CISM—Certified Information Security Manager - Part 243

1. What is the MOST important factor for determining prioritization of incident response?

A) Service level agreements (SLAs) pertaining to the impacted systems
B) The potential impact to the business
C) The time to restore the impacted systems
D) The availability of specialized technical staff



2. Relying on which of the following methods when detecting new threats using IDS should be of MOST concern?

A) Statistical pattern recognition
B) Attack signatures
C) Heuristic analysis
D) Traffic analysis



3. When developing a classification method for incidents, the categories MUST be:

A) quantitative defined.
B) regularly reviewed.
C) specific to situations.
D) assigned to incident handlers.



4. Which of the following is the PRIMARY objective of an incident communication plan?

A) To convey information about the incident to those affected by it
B) To prevent reputational damage to the organization
C) To prevent unannounced visits from the media during crisis
D) To fulfill regulatory requirements for incident response



5. Which of the following is MOST -helpful to management in determining whether risks are within an organization's tolerance level?

A) Audit findings
B) Heat map
C) Penetration test results
D) Maturity level