CA Foundation Business Economics Questions 2023 - Part 32
Fri, 03 Mar 2023
Inspirational journeys
Follow the stories of academics and their research expeditions
CISM—Certified Information Security Manager - Part 4
1. Minimum standards for securing the technical infrastructure should be defined in a security:
A) strategy.
B) guidelines.
C) model.
D) architecture.
2. Which of the following is MOST appropriate for inclusion in an information security strategy?
A) Business controls designated as key controls
B) Security processes, methods, tools and techniques
C) Firewall rule sets, network defaults and intrusion detection system (IDS) settings
D) Budget estimates to acquire specific security tools
3. Senior management commitment and support for information security will BEST be attained by an information security manager by emphasizing:
A) organizational risk.
B) organization wide metrics.
C) security needs.
D) the responsibilities of organizational units.
4. Which of the following roles would represent a conflict of interest for an information security manager?
A) Evaluation of third parties requesting connectivity
B) Assessment of the adequacy of disaster recovery plans
C) Final approval of information security policies
D) Monitoring adherence to physical security controls
5. Which of the following situations must be corrected FIRST to ensure successful information security governance within an organization?
A) The information security department has difficulty filling vacancies.
B) The chief information officer (CIO) approves security policy changes.
C) The information security oversight committee only meets quarterly.
D) The data center manager has final signoff on all security projects.
A) strategy.
B) guidelines.
C) model.
D) architecture.
2. Which of the following is MOST appropriate for inclusion in an information security strategy?
A) Business controls designated as key controls
B) Security processes, methods, tools and techniques
C) Firewall rule sets, network defaults and intrusion detection system (IDS) settings
D) Budget estimates to acquire specific security tools
3. Senior management commitment and support for information security will BEST be attained by an information security manager by emphasizing:
A) organizational risk.
B) organization wide metrics.
C) security needs.
D) the responsibilities of organizational units.
4. Which of the following roles would represent a conflict of interest for an information security manager?
A) Evaluation of third parties requesting connectivity
B) Assessment of the adequacy of disaster recovery plans
C) Final approval of information security policies
D) Monitoring adherence to physical security controls
5. Which of the following situations must be corrected FIRST to ensure successful information security governance within an organization?
A) The information security department has difficulty filling vacancies.
B) The chief information officer (CIO) approves security policy changes.
C) The information security oversight committee only meets quarterly.
D) The data center manager has final signoff on all security projects.
1. Right Answer: D
Explanation: Minimum standards for securing the technical infrastructure should be defined in a security architecture document. This document defines how components are secured and the security services that should be in place. A strategy is a broad, high-level document. A guideline is advisory in nature, while a security model shows the relationships between components.
2. Right Answer: B
Explanation: A set of security objectives, processes, methods, tools and techniques together constitute a security strategy. Although IT and business governance are intertwined, business controls may not be included in a security strategy. Budgets will generally not be included in an information security strategy. Additionally, until information security strategy is formulated and implemented, specific tools will not be identified and specific cost estimates will not be available. Firewall rule sets, network defaults and intrusion detection system (IDS) settings are technical details subject to periodic change, and are not appropriate content for a strategy document.
3. Right Answer: A
Explanation: Information security exists to help the organization meet its objectives. The information security manager should identify information security needs based on organizational needs. Organizational or business risk should always take precedence. Involving each organizational unit in information security and establishing metrics to measure success will be viewed favorably by senior management after the overall organizational risk is identified.
4. Right Answer: C
Explanation: Since management is ultimately responsible for information security, it should approve information security policy statements; the information security manager should not have final approval. Evaluation of third parties requesting access, assessment of disaster recovery plans and monitoring of compliance with physical security controls are acceptable practices and do not present any conflicts of interest.
5. Right Answer: D
Explanation: A steering committee should be in place to approve all security projects. The fact that the data center manager has final signoff for all security projects indicates that a steering committee is not being used and that information security is relegated to a subordinate place in the organization. This would indicate a failure of information security governance. It is not inappropriate for an oversight or steering committee to meet quarterly. Similarly, it may be desirable to have the chief information officer (CIO) approve the security policy due to the size of the organization and frequency of updates. Difficulty in filling vacancies is not uncommon due to the shortage of good, qualified information security professionals.
Explanation: Minimum standards for securing the technical infrastructure should be defined in a security architecture document. This document defines how components are secured and the security services that should be in place. A strategy is a broad, high-level document. A guideline is advisory in nature, while a security model shows the relationships between components.
2. Right Answer: B
Explanation: A set of security objectives, processes, methods, tools and techniques together constitute a security strategy. Although IT and business governance are intertwined, business controls may not be included in a security strategy. Budgets will generally not be included in an information security strategy. Additionally, until information security strategy is formulated and implemented, specific tools will not be identified and specific cost estimates will not be available. Firewall rule sets, network defaults and intrusion detection system (IDS) settings are technical details subject to periodic change, and are not appropriate content for a strategy document.
3. Right Answer: A
Explanation: Information security exists to help the organization meet its objectives. The information security manager should identify information security needs based on organizational needs. Organizational or business risk should always take precedence. Involving each organizational unit in information security and establishing metrics to measure success will be viewed favorably by senior management after the overall organizational risk is identified.
4. Right Answer: C
Explanation: Since management is ultimately responsible for information security, it should approve information security policy statements; the information security manager should not have final approval. Evaluation of third parties requesting access, assessment of disaster recovery plans and monitoring of compliance with physical security controls are acceptable practices and do not present any conflicts of interest.
5. Right Answer: D
Explanation: A steering committee should be in place to approve all security projects. The fact that the data center manager has final signoff for all security projects indicates that a steering committee is not being used and that information security is relegated to a subordinate place in the organization. This would indicate a failure of information security governance. It is not inappropriate for an oversight or steering committee to meet quarterly. Similarly, it may be desirable to have the chief information officer (CIO) approve the security policy due to the size of the organization and frequency of updates. Difficulty in filling vacancies is not uncommon due to the shortage of good, qualified information security professionals.
Tags:
it certification certified it it exams isaca certification isaca cgeit isaca cisa isaca cism isaca cobit 5 isaca crisc isaca questions practice exams pratice quests risc maangement it management it questions isaca answers isaca practice isaca dumps isaca test test questions questins and answer explanation0 Comments
Categories
Recent posts
CA Foundation Business Economics Questions 2023 - Part 31
Fri, 03 Mar 2023
CA Foundation Business Economics Questions 2023 - Part 30
Fri, 03 Mar 2023
Leave a comment