CISM Overlap Practice Bank Questions

U006 / Practice 1 Q6; Practice 2 Q5 / Which of the following is MOST likely to be discretionary? A. Policies B. Procedures C. Guidelines D. Standards

Source answer: C. Guidelines | Source explanation: Policies define security goals and expectations for an organization. These are defined in more specific terms within standards and procedures. Standards establish what is to be done while procedures describe how it is to be done. Guidelines provide recommendations that business management must consider in developing practices within their areas of control; as such, they are discretionary.

U012 / Practice 1 Q14; Practice 2 Q23 / Who should be responsible for enforcing access rights to application data? A. Data owners B. Business process owners C. The security steering committee D. Security administrators

Source answer: D. Security administrators | Source explanation: As custodians, security administrators are responsible for enforcing access rights to data. Data owners are responsible for approving these access rights. Business process owners are sometimes the data owners as well, and would not be responsible for enforcement. The security steering committee would not be responsible for enforcement.

U018 / Practice 1 Q32 / Which of the following is the MOST important information to include in an information security standard? A. Creation date B. Author name C. Initial draft approval date D. Last review date

Source answer: D. Last review date | Source explanation: The last review date confirms the currency of the standard, affirming that management has reviewed the standard to assure that nothing in the environment has changed that would necessitate an update to the standard. The name of the author as well as the creation and draft dates are not that important.

U035 / Practice 1 Q95 / When an organization is setting up a relationship with a third-party IT service provider, which of the following is one of the MOST important topics to include in the contract from a security standpoint? A. Compliance with international security standard B. Use of a two-factor authentication syste C. Existence of an alternate hot site in case of business disruptio D. Compliance with the organization's information security requirement

Source answer: D. Compliance with the organization's information security requirement | Source explanation: Prom a security standpoint, compliance with the organization's information security requirements is one of the most important topics that should be included in the contract with third-party service provider. The scope of implemented controls in any ISO 27001-compliant organization depends on the security requirements established by each organization. Requiring compliance only with this security standard does not guarantee that a service provider complies with the organization's security requirements. The requirement to use a specific kind of control methodology is not usually stated in the contract with third-party service providers.

U036 / Practice 1 Q100; Practice 2 Q94 / Which of the following are seldom changed in response to technological changes? A. Standards B. Procedures C. Policies D. Guidelines

Source answer: C. Policies | Source explanation: Policies are high-level statements of objectives. Because of their high-level nature and statement of broad operating principles, they are less subject to periodic change. Security standards and procedures as well as guidelines must be revised and updated based on the impact of technology changes.

U039 / Practice 1 Q107; Practice 2 Q106 / The MOST important factor in planning for the long-term retention of electronically stored business records is to take into account potential changes in: A. storage capacity and shelf lif B. regulatory and legal requirement C. business strategy and directio D. application systems and medi

Source answer: D. application systems and medi | Source explanation: Long-term retention of business records may be severely impacted by changes in application systems and media. For example, data stored in nonstandard formats that can only be read and interpreted by previously decommissioned applications may be difficult, if not impossible, to recover. Business strategy and direction do not generally apply, nor do legal and regulatory requirements. Storage capacity and shelf life are important but secondary issues.

U049 / Practice 1 Q135 / The data access requirements for an application should be determined by the: A. legal departmen B. compliance office C. information security manage D. business owne

Source answer: D. business owne | Source explanation: Business owners are ultimately responsible for their applications. The legal department, compliance officer and information security manager all can advise, but do not have final responsibility.

U056 / Practice 1 Q158 / Who in an organization has the responsibility for classifying information? A. Data custodian B. Database administrator C. Information security officer D. Data owner

Source answer: D. Data owner | Source explanation: The data owner has full responsibility over data. The data custodian is responsible for securing the information. The database administrator carries out the technical administration. The information security officer oversees the overall classification management of the information.

U069 / Practice 1 Q206 / To determine the selection of controls required to meet business objectives, an information security manager should: A. prioritize the use of role-based access control B. focus on key control C. restrict controls to only critical application D. focus on automated control

Source answer: B. focus on key control | Source explanation: Key controls primarily reduce risk and are most effective for the protection of information assets. The other choices could be examples of possible key controls.

U071 / Practice 1 Q209 / One way to determine control effectiveness is by determining: A. whether it is preventive, detective or compensator B. the capability of providing notification of failur C. the test results of intended objective D. the evaluation and analysis of reliabilit

Source answer: C. the test results of intended objective | Source explanation: Control effectiveness requires a process to verify that the control process worked as intended. Examples such as dual-control or dual-entry bookkeeping provide verification and assurance that the process operated as intended. The type of control is not relevant, and notification of failure is not determinative of control strength. Reliability is not an indication of control strength; weak controls can be highly reliable, even if they are ineffective controls.

