(CISM) ISACA Flashcards

The following conditions lead to the MOST successful IT risk management activities:

Answer: Integrated within business processes

Effective IT-related risk management activities are most effective when they are integrated within business processes.

For a significant proposed purchase and new procedure for an organization, a risk assessment and business impact analysis (BIA) have been finished. The business department manager and the information security manager debate about who will be in charge of assessing the outcomes and identified risks. Which of the following would be the information security manager's BEST course of action?

Answer: Review of the risk assessment with executive management for final input

The best approach for the information security manager in this situation would be to review the risk assessment with executive management for final input.

Who is responsible for making sure that data is categorized and that particular security precautions are taken?

Answer: Senior management

Senior management is accountable for ensuring that information is categorized and that specific protective measures are taken. As the highest level of management within an organization, senior management holds the ultimate responsibility for information security and the protection of organizational assets. This includes establishing policies and procedures for information classification and ensuring that appropriate protective measures are implemented.

It is possible to monitor unusual server traffic between internal and external parties to:

Answer: Record the trace of advanced persistent threats

Monitoring abnormal server communication from inside the organization to external parties can serve the purpose of recording the trace of advanced persistent threats (APTs).

Which of the following is the BEST technique to catch an intruder who breaks into a network without doing any damage?

Answer: Install a honeypot on the network

A honeypot is the best technique to catch an intruder who breaks in without doing damage because it's a deceptive system that attracts attackers and lets you observe their behavior without risking production assets. Security baselines, periodic penetration testing, and vendor defaults are preventive or testing measures, not active intruder-detection tools.

A security manager examines the logs of numerous devices to ascertain how a security breach on the business network happened. Which of the following BEST makes it easier to compare and analyze these logs?

Answer: Time server

A time server best enables log comparison because synchronized, consistent timestamps across all devices are required before events from different sources can be sequenced and correlated. DNS, database, and proxy servers serve other functions and do nothing to ensure the time alignment needed to reconstruct the order of a breach.

What authentication technique stops authentication replay?

Answer: Challenge/response mechanism

The challenge/response mechanism is an authentication method that effectively prevents authentication replay attacks.