ITIL 4 Practitioner Information Security Management

Review 20 ITIL-4-PRACTITIONER-INFORMATION-SECURITY-MANAGEMENT practice questions with answer explanations and community insights.

Question 1

What is an example of two-factor authentication?

  1. Using encryption and a security certificate to positively identify a website
  2. Using a password and a PIN to log in to a business application
  3. Using a PIN and a physical key to unlock the door to a computer room
  4. Using two passwords known by different people to access a computer system

Question 2

Which action will be performed as part of the ‘information security incident review’ of the ‘information security incident management’ process, after a server has been compromised?

  1. Configuring a new server to perform the role of the compromised system
  2. Disconnecting the compromised system from the network
  3. Contacting regulators to explain the impact of the incident
  4. Monitoring services to ensure the incident has been fully resolved

Question 3

An organization has a small information security team. This team evaluates all changes to decide if there might be a security impact, and this evaluation is a significant bottleneck for the organization, resulting in delays that slow down the rate of business change.What should the organization do to manage this issue?

  1. Allow staff from other teams to assess the security impact of changes that are frequent and low risk
  2. Communicate the importance of information security to stakeholders so that people understand the need for the delays
  3. Prioritize the evaluation of changes so that important business changes are not severely affected
  4. Automatically approve changes that have not been assessed within agreed times.

Question 4

A board of a large organization is considering certification of the organization’s information security management system to an internal standard. The board expects the certification to help retain and attract customers and reach new markets. CISO and information security managers estimated the costs of certification and necessary preparations and think that some requirements of the standard are too expensive to meet compared to the risks they address.What is the BEST course of action for the organization in this situation?

  1. The board should consider the costs of the certification together with the expected value for the organization
  2. The board should cancel the certification project as the costs are not justified
  3. The organization should adopt only those parts of the standard which are recommended by the CISO
  4. The organization should delegate the certification project to an external consultant
We are moving to a new platform

CertificationTest is being migrated. Some pages may be slow or briefly unavailable; everything will be back to normal within a few hours. If you run into any issue, email support@certificationtest.net.