ISACA CISM Practice Questions with Explanations

Correct answer: B

Risk analysis fundamentally helps organizations prioritize their security investments by identifying which assets face the greatest threats and require protection. This directly enables cost-effective decision-making about where limited security resources should be allocated. While risk analysis informs other decisions like access control and technology selection, the BEST overall purpose is ensuring resources are spent efficiently on protecting critical assets.

Why the other options are wrong:

• A. Risk analysis informs access control decisions but doesn't ensure their implementation.
• C. While risk analysis guides funding decisions, it doesn't directly apply funding itself.
• D. Risk analysis informs technology choices but doesn't mandate specific technologies.

Correct answer: D

Legal and regulatory requirements are mandatory obligations that take precedence over internal policies. If local regulations exist, they represent binding legal requirements that the organization must meet regardless of global policy preferences. Non-compliance with local regulations can result in legal penalties, fines, and loss of operating licenses, making regulatory requirements the ultimate authority in any jurisdiction.

Why the other options are wrong:

• A. Business objectives don't override regulatory requirements; compliance is mandatory.
• B. Practicality of awareness doesn't determine which requirements apply.
• C. Global policies may contain necessary controls; the real issue is that local regulations are mandatory.

Correct answer: D

A gap analysis is the FIRST appropriate step because it directly compares the organization's existing security controls against the new regulatory requirements, clearly identifying what is missing or inadequate. This establishes baseline understanding before committing resources. While risk assessment and cost-benefit analysis follow logically afterward, the gap analysis provides the foundational understanding of what controls need to be added or modified to meet the new requirement.

Why the other options are wrong:

• A. Cost-benefit analysis requires knowing the gap first.
• B. Risk assessment comes after understanding the specific gaps.
• C. Management interviews provide business context but not technical understanding of control gaps.

Correct answer: D

Risk management is the comprehensive process that evaluates how business strategy changes affect the organizational threat landscape, identifies new risks, and determines both whether existing controls remain adequate and what new controls are needed. Risk management encompasses the systematic evaluation and selection of controls in response to strategic shifts. While change management is also important operationally, risk management is the process specifically designed to evaluate and select controls based on new business contexts.

Why the other options are wrong:

• A. Access control management addresses a specific control type, not the overall evaluation needed.
• B. Change management handles implementation but not the control evaluation and selection process.
• C. Configuration management tracks settings but doesn't evaluate control adequacy or select new controls.

Correct answer: D

Establishing incentives and channels for staff to report risks creates a proactive, participatory risk-aware culture where employees feel empowered and rewarded for contributing to organizational security. This bottom-up engagement is more effective for building sustained cultural change than top-down messaging or testing. When employees are encouraged and motivated to identify and report risks, they become active participants in risk management rather than passive recipients of information.

Why the other options are wrong:

• A. Changing messages periodically doesn't build sustained awareness or behavioral change.
• B. Communicating threats is reactive and doesn't necessarily build a culture of proactive risk management.
• C. Testing compliance and posting results is accountability-focused but doesn't encourage proactive risk reporting.

Correct answer: C

An addendum to the existing contract is the practical, standard approach to address contractual gaps. It allows the organization to add specific data safeguarding requirements without disrupting the existing business relationship or requiring full contract renegotiation. This remedial measure is more practical than cancellation and more effective than risk transfer alone, as it establishes clear contractual obligations for the provider to implement protective measures.

Why the other options are wrong:

• A. Cancellation is an extreme response that disrupts business; amendment is more appropriate.
• B. Risk transfer without contractual obligations doesn't ensure the provider will actually implement safeguards.
• D. An audit verifies provider capabilities but doesn't address the contractual gap that must be filled.

Correct answer: A

Identifying which controls and security events need to be monitored is the MOST critical consideration before SIEM implementation because it determines the entire scope and success of the deployment. Without knowing what to monitor, the SIEM implementation lacks purpose and focus. Once monitoring requirements are defined, reporting capabilities, vendor contracts, and support can be evaluated to meet those specific needs. Monitoring requirements drive all other implementation decisions.

Why the other options are wrong:

• B. Reporting is important but depends first on knowing what will be monitored.
• C. The vendor contract is a supporting concern but not more important than defining monitoring requirements.
• D. Technical support is valuable but secondary to defining what the tool should actually monitor.

Correct answer: A

Definitions of responsibilities are the cornerstone of any enterprise security policy, clearly establishing who is accountable for various security functions and compliance. This is a high-level policy matter that applies organization-wide. Retention schedules and system access specifications are typically detailed in lower-level procedures or implementation standards rather than enterprise-level policies, and organizational risk is an input to policy rather than a component of it.

Why the other options are wrong:

• B. Retention schedules are typically found in records management procedures, not enterprise security policy.
• C. System access specifications are implementation-level details found in standards or procedures.
• D. Organizational risk is analyzed to inform policy but isn't typically included as policy content itself.

