Cism Information Security Program Development Practice Exam

Priority should be given to which of the following to ensure effective implementation of information security governance?

Options are :

  • Consultation
  • Negotiation
  • Planning (Correct)
  • Facilitation

Answer : Planning

Which of the following is the BEST method to securely transfer a message?

Options are :

  • Password-protected removable media
  • Steganography
  • Using public key infrastructure (PKI) encryption (Correct)
  • Facsimile transmission in a secured room

Answer : Using public key infrastructure (PKI) encryption

CISM Information Risk Management Certification Practice

When speaking to an organization's human resources department about information security, an information security manager should focus on the need for:

Options are :

  • an adequate budget for the security program.
  • security awareness training for employees. (Correct)
  • periodic risk assessments.
  • recruitment of technical IT employees.

Answer : security awareness training for employees.

When configuring a biometric access control system that protects a high-security data center, the system's sensitivity level should be set:

Options are :

  • exactly to the crossover error rate.
  • to a lower crossover error rate.
  • to u higher false reject rate (FRR). (Correct)
  • to a higher false acceptance rate (FAR).

Answer : to u higher false reject rate (FRR).

A test plan to validate the security controls of a new system should be developed during which phase of the project?

Options are :

  • Testing
  • Initiation
  • Development
  • Design (Correct)

Answer : Design

CISM Information Risk Management Certification

The PRIMARY objective of an Internet usage policy is to prevent:

Options are :

  • access to inappropriate sites.
  • violation of copyright laws.
  • downloading malicious code.
  • disruption of Internet access. (Correct)

Answer : disruption of Internet access.

What is the BEST policy for securing data on mobile universal serial bus (USB) drives?

Options are :

  • Limit the use of USB devices
  • Prohibit employees from copying data to l)SB devices
  • Encryption (Correct)
  • Authentication

Answer : Encryption

The MAIN reason for deploying a public key infrastructure (PKI) when implementing an information security program is to:

Options are :

  • allow deployment of the active directory.
  • implement secure sockets layer (SSL) encryption.
  • ensure the confidentiality of sensitive material.
  • provide a high assurance of identity. (Correct)

Answer : provide a high assurance of identity.

CISM Information Security Program Management

In order to protect a network against unauthorized external connections to corporate systems, the information security manager should BEST implement:

Options are :

  • network encryption protocol.
  • a strong authentication. (Correct)
  • IP antispoofing filtering.
  • access lists of trusted devices.

Answer : a strong authentication.

An extranet server should be placed:

Options are :

  • outside the firewall.
  • on a screened subnet. (Correct)
  • on the external router.
  • on the firewall server.

Answer : on a screened subnet.

Cism Information Security Program Development Practice

Which of the following is the BEST method for ensuring that security procedures and guidelines are known and understood?

Options are :

  • Employee's signed acknowledgement
  • Periodic compliance reviews
  • Computer-based certification training (CBT) (Correct)
  • Periodic focus group meetings

Answer : Computer-based certification training (CBT)

Which of the following devices could potentially stop a Structured Query Language (SQL) injection attack?

Options are :

  • An intrusion detection system (IDS)
  • An intrusion prevention system (IPS) (Correct)
  • A host-based firewall
  • A host-based intrusion detection system (HIDS)

Answer : An intrusion prevention system (IPS)

An organization has adopted a practice of regular staff rotation to minimize the risk of fraud and encourage crosstraining. Which type of authorization policy would BEST address this practice?

Options are :

  • Attribute-based
  • Role-based (Correct)
  • Multilevel
  • Discretionary

Answer : Role-based

CISM Information Security Program Management Practice

Which of the following BEST ensures that information transmitted over the Internet will remain confidential?

Options are :

  • Firewalls and routers
  • Virtual private network (VPN) (Correct)
  • Biometric authentication
  • Two-factor authentication

Answer : Virtual private network (VPN)

Which of the following is the MOST effective type of access control?

Options are :

  • Discretionary
  • Role-based (Correct)
  • Decentralized
  • Centralized

Answer : Role-based

Which of the following guarantees that data in a file have not changed?

Options are :

  • Using stringent access control to prevent unauthorized access
  • Inspecting the modified date of the file
  • Encrypting the file with symmetric encryption
  • Creating a hash of the file, then comparing the file hashes (Correct)

Answer : Creating a hash of the file, then comparing the file hashes

CISM Information Security Program Management Test

The BEST reason for an organization to have two discrete firewalls connected directly to the Internet and to the same DMZ would be to:

Options are :

  • provide in-depth defense.
  • prevent a denial-of-service attack.
  • separate test and production.
  • permit traffic load balancing. (Correct)

Answer : permit traffic load balancing.

Which of the following mechanisms is the MOST secure way to implement a secure wireless network?

Options are :

  • Filter media access control (MAC) addresses
  • Use a Wi-Fi Protected Access (WPA2) protocol (Correct)
  • Web-based authentication
  • Use a Wired Equivalent Privacy (WEP) key

Answer : Use a Wi-Fi Protected Access (WPA2) protocol

Nonrepudiation can BEST be ensured by using:

Options are :

  • strong passwords.
  • a digital hash.
  • digital signatures. (Correct)
  • symmetric encryption.

Answer : digital signatures.

CISM Information Security Governance Certification Practice

Security monitoring mechanisms should PRIMARILY:

Options are :

  • assist owners to manage control risks.
  • record all security violations.
  • focus on business-critical information. (Correct)
  • focus on detecting network intrusions.

Answer : focus on business-critical information.

Which of the following devices should be placed within a DMZ?

