CISM Online Practice Questions and Answers

Correct Answer: C

Decentralization of information security management generally results in better alignment to business unit needs. It is generally more expensive to administer due to the lack of economies of scale. Uniformity in quality of service tends to vary from unit to unit.

Correct Answer: B

Correct Answer: D

Correct Answer: B

Correct Answer: D

Organizational units contribute to and agree on priorities is the best way to facilitate effective strategic alignment of security initiatives because it ensures that the security initiatives are aligned with the business goals and objectives, supported by relevant stakeholders, and prioritized based on risk and value. The business strategy is periodically updated is not sufficient to facilitate effective strategic alignment of security initiatives because it does not involve collaboration or communication between different organizational units. Procedures and standards are approved by department heads is not sufficient to facilitate effective strategic alignment of security initiatives because it does not reflect the strategic direction or vision of the organization. Periodic security audits are conducted by a third-party is not sufficient to facilitate effective strategic alignment of security initiatives because it does not address the planning or implementation of security initiatives. References: https://www.isaca.org/resources/isaca-journal/issues/2016/volume- 2/how-to-align-security-initiatives-with-business-goals-and-objectives https://www.isaca.org/resources/isaca-journal/issues/2015/volume-1/how-to-measure-theeffectiveness-of-information-security-governance

Correct Answer: A

A buffer overflow is a software coding error or vulnerability that occurs when a function is carried out with more data than the function can handle, resulting in adjacent memory locations being overwritten or corrupted by the excess data1. A

program contains a hidden and unintended function that presents a security risk is not a buffer overflow, but rather a backdoor2. Malicious code designed to interfere with normal operations is not a buffer overflow, but rather malware3. A type

of covert channel that captures data is not a buffer overflow, but rather a keylogger.

References:

https://www.fortinet.com/resources/cyberglossary/buffer-overflow 2 https://www.fortinet.com/resources/cyberglossary/backdoor 3 https://www.fortinet.com/resources/cyberglossary/malware https://www.fortinet.com/resources/cyberglossary/

keylogger

Correct Answer: D

A business impact analysis (BIA) is a process that identifies and evaluates the potential effects of disruptions to critical business operations as a result of a disaster, accident or emergency. The primary purpose of a BIA is to determine the criticality of information assets and the impact of their unavailability on the organization's mission, objectives and reputation. (From CISM Review Manual 15th Edition) References: CISM Review Manual 15th Edition, page 178, section 4.3.2.1.

Correct Answer: D

According to the CISM Review Manual, the security architecture of an organization defines the security principles, standards, guidelines and procedures that support the information security strategy and align with the business objectives.

When acquiring another company, the information security manager of the acquiring company should focus on ensuring that the security architecture of the acquired company is compatible with its own, or that any gaps or conflicts are

identified and resolved.

References: CISM Review Manual, 27th Edition, Chapter 2, Section 2.1.2, page 751.

Correct Answer: B

The business owner is the most appropriate person to own the risk associated with the failure of a privileged access control because they are ultimately responsible for the protection and use of the information in their business unit

1.

The data owner is responsible for determining the access rights for specific data sets, but not for the access control mechanisms

2.

The information security manager is responsible for implementing and enforcing the security policies and standards, but not for owning the risk

3.

The compliance manager is responsible for ensuring that the organization meets the regulatory requirements, but not for owning the risk. References: 1 https://www.cyberark.com/resources/blog/how-do-you-prioritize-risk-for-privilegedaccess- management 3 https://www.isaca.org/resources/isaca-journal/issues/2017/volume- 1/capability-framework-for-privileged-access- management 2 https://security.stackexchange.com/questions/218049/what-is-the-difference-betweendata-owner-data-custodian-and-system-owner

Correct Answer: B