Correct answer: D

When a legacy application is noncompliant but lacks remediation budget, the information security manager must FIRST assess the consequences of noncompliance against remediation costs. This risk-benefit analysis is foundational to all subsequent decisions-it determines whether to pursue funding (A), accept risk (B), notify stakeholders (C), or take other action. Without understanding the actual risk exposure relative to cost, any decision lacks proper justification.

Why the other options are wrong:

• A. Developing a business case is premature without first understanding the severity of noncompliance risk.
• B. Risk acceptance requires prior assessment and is a decision made after analysis, not before.
• C. Notification to legal and audit is appropriate after assessment, but not the first action.

Correct answer: C

Ensuring security is involved in the procurement process is the MOST effective approach because it embeds security requirements from the beginning of vendor selection and contract negotiation, rather than addressing concerns reactively. Early involvement allows security to shape contract terms, vendor selection criteria, and requirements. While other options (legal review, policy communication, audits) are supportive activities, early procurement involvement is the most proactive and comprehensive method.

Why the other options are wrong:

• A. Legal department review is important but doesn't ensure security concerns are identified and addressed during negotiations.
• B. Communicating policy after vendor selection is reactionary rather than preventive.
• D. Auditing after contract signature may be too late to negotiate favorable security terms.

Correct answer: B

Encrypting consumer data in transit and at rest is the BEST comprehensive method to protect private information because it addresses the two most critical exposure points- data moving across networks and data stored on servers. This protects data regardless of other security gaps and is a defense-in-depth fundamental. While strong authentication (A), secure transport (C), and masking (D) are useful, encryption provides the broadest protection across all states of data.

Why the other options are wrong:

• A. Strong authentication protects account access but doesn't protect data itself from exposure.
• C. Secure transport layer only protects data in transit, not at rest.
• D. Masking is useful for display/analytics but doesn't prevent unauthorized access to actual data values.

Correct answer: B

The ability to centrally manage devices is the MOST important protection for company data loss in BYOD because it enables enforcement of security policies, remote wipe capabilities, encryption requirements, and compliance monitoring across all devices. Central management provides comprehensive control and visibility. While locating devices (A) helps recovery and other controls (C, D) are useful, central management encompasses the broadest protective capabilities.

Why the other options are wrong:

• A. Remote location helps find lost devices but doesn't guarantee data protection or enable data deletion.
• C. Restricting unapproved applications is one control but doesn't address data loss directly.
• D. Device classification helps organization but doesn't directly protect data in loss scenarios.

Correct answer: B

Performing a risk assessment provides the BEST information to determine if an initiative has reduced risk to acceptable levels because it measures residual risk post- implementation against defined thresholds. A risk assessment directly evaluates whether security controls achieved their intended risk reduction. Cost-benefit analysis (A) measures value but not risk reduction; risk register (C) documents known risks but may not capture current state; BIA (D) measures business impact, not security effectiveness.

Why the other options are wrong:

• A. Cost-benefit analysis shows financial value but doesn't measure whether risk is actually at acceptable levels.
• C. Risk register documents identified risks but doesn't measure whether implemented controls reduced risk sufficiently.
• D. Business impact analysis assesses potential damage but doesn't evaluate security control effectiveness.

Correct answer: B

Appropriate service level agreements (SLAs) are the BEST way to address risk monitoring and timely response concerns because they define measurable performance standards, availability guarantees, incident response times, and remediation requirements. SLAs provide contractual enforcement mechanisms and clear expectations. While technical support (A), audit rights (C), and internal standards (D) are relevant, SLAs are the primary contractual vehicle that ensures vendor accountability and timely response.

Why the other options are wrong:

• A. Continuous technical support doesn't define response times or accountability requirements.
• C. Audit clauses enable verification but don't mandate vendor response times or SLA commitments.
• D. Internal standards apply to the organization but don't enforce vendor behavior or timelines.

Correct answer: B

Aligning policies to the most stringent global regulations ensures compliance with all applicable data security requirements, since adherence to the highest standard automatically satisfies lower standards. This approach future-proofs the organization and prevents gaps where one jurisdiction's requirements exceed another. Executive sign-off (A) approves policies but doesn't ensure compliance; stakeholder review (C) gathers input but doesn't guarantee regulatory alignment; outsourcing (D) transfers responsibility but remains the organization's ultimate obligation.

Why the other options are wrong:

• A. Executive sign-off demonstrates approval but doesn't ensure policies meet regulatory requirements.
• C. Stakeholder review gathers perspectives but doesn't guarantee compliance with external regulatory requirements.
• D. Outsourcing compliance activities doesn't eliminate organizational responsibility for compliance.

