CISM Practice Test

CISM Practice Test practice questions, page 47 of 50, with answer review and explanations.

Question 231

An information security manager has been tasked with developing materials to update the board, regulatory agencies, and the media about a security incident. Which of the following should the information security manager do FIRST?

  1. Invoke the organization's incident response plan.
  2. Set up communication channels for the target audience.
  3. Create a comprehensive singular communication.
  4. Determine the needs and requirements of each audience.

Question 232

Which of the following is MOST appropriate to add to a dashboard for the purpose of illustrating an organization's risk level to senior management?

  1. Results of risk and control testing
  2. Number of reported incidents
  3. Budget variance for information security
  4. Risk heat map

Question 233

When establishing escalation processes for an organization's computer security incident response team, the organization's procedures should:

  1. require events to be escalated whenever possible to ensure that management is kept informed.
  2. provide unrestricted communication channels to executive leadership to ensure direct access.
  3. specify step-by-step escalation paths to ensure an appropriate chain of command.
  4. recommend the same communication path for events to ensure consistency of communication.

Question 234

Which of the following is the MOST beneficial outcome of testing an incident response plan?

  1. The response includes escalation to senior management.
  2. Test plan results are documented.
  3. Incident response time is improved.
  4. The plan is enhanced to reflect the findings of the test.

Question 235

The PRIMARY goal of a post-incident review should be to:

  1. identify policy changes to prevent a recurrence.
  2. establish the cost of the incident to the business.
  3. determine why the incident occurred.
  4. determine how to improve the incident handling process.