Free ISACA CISM Practice Exams - Page 4 of 83

Question #31

An organization has decided to outsource IT operations.

Which of the following should be the PRIMARY focus of the information security manager?

A . Security requirements are included in the vendor contract
B . External security audit results are reviewed.
C . Service level agreements (SLAs) meet operational standards.
D . Business continuity contingency planning is provided

Reveal Solution Hide Solution

Question #32

Which of the following trends would be of GREATEST concern when reviewing the performance of an organization’s intrusion detection systems (IDSs)?

A . Increase in false positives
B . Increase in false negatives
C . Decrease in false negatives
D . Decrease in false positives

Reveal Solution Hide Solution

Question #33

Which of the following analyses will BEST identify the external influences to an organization’s information security?

A . Business impact analysis (BIA)
B . Gap analysis
C . Threat analysis
D . Vulnerability analysis

Reveal Solution Hide Solution

Correct Answer: C
C

Explanation:

A threat analysis will best identify the external influences to an organization’s information security because it involves identifying and evaluating the sources and likelihood of potential adverse events that could affect the organization’s assets, operations, or reputation. External influences include factors such as emerging technologies, social media, business environment, risk tolerance, regulatory requirements, third-party considerations, and threat landscape1. A threat analysis can help the organization to align its information security strategy with its business objectives and risk appetite, and to prioritize and mitigate the most relevant and impactful threats. A business impact analysis (BIA) is a process of assessing the potential consequences of a disruption to the organization’s critical business functions or processes. A BIA does not directly identify the external influences to the organization’s information security, but rather the impact of those influences on the organization’s continuity and recovery. A gap analysis is a process of comparing the current state of the organization’s information security with a desired or expected state, based on best practices, standards, or frameworks. A gap analysis does not directly identify the external influences to the organization’s information security, but rather the areas of improvement or compliance. A vulnerability analysis is a process of identifying and evaluating the weaknesses or flaws in the organization’s information systems or processes that could be exploited by threats. A vulnerability analysis does not directly identify the external influences to the organization’s information security, but rather the exposure or susceptibility of the organization to those influences.

Reference = CISM Review Manual, 15th Edition, pages 22-232; CISM Exam Content Outline, Domain 1, Knowledge Statement 1.113

Threat analysis is a process that is used to identify and assess the external influences or threats that could potentially affect an organization’s information security. It is used to identify potential risks and develop strategies to mitigate or reduce those risks. Threat analysis involves analyzing the environment, identifying potential threats and their potential impacts, and then evaluating the organization’s current security measures and developing strategies to address any deficiencies.

Question #34

The BEST way to identify the risk associated with a social engineering attack is to:

A . monitor the intrusion detection system (IDS),
B . review single sign-on (SSO) authentication lags.
C . test user knowledge of information security practices.
D . perform a business risk assessment of the email filtering system.

Reveal Solution Hide Solution

Correct Answer: C
C

Explanation:

The best way to identify the risk associated with a social engineering attack is to test user knowledge of information security practices. Social engineering is a type of attack that exploits human psychology and behavior to manipulate, deceive, or influence users into divulging sensitive information, granting unauthorized access, or performing malicious actions. Therefore, user knowledge of information security practices is a key factor that affects the likelihood and impact of a social engineering attack. By testing user knowledge of information security practices, such as through quizzes, surveys, or simulated attacks, the information security manager can measure the level of awareness, understanding, and compliance of the users, and identify the gaps, weaknesses, or vulnerabilities that need to be addressed.

Monitoring the intrusion detection system (IDS) (A) is a possible way to detect a social engineering attack, but not to identify the risk associated with it. An IDS is a system that monitors network or system activities and alerts or responds to any suspicious or malicious events. However, an IDS may not be able to prevent or recognize all types of social engineering attacks, especially those that rely on human interaction, such as phishing, vishing, or baiting. Moreover, monitoring the IDS is a reactive rather than proactive approach, as it only reveals the occurrence or consequences of a social engineering attack, not the potential or likelihood of it.

Reviewing single sign-on (SSO) authentication lags (B) is not a relevant way to identify the risk associated with a social engineering attack. SSO is a method of authentication that allows users to access multiple applications or systems with one set of credentials. Authentication lags are delays or failures in the authentication process that may affect the user experience or performance. However, authentication lags are not directly related to social engineering attacks, as they do not indicate the user’s knowledge of information security practices, nor the attacker’s attempts or success in compromising the user’s credentials or access.

Performing a business risk assessment of the email filtering system (D) is also not a relevant way to identify the risk associated with a social engineering attack. An email filtering system is a system that scans, filters, and blocks incoming or outgoing emails based on predefined rules or criteria, such as spam, viruses, or phishing. A business risk assessment is a process that evaluates the potential threats, vulnerabilities, and impacts to the organization’s business objectives, processes, and assets. However, performing a business risk assessment of the email filtering system does not address the risk associated with a social engineering attack, as it only focuses on the technical aspects and performance of the system, not the human factors and behavior of the users.

Reference = CISM Review Manual, 16th Edition, Chapter 2: Information Risk Management, Section:

Risk Identification, Subsection: Threat Identification, page 87-881

Question #35

After a server has been attacked, which of the following is the BEST course of action?

A . Initiate incident response.
B . Review vulnerability assessment.
C . Conduct a security audit.
D . Isolate the system.

Reveal Solution Hide Solution

Question #36

Which of the following is the MOST appropriate metric to demonstrate the effectiveness of information security controls to senior management?

A . Downtime due to malware infections
B . Number of security vulnerabilities uncovered with network scans
C . Percentage of servers patched
D . Annualized loss resulting from security incidents

Reveal Solution Hide Solution

Question #37

Once a suite of security controls has been successfully implemented for an organization’s business units, it is MOST important for the information security manager to: