Information Security Program

CISM · 99 questions

• A newly hired information security manager finds that the security program was started two years ago without a charter, defined scope or documented link to the information security strategy. Teams disagree about which activities belong to the program. What should be done FIRST?
• The organization is moving several critical workloads to a public cloud platform, and the security team has limited experience with cloud environments. What should the information security manager do FIRST?
• A review finds that the organization owns many security tools with overlapping capabilities, and licence and support costs are rising. What should the information security manager do to BEST address this?
• An internal auditor asks the information security manager for evidence that the security program supports the organization's information security strategy. Which evidence would BEST demonstrate this?
• The security program has more planned activities than available staff can deliver this year, and hiring is frozen. How should the information security manager assign the existing staff?
• The organization has outsourced its security operations center to a managed security service provider. Which responsibility should remain with the organization?
• The security program roadmap schedules a zero trust access initiative to begin before the project that consolidates the organization's several identity directories into one authoritative source. What should the information security manager do?
• Departing employees often keep system access for weeks because HR, legal and operations run their processes without involving the security program. What should the information security manager do to BEST address this?
• A mid-size company with no existing data classification is designing its first scheme. Staff will classify information themselves as they create it. Which design is MOST likely to succeed?
• The marketing department has created a new customer analytics data set combining purchase history and contact details. Who should assign its classification?
• Before launching a data classification project, the information security manager learns that the organization's information asset inventory is known to be incomplete and lacks named owners for many assets. What should be done FIRST?
• During awareness training, several employees ask why they should bother applying classification labels to the documents they create each day. Which explanation BEST answers them?
• Product specifications were classified as confidential during development. The product has now launched, and the same specifications are published on the company's public website. What should happen to the internal copies?
• Analysts propose combining several fields that are each classified as internal, such as job titles, office locations and travel schedules, into one data set describing senior executives. How should the combined data set be classified?
• A collaboration platform holds thousands of unlabeled documents. The information security manager proposes requiring classification labels so that data loss prevention and external sharing restrictions are applied automatically according to each label. What is the PRIMARY objective of this approach?
• An information owner is determining the value of a customer database to set its classification. On what should the valuation PRIMARILY be based?
• A data discovery scan finds customer identity records in a departmental file share that is not listed in the information asset inventory and has broad access permissions. There is no evidence that the data has been accessed improperly. What should the information security manager do?
• A parent company has two subsidiaries: one delivers government contracts that require a specified government security control baseline, and the other is a commercial retailer with no such obligation. The parent wants a consistent approach to choosing control frameworks. What should PRIMARILY drive framework selection?
• A team implementing an industry control framework is working through it as a checklist, implementing every control in order regardless of the organization's circumstances. What should the information security manager advise?
• An organization is preparing to seek ISO/IEC 27001 certification to support bids for contracts in its managed services business line. How should the scope of the information security management system BEST be defined?
• A small organization with a limited budget and no dedicated security staff wants a starting set of controls that will address the most common attacks first. Which approach is MOST suitable?
• During a capability maturity assessment of security processes, management asks what target maturity level should be set for each process. What is the BEST guidance?
• After a competitor received public praise for its security program, executives ask the information security manager to copy that program's structure and priorities. What should the information security manager recommend?
• Systems that store, process or transmit payment card data are spread across a flat internal network, so the payment card industry standard applies to nearly every system. What is the MOST effective way to reduce the compliance effort?
• The control framework the organization adopted three years ago has just been released in a substantially revised version. What should the information security manager do FIRST?
• A document states that all user passwords must be at least 14 characters long and must be changed if compromise is suspected. It applies to every system and does not describe how to configure any system. How should this document be classified?
• The organization's information security policy contains specific product configuration settings and must be revised and reapproved by senior management several times a year as technology changes. What should the information security manager do?
• The information security manager has drafted a revised information security policy that sets direction for the whole organization. Who should approve it?
• A business unit cannot meet the encryption standard on a legacy production system until its planned replacement next year, and it asks to operate the system without compliance. What should the information security manager do?
• The information security manager discovers that the organization's security policy set has not been reviewed in three years, during which the company adopted remote working and moved key systems to cloud services. What should be done?
• Two months after a new acceptable use policy was published on the intranet, a survey shows that most employees are unaware of it. What should the information security manager do?
• Following a merger, the two combined companies have conflicting acceptable use policies, and managers are unsure which one applies to integrated teams. What should the information security manager do?
• An internal audit draft report cites a development team for not following the organization's secure coding guideline, which recommends but does not require certain practices. The team fully complied with the mandatory secure coding standard. How should the information security manager respond?
• The executive committee asks the information security manager for one security metric to review each quarter. Which metric would be MOST useful to them?
• The security operations center collects detailed data on detection times, alert volumes and analyst workload. The chief financial officer now also wants a security view drawn from the same data. What should the information security manager do?
• A department proposes 'improve security awareness' as one of its security metrics for the coming year. How should the information security manager BEST improve this proposal?
• Each quarter the security operations team reports the growing number of firewall rules to the steering committee as evidence that perimeter security is improving. The committee wants metrics it can use to make decisions. What is the PRIMARY weakness of this metric?
• Management has funded a new vulnerability management program and asks the information security manager to demonstrate, within a year, that it has improved the organization's security posture. What should the manager do FIRST?
• A security help desk is measured on the average time to close tickets. Closure times have fallen sharply, yet the same malware infections keep recurring on the same endpoints. What is the BEST action for the information security manager?
• The board has set a goal that no more than two business-critical services suffer a security-related outage in the coming year. Which indicator is a key goal indicator (KGI) for this objective rather than a key performance indicator (KPI)?
• An information security manager compiles monthly risk metrics by hand from spreadsheets that each regional office maintains differently, and the figures often change after they have been reported. What should the manager address FIRST to make the metrics useful to management?
• A company relies on a single perimeter firewall to protect all internal systems, and once traffic is inside, it flows freely between them. An assessment notes that one misconfiguration would expose every system. Which architectural principle BEST addresses this weakness?
• A distributed workforce now reaches company applications from home, hotels and client sites. The current design grants broad internal network access once a user connects through the VPN. Which design intent BEST supports the redesign of remote access?
• Different project teams make conflicting security design choices: one encrypts data at rest, another relies only on network controls, and design reviews argue every decision from scratch. What would MOST effectively bring consistency to these decisions?
• In a manufacturing company, the systems that control production lines sit on the same flat network as office workstations used for email and web browsing. What is the PRIMARY benefit of separating them into distinct network segments?
• An organization is migrating workloads to an infrastructure as a service (IaaS) provider. A business sponsor believes the provider will now be responsible for all security. Under the shared responsibility model, which responsibility remains with the organization?
• Each of the organization's 40 business applications maintains its own user store, and departing employees often keep accounts in some applications for months. Which architectural change would BEST address this problem?
• Every new project designs its security controls from scratch, which causes delays, duplicated effort and uneven protection for systems that have similar risks. What should the information security manager develop to address this?
• An architecture review finds that all internet traffic passes through one security inspection appliance, and its failure would halt customer transactions. What should the information security manager recommend?
• The security architecture team designs its standards separately from the enterprise architecture function, and business units complain that security designs ignore their processes and planned changes. What is the BEST way to resolve this?
• A risk assessment has rated unauthorized access to a customer database above the organization's risk appetite. Several controls are proposed, each with a different cost and effect. Which control should the information security manager recommend?
• During a control mapping exercise, the information security manager must label each control by its function. Which of the following controls is primarily DETECTIVE?
• An information security manager is categorizing controls by type for a control inventory. Which of the following is an ADMINISTRATIVE (managerial) control?
• A project team has already shortlisted data loss prevention products for a new customer data platform, but no one has agreed what the controls must achieve. What should the information security manager do FIRST?
• Security requirements for a new customer portal were added during user acceptance testing, causing rework and a delayed launch. What should the information security manager do to prevent this on future development projects?
• A payment platform must check that every transaction respects the customer's account limits, and it processes several thousand transactions each day. Which type of control is MOST appropriate for this requirement?
• A new approval control added to the order process doubles processing time, and sales staff now use personal email to send orders around it. What is the BEST action for the information security manager?
• A new finance application is being deployed, and the business wants to assign access efficiently while limiting the risk of fraud. Which approach BEST meets both goals?
• The organization plans to roll out multifactor authentication to 20,000 employees in several countries, and leadership is concerned about disruption to daily operations. Which approach BEST reduces that risk?
• Shortly after deployment began, a new endpoint security agent caused a critical business application to crash on the first group of machines. What should have been done to prevent this?
• Security engineers have been deploying firewall changes and new controls directly to production to respond quickly, bypassing the normal change process, and two outages have resulted. What should the information security manager do?
• Access to business systems is granted from email requests sent by managers, and no process links access to hiring, transfers or terminations. Audits keep finding active accounts belonging to former employees. Which action BEST addresses the root cause?
• A data loss prevention control was installed six months ago and the project was closed, but nobody confirmed that it actually blocks the data types it was meant to protect. What should the information security manager do NEXT?
• A database team encrypted customer records at rest, but the encryption keys are stored in a file on the same server as the database. What is the PRIMARY concern for the information security manager?
• Developers release code many times a day through an automated pipeline. A quarterly manual security review cannot keep pace and finds flaws only after they reach production. What is the BEST approach?
• After an audit finding, logging was enabled on all servers, but no one reviews the logs or acts on what they contain. What is the information security manager's MOST important concern?
• Before relying on a new access approval control, the information security manager wants to know whether it actually worked throughout the past six months, not only whether it was designed correctly. Which evaluation is required?
• The team that operates the privileged access management control has offered to test its effectiveness for the annual assurance report presented to the board. What is the MAIN concern with this arrangement?
• An information security manager must determine whether a quarterly user access review control operated effectively during the past year. What is the BEST evidence to examine?
• The information security manager plans to have business units assess their own controls through control self-assessment. What is the MOST important consideration to ensure the results can be relied on?
• The information security manager is planning a penetration test of production customer-facing systems by an external firm. What must be in place BEFORE testing begins?
• Annual control testing has repeatedly found that a critical configuration control failed months before the test, leaving long periods of undetected exposure. What would BEST address this problem?
• Testing shows that a key control protecting payment card data has failed. Which response by the information security manager BEST addresses the failure?
• Senior management asks whether the security operations center (SOC) would actually detect and respond to a skilled, stealthy attacker. Which assessment BEST answers this question?
• The information security manager wants a metric that shows whether the security awareness program is actually changing employee behavior. Which metric is BEST?
• Developers and system administrators receive the same general awareness training as all other staff. Several recent incidents involved insecure code and misconfigured servers. What should the information security manager do?
• A small group of employees repeatedly fails phishing simulations despite completing the standard awareness training. What is the BEST response for the information security manager?
• The security awareness program consists of a single annual compliance module, and phishing click rates rise steadily in the months after it is completed. What would BEST improve the program?
• Senior executives are exempt from security training because of their schedules. Attackers recently impersonated the CEO in an attempted payment fraud targeting the finance team. What should the information security manager recommend?
• New employees receive full system access on their first day but attend security awareness training several weeks later. What should the information security manager recommend?
• An awareness program still focuses on threats from several years ago, while recent incidents involved voice phishing calls and malicious QR codes. What should the information security manager do?
• An employee disputes disciplinary action for misusing company systems, claiming never to have been told the rules. HR cannot show that the employee ever accepted the acceptable use policy. What would have BEST prevented this situation?
• A contract with a new cloud payroll provider that will process employee personal data is about to be signed. What should the information security manager ensure FIRST?
• A vendor risk team of three people must assess the security of more than 600 suppliers, ranging from stationery vendors to cloud providers that hold customer data. What is the BEST approach?
• A critical service provider hosts the organization's customer data with a subcontractor that the organization has no contract with. What is the BEST way to address this fourth-party risk?
• An information security manager is reviewing a service provider's independent assurance report on its controls before relying on it. Which review step is MOST important?
• During a contract renewal review, the information security manager finds that the agreement with a payroll vendor that processes employee personal data contains no clause requiring the vendor to report security incidents. What is the BEST way to address this gap?
• An organization plans to end its relationship with a cloud-based customer support provider that stores several years of customer records. Which contract provision is MOST important to the information security manager when planning the exit?
• A business unit wants to move a workload to a large public cloud provider. The provider's standard terms prohibit individual customer audits of its data centers. What is the BEST way for the information security manager to obtain assurance over the provider's controls?
• The information security manager discovers that the marketing department signed up for a SaaS analytics tool and uploaded customer lists without any security review. Several similar cases have occurred this year. What is the BEST long-term action?
• A review of the third-party risk program shows that vendors handling sensitive data are assessed thoroughly at onboarding but never reassessed, even though several have since changed hosting providers. What should the information security manager recommend?
• The information security manager has been asked to give a program status update at the next board meeting, with ten minutes on the agenda. Which content is MOST appropriate?
• The information security manager sends a single 40-page program report to both the infrastructure engineering team and the executive committee. Executives say it is too technical, and engineers say it lacks the detail they need. What should the manager do?
• After a new detection tool was deployed, the number of reported security incidents tripled compared with the previous quarter. The information security manager is preparing the quarterly report for senior management. What is the BEST way to present this metric?
• The security program will introduce mandatory multifactor authentication and a new data-handling standard affecting every department next quarter. What should the information security manager do FIRST to support adoption?
• A business unit has repeatedly declined to implement controls required by the approved information security standard, citing productivity. Discussions with the unit's manager have not resolved the issue. What should the information security manager do NEXT?
• The draft annual security program report lists projects completed, tools deployed and training sessions delivered. The CEO asks whether the organization is actually more secure than last year. What change would BEST answer that question?
• Business unit leaders complain that security program initiatives do not reflect their priorities and often disrupt their projects. What should the information security manager do to address this on an ongoing basis?
• Two key program milestones are behind schedule and a critical control has failed testing. The information security manager is concerned that reporting this will damage confidence in the program. What should the manager do?