
validated to ensure its authenticity.
decompiled to check for malicious code.
loaded onto an isolated test machine.
46
Which of the following devices should be placed within a demilitarized zone?
Network switch
Web server
Database server
File/print server
47
Who should approve user access in business-critical applications?
The information security manager
The data owner
The data custodian
Business management
48
What is the
BEST
policy for securing data on mobile universal serial bus (USB) drives?
Authentication
Prohibit employees from copying data to USB devices
Limit the use of USB devices
Encryption
49
Which of the following is the
MOST
likely to change an organization's culture to one that is more security conscious?
Periodic compliance reviews
Adequate security policies and procedures
Security awareness campaigns
Security steering committees
50
Which of the following is the
BEST
indicator that security awareness training has been effective?
A majority of employees have completed training.
Employees sign to acknowledge the security policy.
No incidents have been reported in three months.
More incidents are being reported.