Options are :

  • Mail relay (Correct)
  • Authentication server
  • Firewall
  • Router

Answer : Mail relay

When contracting with an outsourcer to provide security administration, the MOST important contractual element is the:

Options are :

  • service level agreement (SLA). (Correct)
  • right-to-terminate clause.
  • financial penalties clause.
  • limitations of liability.

Answer : service level agreement (SLA).

The effectiveness of virus detection software is MOST dependent on which of the following?

Options are :

  • Definition tables (Correct)
  • Software upgrades
  • Intrusion detection
  • Packet filtering

Answer : Definition tables

For virtual private network (VPN) access to the corporate network, the information security manager is requiring strong authentication. Which of the following is the strongest method to ensure that logging onto the network is secure?

Options are :

  • Secure Sockets Layer (SSL)-based authentication
  • Two-factor authentication (Correct)
  • Symmetric encryption keys
  • Biometrics

Answer : Two-factor authentication

An intrusion detection system should be placed:

Options are :

  • outside the firewall.
  • on the firewall server.
  • on the external router.
  • on a screened subnet. (Correct)

Answer : on a screened subnet.

CISM Information Security Program Management Practice

Which of the following would be the FIRST step in establishing an information security program?

Options are :

  • Develop the security policy.
  • Develop the security plan. (Correct)
  • Develop security operating procedures.
  • Conduct a security controls study.

Answer : Develop the security plan.

Which of the following is the BEST metric for evaluating the effectiveness of security awareness twining? The number of:

Options are :

  • password resets.
  • reported incidents. (Correct)
  • incidents resolved.
  • access rule violations.

Answer : reported incidents.

Which of the following is the MOST important reason for an information security review of contracts? To help ensure that:

Options are :

  • confidential data are not included in the agreement.
  • the right to audit is a requirement.
  • appropriate controls are included. (Correct)
  • the parties to the agreement can perform.

Answer : appropriate controls are included.

CISM Information Risk Management Certification Practice

Who can BEST advocate the development of and ensure the success of an information security program?

Options are :

  • IT management
  • Chief operating officer (COO)
  • Internal auditor
  • Steering committee (Correct)

Answer : Steering committee

Which of the following devices should be placed within a demilitarized zone (DMZ )?

Options are :

  • File/print server
  • Network switch
  • Web server (Correct)
  • Database server

Answer : Web server

Cism Information Security Program Development Practice

On which of the following should a firewall be placed?

Options are :

  • Intrusion detection system (IDS) server
  • Screened subnet
  • Domain boundary (Correct)
  • Web server

Answer : Domain boundary

Which of the following is the MOST effective solution for preventing internal users from modifying sensitive and classified information?

Options are :

  • Role-based access controls (Correct)
  • System access violation logs
  • Exit routines
  • Baseline security standards

Answer : Role-based access controls

When a proposed system change violates an existing security standard, the conflict would be BEST resolved by:

Options are :

  • calculating the residual risk. (Correct)
  • redesigning the system change.
  • enforcing the security standard.
  • implementing mitigating controls.

Answer : calculating the residual risk.

CISM Information Risk Management Certification

Which of the following is MOST effective in preventing security weaknesses in operating systems?

Options are :

  • Patch management (Correct)
  • Security baselines
  • Change management
  • Configuration management

Answer : Patch management

Which of the following tools is MOST appropriate for determining how long a security project will take to implement?

Options are :

  • Gantt chart
  • Rapid Application Development (RAD)
  • Critical path (Correct)
  • Waterfall chart

Answer : Critical path

Which of the following is MOST effective in preventing weaknesses from being introduced into existing production systems?

Options are :

  • Change management (Correct)
  • Patch management
  • Security baselines
  • Virus detection

Answer : Change management

CISM Information Security Governance Certified Practice Exam

Which of the following is the MOST appropriate frequency for updating antivirus signature files for antivirus software on production servers?

Options are :

  • Weekly
  • Concurrently with O/S patch updates
  • During scheduled change control updates
  • Daily (Correct)

Answer : Daily

Which of the following is the BEST metric for evaluating the effectiveness of an intrusion detection mechanism?

Options are :

  • Ratio of successful to unsuccessful attacks
  • Ratio of false positives to false negatives (Correct)
  • Number of attacks detected
  • Number of successful attacks

Answer : Ratio of false positives to false negatives

An intranet server should generally be placed on the:

Options are :

  • external router.
  • primary domain controller.
  • internal network. (Correct)
  • firewall server.

Answer : internal network.

CISM Information Security Program Management Practice

When application-level security controlled by business process owners is found to be poorly managed, which of the following could BEST improve current practices?

Options are :

  • Implementing sanctions for noncompliance
  • Policy enforcement by IT management
  • Periodic compliance reviews
  • Centralizing security management (Correct)

Answer : Centralizing security management

Who can BEST approve plans to implement an information security governance framework?

Options are :

  • Information security management
  • Internal auditor
  • Steering committee (Correct)
  • Infrastructure management

Answer : Steering committee

Which of the following is generally used to ensure that information transmitted over the Internet is authentic and actually transmitted by the named sender?

Options are :

  • Two-factor authentication
  • Biometric authentication
  • Embedded steganographic
  • Embedded digital signature (Correct)

Answer : Embedded digital signature

CISM Information Security Governance Certification Exam

Access control to a sensitive intranet application by mobile users can BEST be implemented through:

Options are :

  • two-factor authentication. (Correct)
  • digital signatures.
  • data encryption.
  • strong passwords.

Answer : two-factor authentication.

Comment / Suggestion Section
Point our Mistakes and Post Your Suggestions