U080 / Practice 1 Q228 / The security responsibility of data custodians in an organization will include: A. assuming overall protection of information asset B. determining data classification level C. implementing security controls in products they instal D. ensuring security measures are consistent with polic

Source answer: D. ensuring security measures are consistent with polic | Source explanation: Security responsibilities of data custodians within an organization include ensuring that appropriate security measures are maintained and are consistent with organizational policy. Executive management holds overall responsibility for protection of the information assets. Data owners determine data classification levels for information assets so that appropriate levels of controls can be provided to meet the requirements relating to confidentiality, integrity and availability. Implementation of information security in products is the responsibility of the IT developers.

U085 / Practice 1 Q247 / Which program element should be implemented FIRST in asset classification and control? A. Risk assessment B. Classification C. Valuation D. Risk mitigation

Source answer: C. Valuation | Source explanation: Valuation is performed first to identify and understand the assets needing protection. Risk assessment is performed to identify and quantify threats to information assets that are selected by the first step, valuation. Classification and risk mitigation are steps following valuation.

U092 / Practice 1 Q270; Practice 2 Q219 / The MAIN reason why asset classification is important to a successful information security program is because classification determines: A. the priority and extent of risk mitigation effort B. the amount of insurance needed in case of los C. the appropriate level of protection to the asse D. how protection levels compare to peer organization

Source answer: C. the appropriate level of protection to the asse | Source explanation: Protection should be proportional to the value of the asset. Classification is based upon the value of the asset to the organization. The amount of insurance needed in case of loss may not be applicable in each case. Peer organizations may have different classification schemes for their assets.

U094 / Practice 1 Q275; Practice 2 Q222 / Data owners are PRIMARILY responsible for establishing risk mitigation methods to address which of the following areas? A. Platform security B. Entitlement changes C. Intrusion detection D. Antivirus controls

Source answer: B. Entitlement changes | Source explanation: Data owners are responsible for assigning user entitlements and approving access to the systems for which they are responsible. Platform security, intrusion detection and antivirus controls are all within the responsibility of the information security manager.

U097 / Practice 1 Q288 / Which of the following are the essential ingredients of a business impact analysis (B1A)? A. Downtime tolerance, resources and criticality B. Cost of business outages in a year as a factor of the security budget C. Business continuity testing methodology being deployed D. Structure of the crisis management team

Source answer: A. Downtime tolerance, resources and criticality | Source explanation: The main purpose of a BIA is to measure the downtime tolerance, associated resources and criticality of a business function. Options B, C and D are all associated with business continuity planning, but are not related to the BIA.

U099 / Practice 1 Q294 / To ensure that payroll systems continue on in an event of a hurricane hitting a data center, what would be the FIRS T crucial step an information security manager would take in ensuring business continuity planning? A. Conducting a qualitative and quantitative risk analysi B. Assigning value to the asset C. Weighing the cost of implementing the plan v D. financial los E. Conducting a business impact analysis (BIA).

REVIEW NOTE: DAMAGED OPTIONS: The source splits one option into C and D, then labels BIA as E, while its key says D. Its explanation supports "Conducting a business impact analysis (BIA)." Original text and key are preserved below. | Source answer: D. financial los | Source explanation: BIA is an essential component of an organization's business continuity plan; it includes an exploratory component to reveal any vulnerabilities and a planning component to develop strategies for minimizing risk. It is the first crucial step in business continuity planning. Qualitative and quantitative risk analysis will have been completed to define the dangers to individuals, businesses and government agencies posed by potential natural and human-caused adverse events. Assigning value to assets is part of the BIA process. Weighing the cost of implementing the plan vs. financial loss is another part of the BIA.

U104 / Practice 1 Q306 / The criticality and sensitivity of information assets is determined on the basis of: A. threat assessmen B. vulnerability assessmen C. resource dependency assessmen D. impact assessmen

Source answer: D. impact assessmen | Source explanation: The criticality and sensitivity of information assets depends on the impact of the probability of the threats exploiting vulnerabilities in the asset, and takes into consideration the value of the assets and the impairment of the value. Threat assessment lists only the threats that the information asset is exposed to. It does not consider the value of the asset and impact of the threat on the value. Vulnerability assessment lists only the vulnerabilities inherent in the information asset that can attract threats. It does not consider the value of the asset and the impact of perceived threats on the value. Resource dependency assessment provides process needs but not impact.

U105 / Practice 1 Q308 / The MOST appropriate owner of customer data stored in a central database, used only by an organization's sales department, would be the: A. sales departmen B. database administrato C. chief information officer (CIO). D. head of the sales departmen

Source answer: D. head of the sales departmen | Source explanation: The owner of the information asset should be the person with the decision-making power in the department deriving the most benefit from the asset. In this case, it would be the head of the sales department. The organizational unit cannot be the owner of the asset because that removes personal responsibility. The database administrator is a custodian. The chief information officer (CIO) would not be an owner of this database because the CTO is less likely to be knowledgeable about the specific needs of sales operations and security concerns.

