CISM Practice Test

CISM Practice Test practice questions, page 31 of 50, with answer review and explanations.

Question 151

The PRIMARY purpose of establishing an information security governance framework should be to:

  1. establish the business case for strategic integration of information security in organizational efforts.
  2. document and communicate how the information security program functions within the organization.
  3. align information security strategy and investments to support organizational activities.
  4. align corporate governance, activities, and investments to information security goals.

Question 152

Senior management is concerned that the incident response team took unapproved actions during incident response that put business objectives at risk. Which of the following is the BEST way for the information security manager to respond to this situation?

  1. Update roles and responsibilities of the incident response team.
  2. Train the incident response team on escalation procedures.
  3. Implement a monitoring solution for incident response activities.
  4. Validate that the information security strategy maps to corporate objectives.

Question 153

An incident response team has determined there is a need to isolate a system that is communicating with a known malicious host on the Internet. Which of the following stakeholders should be contacted FIRST?

  1. The business owner
  2. Key customers
  3. Executive management
  4. System administrator

Question 154

Which of the following external entities would provide the BEST guidance to an organization facing advanced attacks?

  1. Incident response experts from highly regarded peer organizations
  2. Open-source reconnaissance
  3. Recognized threat intelligence communities
  4. Disaster recovery consultants widely endorsed in industry forums

Question 155

Which of the following should be an information security manager's MOST important criterion for determining when to review the incident response plan?

  1. When recovery time objectives (RTOs) are not met
  2. When missing information impacts recovery from an incident
  3. Before an internal audit of the incident response process
  4. At intervals indicated by industry best practice