CISM D3 Questions

CISM Questions – Domain 3
1. To justify its on ‐going security budget, which of the following would

be of MOST use to the information security department?
A. Security breach frequency
B. Annualized loss expectancy (ALE)
C. Cost‐benefit analysis
D. Peer group comparison
2. An outsource service provider must handle sensitive customer

information. Which of the following is MOST important for an information
security manager to know?
A. Security in storage and transmission of sensitive data
B. Provider's level of compliance with industry standards
C. Security technologies in place at the facility
D. Results of the latest independent security review
3. When a departmental system continues to be out of compliance with

an information security policy's password strength requirements, the
BEST action to undertake is to:
A. submit the issue to the steering committee.
B. conduct a risk assessment to quantify the risk.
C. isolate the system from the rest of the network.
D. request a risk acceptance from senior management.
4. Security audit reviews should PRIMARILY:
A. ensure that controls operate as required.
B. ensure that controls are cost‐effective.
C. focus on preventive controls.
D. ensure controls are technologically current.
5. The data backup policy will contain which of the following?

A. Criteria for data backup
B. Personnel responsible for backup
C. A data backup schedule
D. A list of systems to be backed up
6. Which of the following is MOST important to the success of an

information security program?
A. Security awareness training
B. Achievable goals and objectives
C. Senior management sponsorship
D. Adequate start‐up budget and staffing
7. After obtaining commitment from senior management which of the
following should be completed NEXT when establishing an information
security program?
A. Define security metrics
B. Conduct a risk assessment
C. Perform a gap analysis
D. Procure security tools
8. Serious security incidents typically lead to renewed focus by

management on information security that then usually fades overtime.
To BEST utilize this renewed focus, the information security manager
should make the case to:
A. improve the integration of business and information security
processes.
B. increase information security budgets and staffing levels.
C. develop tighter controls and stronger compliance efforts.
D. acquire better supplemental technical security controls.
9. Which of the following activities will MOST effectively foster effective

security behaviour?
A. implementing a security awareness program
B. Rewarding compliance with security policies and guidelines
C. Implementing a discipline and reward system
D. Implementing a whistle‐blower hotline
10. Which of the following is the BEST indicator that security awareness
training has been effective?
A. Employees sign to acknowledge the security policy
B. More incidents are being reported
C. A majority of employees have completed training
D. No incidents have been reported in three months
11. What is the best way to ensure data protection upon termination of
employment?
A. Retrieve identification badge and card keys
B. Retrieve all personal computer equipment
C. Erase all of the employee’s folders
D. Ensure all logical access is removed
12. A security baseline can BEST be used for:

A. securing unstable environments.
B. establishing uniform system hardening
C. prioritizing security objectives
D. establishing a corporate security policy.
13. Which of the following are likely to be updated MOST frequently?

A. Procedures tor hardening database servers
B. Standards for password length and complexity
C. Policies addressing information security governance
D. Standards for document retention and destruction
14. Which of the following will BEST protect against malicious activity by
a former employee?
A. Pre‐employment screening
B. Close monitoring of users
C. Periodic awareness training
D. Effective termination procedures
15. Which of the following is the BEST approach to mitigate online brute
‐force attacks on user accounts?
A. Passwords stored in encrypted form
B. User awareness
C. Strong passwords that are changed periodically
D. Implementation of lock‐out policies
16. Which of the following is the MOST appropriate method of ensuring

password strength in a large organization?
A. Attempt to reset several passwords to weaker values
B. Install code to capture passwords for periodic audit
C. Sample a subset of users and request their passwords for review
D. Install strong password settings on each platform
17. Security monitoring mechanisms should PRIMARILY:
A. focus on business critical information.
B. assist owners to manage control risks.
C. focus on detecting network intrusions.
D. record all security violations.
18. The organization has decided to outsource the majority of the IT

department with a vendor that is hosting servers in a foreign country. Of
the following, which is the MOST critical security consideration?
A. Laws and regulations of the country of origin may not be enforceable
in the foreign country.
B. A security breach notification might get delayed due to the time
difference.
C. Additional network intrusion detection sensors should be installed,
resulting in an additional cost
D. The company could lose physical control over the server and be
unable to monitor the physical security posture of the servers.
19. The development of an information security program begins with:

A. a comprehensive risk assessment and analysis.
B. the development of a security architecture.
C. completion of a controls statement of applicability.
D. an effective information security strategy.
20. The BEST way to prevent phishing attacks is with:
A. current antivirus definitions.
B. email filtering.
C. an intrusion detection system (IDS).
D. security awareness training.

CISM D3 Questions

Uploaded by

Copyright:

Available Formats

CISM D3 Questions

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

CISM D3 Questions

Uploaded by

Copyright:

Available Formats

CISM Questions – Domain 3

1. To justify its on ‐going security budget, which of the following would

2. An outsource service provider must handle sensitive customer

3. When a departmental system continues to be out of compliance with

5. The data backup policy will contain which of the following?

6. Which of the following is MOST important to the success of an

8. Serious security incidents typically lead to renewed focus by

9. Which of the following activities will MOST effectively foster effective

12. A security baseline can BEST be used for:

13. Which of the following are likely to be updated MOST frequently?

16. Which of the following is the MOST appropriate method of ensuring

18. The organization has decided to outsource the majority of the IT

19. The development of an information security program begins with:

You might also like