U113 / Practice 1 Q331 / A business impact analysis (BIA) is the BEST tool for calculating: A. total cost of ownershi B. priority of restoratio C. annualized loss expectancy (ALE). D. residual ris

Source answer: B. priority of restoratio | Source explanation: A business impact analysis (BIA) is the best tool for calculating the priority of restoration for applications. It is not used to determine total cost of ownership, annualized loss expectancy (ALE) or residual risk to the organization.

U121 / Practice 1 Q356 / In a business impact analysis, the value of an information system should be based on the overall cost: A. of recover B. to recreat C. if unavailabl D. of emergency operation

Source answer: C. if unavailabl | Source explanation: The value of an information system should be based on the cost incurred if the system were to become unavailable. The cost to design or recreate the system is not as relevant since a business impact analysis measures the impact that would occur if an information system were to become unavailable. Similarly, the cost of emergency operations is not as relevant.

U128 / Practice 1 Q382; Practice 2 Q294 / Which of the following is the MOST appropriate use of gap analysis? A. Evaluating a business impact analysis (BIA) B. Developing a balanced business scorecard C. Demonstrating the relationship between controls D. Measuring current state v E. desired future state

REVIEW NOTE: DAMAGED OPTIONS: D and E are one split phrase: "Measuring current state vs. desired future state." Source key D is preserved. | Source answer: D. Measuring current state v | Source explanation: A gap analysis is most useful in addressing the differences between the current state and an ideal future state. It is not as appropriate for evaluating a business impact analysis (BIA), developing a balanced business scorecard or demonstrating the relationship between variables.

U129 / Practice 1 Q387; Practice 2 Q296 / The PRIMARY reason for assigning classes of sensitivity and criticality to information resources is to provide a basis for: A. determining the scope for inclusion in an information security progra B. defining the level of access control C. justifying costs for information resource D. determining the overall budget of an information security progra

Source answer: B. defining the level of access control | Source explanation: The assigned class of sensitivity and criticality of the information resource determines the level of access controls to be put in place. The assignment of sensitivity and criticality takes place with the information assets that have already been included in the information security program and has only an indirect bearing on the costs to be incurred. The assignment of sensitivity and criticality contributes to, but does not decide, the overall budget of the information security program.

U140 / Practice 1 Q413 / What is the MOST important item to be included in an information security policy? A. The definition of roles and responsibilities B. The scope of the security program C. The key objectives of the security program D. Reference to procedures and standards of the security program

Source answer: C. The key objectives of the security program | Source explanation: Stating the objectives of the security program is the most important element to ensure alignment with business goals. The other choices are part of the security policy, but they are not as important.

U144 / Practice 1 Q420 / The IT function has declared that, when putting a new application into production, it is not necessary to update the business impact analysis (BIA) because it does not produce modifications in the business processes. The information security manager should: A. verify the decision with the business unit B. check the system's risk analysi C. recommend update after post implementation revie D. request an audit revie

Source answer: A. verify the decision with the business unit | Source explanation: Verifying the decision with the business units is the correct answer because it is not the IT function's responsibility to decide whether a new application modifies business processes Choice B does not consider the change in the applications. Choices C and D delay the update.

U174 / Practice 2 Q48 / What is the PRIMARY role of the information security manager in the process of information classification within an organization? A. Defining and ratifying the classification structure of information assets B. Deciding the classification levels applied to the organization's information assets C. Securing information assets in accordance with their classification D. Checking if information assets have been classified properly

Source answer: A. Defining and ratifying the classification structure of information assets | Source explanation: Defining and ratifying the classification structure of information assets is the primary role of the information security manager in the process of information classification within the organization. Choice B is incorrect because the final responsibility for deciding the classification levels rests with the data owners. Choice C is incorrect because the job of securing information assets is the responsibility of the data custodians. Choice D may be a role of an information security manager but is not the key role in this context.

U181 / Practice 2 Q76 / Data owners must provide a safe and secure environment to ensure confidentiality, integrity and availability of the transaction. This is an example of an information security: A. baselin B. strateg C. procedur D. polic

Source answer: D. polic | Source explanation: A policy is a high-level statement of an organization's beliefs, goals, roles and objectives. Baselines assume a minimum security level throughout an organization. The information security strategy aligns the information security program with business objectives rather than making control statements. A procedure is a step-by step process of how policy and standards will be implemented.

U195 / Practice 2 Q191 / Which of the following is the PRIMARY prerequisite to implementing data classification within an organization? A. Defining job roles B. Performing a risk assessment C. Identifying data owners D. Establishing data retention policies

Source answer: C. Identifying data owners | Source explanation: Identifying the data owners is the first step, and is essential to implementing data classification. Defining job roles is not relevant. Performing a risk assessment is important, but will require the participation of data owners (who must first be identified). Establishing data retention policies may occur after data have been classified.

