Mixed Deck — All CISM Topics Flashcards

A CISM is conducting a risk assessment and discovers a high likelihood threat with low potential impact. This risk should be:

Answer: Evaluated in the context of the organization's risk appetite

All risks, regardless of their individual dimensions, must be evaluated against the organization's defined risk appetite before determining the appropriate response.

Which of the following represents a governance control rather than a technical control?

Answer: Acceptable use policy

An acceptable use policy is a governance (administrative) control that defines rules and expectations for users, rather than a technical enforcement mechanism.

Which BC/DR test type carries the GREATEST risk of causing unplanned downtime?

Answer: Full interruption test

A full interruption test shuts down primary systems and fully activates recovery procedures, carrying the highest risk of real outages if the recovery environment fails.

How often should a Business Continuity Plan be tested at MINIMUM according to best practices?

Answer: At least annually, and after any significant change to the environment

Best practices and most frameworks require BCP testing at least annually and after any significant changes to ensure the plan remains effective and current.

An organization's board of directors is MOST responsible for which security governance activity?

Answer: Setting risk appetite and oversight

The board of directors is responsible for setting the organization's risk appetite and providing oversight of the overall security posture.

Which of the following is MOST important when communicating about a security incident to external stakeholders?

Answer: Ensuring communications are timely, accurate, and legally reviewed

External incident communications must be timely, factually accurate, and reviewed by legal counsel to manage liability and maintain stakeholder trust.

Which of the following is an example of a detective information security control?

Answer: Intrusion detection system (IDS) alerting on suspicious activity

Detective controls like IDS identify and alert on events that have occurred or are occurring, enabling response without preventing the activity itself.

Which of the following BEST describes the purpose of a Recovery Time Objective (RTO)?

Answer: The target time within which a business process must be restored after disruption

RTO defines how quickly a business process must be restored to avoid unacceptable consequences, driving recovery design and investment.

An organization wants to ensure its Business Continuity Plan (BCP) remains effective over time. The BEST way to accomplish this is to:

Answer: Test, review, and update the BCP on a regular schedule

Regular testing, review, and updates ensure the BCP reflects current systems, personnel, and threats, maintaining its effectiveness as conditions change.

What authentication technique stops authentication replay?

Answer: Challenge/response mechanism

The challenge/response mechanism is an authentication method that effectively prevents authentication replay attacks.

Which element should be included in a crisis communications plan?

Answer: Pre-approved messaging templates and designated spokespersons for stakeholder communication

A crisis communications plan defines who communicates, what is communicated, and provides pre-approved templates to ensure timely, consistent, and accurate messaging during a disruption.

Which of the following is a KEY benefit of integrating compliance and security program activities?

Answer: Duplication of effort is reduced and security controls serve multiple purposes simultaneously

Integrating compliance and security reduces duplication by using shared controls, frameworks, and assessments to meet both security and regulatory objectives efficiently.

Which of the following BEST describes the relationship between IT governance and information security governance?

Answer: Information security governance is a subset of IT governance

Information security governance is a subset of IT governance, which itself is a component of overall corporate governance.

A risk assessment reveals that a control is more expensive than the risk it mitigates. A CISM should RECOMMEND:

Answer: Accepting the risk if it falls within the risk appetite

When a control's cost exceeds the risk value it addresses, accepting the risk is appropriate if it aligns with the organization's defined risk appetite.

What is 'residual risk' in information security risk management?

Answer: The risk that remains after controls have been applied

Residual risk is the amount of risk that remains after security controls have been implemented to reduce or manage the inherent risk.

Which of the following BEST describes a 'control deficiency' in a compliance context?

Answer: A failure of a control to operate as intended or meet a required standard

A control deficiency is a gap where a control either doesn't exist, fails to operate as designed, or fails to meet the required standard.

IT risk management initiatives are MOST successful when they:

Answer: Integrated within business processes

IT risk management is most successful when integrated within business processes, because the people who own the processes have the context and authority to make risk decisions that stick. Keeping it confined to the IT department or treating it as a separate process isolates it from where risk actually occurs, and merely communicating it to employees doesn't embed it into operations.

Which of the following BEST describes the role of a CISM during a major security incident?

Answer: Providing strategic oversight, coordination, and communication

During a major incident, the CISM's role is strategic — providing oversight, coordinating the response team, and managing communication with leadership.

During a risk assessment, an organization identifies a threat with a high likelihood but low impact. What is the MOST appropriate risk treatment?

Answer: Implement controls proportional to the risk level

Controls should be implemented proportional to the overall risk level, balancing likelihood and impact considerations.

A newly appointed CISM is reviewing the organization's information security governance structure. Which of the following BEST demonstrates effective governance?

Answer: The board of directors receives regular security risk reports

Effective governance requires board-level oversight and accountability, including regular reporting on security risks.