U198 / Practice 2 Q204 / Which of (lie following would be the MOST relevant factor when defining the information classification policy? A. Quantity of information B. Available IT infrastructure C. Benchmarking D. Requirements of data owners

Source answer: D. Requirements of data owners | Source explanation: When defining the information classification policy, the requirements of the data owners need to be identified. The quantity of information, availability of IT infrastructure and benchmarking may be part of the scheme after the fact and would be less relevant.

U199 / Practice 2 Q210 / Which of the following roles is PRIMARILY responsible for determining the information classification levels for a given information asset? A. Manager B. Custodian C. User D. Owner

Source answer: D. Owner | Source explanation: Although the information owner may be in a management position and is also considered a user, the information owner role has the responsibility for determining information classification levels. Management is responsible for higher-level issues such as providing and approving budget, supporting activities, etc. The information custodian is responsible for day-to-day security tasks such as protecting information, backing up information, etc. Users are the lowest level. They use the data, but do not classify the data. The owner classifies the data.

U202 / Practice 2 Q218 / Who would be in the BEST position to determine the recovery point objective (RPO) for business applications? A. Business continuity coordinator B. Chief operations officer (COO) C. Information security manager D. Internal audit

Source answer: B. Chief operations officer (COO) | Source explanation: The recovery point objective (RPO) is the processing checkpoint to which systems are recovered. In addition to data owners, the chief operations officer (COO) is the most knowledgeable person to make this decision. It would be inappropriate for the information security manager or an internal audit to determine the RPO because they are not directly responsible for the data or the operation.

U211 / Practice 2 Q268 / A company recently developed a breakthrough technology. Since this technology could give this company a significant competitive edge, which of the following would FIRST govern how this information is to be protected? A. Access control policy B. Data classification policy C. Encryption standards D. Acceptable use policy

Source answer: B. Data classification policy | Source explanation: Data classification policies define the level of protection to be provided for each category of data. Without this mandated ranking of degree of protection, it is difficult to determine what access controls or levels of encryption should be in place. An acceptable use policy is oriented more toward the end user and, therefore, would not specifically address what controls should be in place to adequately protect information.

U236 / Practice 2 Q374 / It is important to develop an information security baseline because it helps to define: A. critical information resources needing protectio B. a security policy for the entire organizatio C. the minimum acceptable security to be implemente D. required physical and logical access control

Source answer: C. the minimum acceptable security to be implemente | Source explanation: Developing an information security baseline helps to define the minimum acceptable security that will be implemented to protect the information resources in accordance with the respective criticality levels. Before determining the security baseline, an information security manager must establish the security policy, identify criticality levels of organization's information resources and assess the risk environment in which those resources operate.

U243 / Practice 2 Q392 / Good information security standards should: A. define precise and unambiguous allowable limit B. describe the process for communicating violation C. address high-level objectives of the organizatio D. be updated frequently as new software is release

Source answer: A. define precise and unambiguous allowable limit | Source explanation: A security standard should clearly state what is allowable; it should not change frequently. The process for communicating violations would be addressed by a security procedure, not a standard. High-level objectives of an organization would normally be addressed in a security policy.

U254 / Practice 2 Q428 / Data owners will determine what access and authorizations users will have by: A. delegating authority to data custodia B. cloning existing user account C. determining hierarchical preference D. mapping to business need

Source answer: D. mapping to business need | Source explanation: Access and authorizations should be based on business needs. Data custodians implement the decisions made by data owners. Access and authorizations are not to be assigned by cloning existing user accounts or determining hierarchical preferences. By cloning, users may obtain more access rights and privileges than is required to do their job. Hierarchical preferences may be based on individual preferences and not on business needs.

U259 / Practice 2 Q441 / Which of the following provides the linkage to ensure that procedures are correctly aligned with information security policy requirements? A. Standards B. Guidelines C. Security metrics D. IT governance

Source answer: A. Standards | Source explanation: Standards are the bridge between high-level policy statements and the "how to" detailed formal of procedures. Security metrics and governance would not ensure correct alignment between policies and procedures. Similarly, guidelines are not linkage documents but rather provide suggested guidance on best practices.

U267 / Practice 2 Q467 / The MOST appropriate individual to determine the level of information security needed for a specific business application is the: A. system develope B. information security manage C. steering committe D. system data owne

Source answer: D. system data owne | Source explanation: Data owners are the most knowledgeable of the security needs of the business application for which they are responsible. The system developer, security manager and system custodian will have specific knowledge on limited areas but will not have full knowledge of the business issues that affect the level of security required. The steering committee does not perform at that level of detail on the operation.