Correct answer: C

The PRIMARY reason for defining information security roles and responsibilities is to enforce individual accountability by making clear who is responsible for specific security tasks and decisions. This establishes clear ownership, enables performance measurement, and ensures security obligations are not ambiguous. While compliance (A) is a consequence, increasing accountability (B) is broader than enforcing it, and training (D) is a supporting activity, individual accountability is the foundational purpose that drives all other benefits.

Why the other options are wrong:

• A. Policy compliance is a benefit of defined roles, not the primary reason for defining them.
• B. Corporate accountability is broader; the specific purpose is individual accountability.
• D. Training reinforcement is a supporting benefit but not the primary reason roles are defined.

Correct answer: B

Threat and vulnerability assessments are primarily conducted to estimate and understand risk. Risk is defined as the combination of threat and vulnerability; without assessing these elements, an organization cannot quantify or estimate its risk exposure. While assessments may inform investments, control objectives, and posture, their PRIMARY purpose is risk estimation-this is the foundational reason they are performed.

Why the other options are wrong:

• A. Assessments inform investment decisions but are not performed primarily for that purpose.
• C. Control objectives are derived from risk assessment results, not the primary reason for conducting assessments.
• D. Assessments are components of security posture but risk estimation is the more direct primary purpose.

Correct answer: A

During development of a critical system with highly confidential data, the primary focus should be ensuring that residual risk (risk remaining after controls are applied) is at an acceptable level. This represents the ultimate security objective-reducing risk to a level the organization can tolerate. While reducing vulnerabilities and complying with regulations are important supporting activities, the manager's primary focus must be on whether the overall risk exposure is acceptable to the business.

Why the other options are wrong:

• B. Reducing vulnerabilities is a means to an end; the goal is acceptable residual risk, not a specific vulnerability count.
• C. Avoiding threats entirely is often impossible; the focus should be on managing risk, not complete avoidance.
• D. Compliance is necessary but may not be sufficient; regulatory compliance does not guarantee acceptable risk levels.

Correct answer: B

The FIRST step in vendor evaluation for sensitive data processing must be to establish information security criteria as part of the vendor selection process itself. This ensures security is built into the vendor evaluation framework from the beginning. Only after establishing these criteria can metrics be developed, reports be meaningfully reviewed, or contracts be properly drafted. Security must be a fundamental selection criterion, not an afterthought.

Why the other options are wrong:

• A. Metrics are developed after security criteria are established, making this a secondary step.
• C. Third-party reports review existing vendors but presupposes that selection criteria have already been defined.
• D. Contracts are drafted based on established criteria; contractual clauses should reflect pre-defined security requirements.

Correct answer: B

A SIEM tool is the BEST single source because it aggregates and correlates logs and events from across the entire infrastructure, providing comprehensive visibility into system activities, network traffic, and security events. While FIM, IDS, and antivirus provide valuable specialized data, a SIEM provides the broadest and most integrated view of what occurred during an alleged breach, making it the single best source for investigation.

Why the other options are wrong:

• A. FIM only tracks file changes and integrity, providing limited scope for breach investigation.
• C. IDS focuses on intrusion attempts but may miss lateral movement and post-breach activities.
• D. Antivirus logs focus on malware detection and are narrower in scope than a comprehensive SIEM.

Correct answer: B

The criticality of a service to the organization is MOST helpful in determining vendor risk because it directly correlates to the business impact if that vendor fails or is compromised. High-criticality services warrant higher security requirements and closer monitoring. While compliance requirements, breach history, and compensating controls all matter, criticality fundamentally determines how much risk exposure the organization should tolerate from each vendor.

Why the other options are wrong:

• A. Compliance requirements are compliance-specific and don't directly measure the vendor's criticality to operations.
• C. Breach history is backward-looking and may not reflect current security posture or future risk.
• D. Compensating controls reduce risk but do not determine the base level of vendor risk exposure.

Correct answer: D

Escalation processes are the MOST important security consideration in incident response strategy with a cloud provider because they determine how quickly and effectively the organization can engage the provider, report incidents, and coordinate response actions. Without clear escalation procedures, critical incident response time may be lost. While audit reports, RTO, and technological capabilities are important, escalation processes directly enable effective incident response coordination.

Why the other options are wrong:

• A. Security audit reports provide assurance but do not directly enable incident response.
• B. RTO is important for recovery planning but escalation processes are critical for response initiation.
• C. Technological capabilities support response but escalation defines who does what and when.

Correct answer: B

The GREATEST challenge occurs when executive leadership views information security governance primarily as a concern of the IT/security team rather than recognizing it as an organizational governance responsibility. This lack of executive ownership undermines the entire framework because effective security governance requires board-level and executive commitment. When leadership sees it as only a technical team concern, implementation will lack the necessary organizational support, budget, and strategic alignment.

Why the other options are wrong:

• A. Executive involvement in decisions actually supports successful governance implementation.
• C. While staff experience gaps are challenges, they can be addressed through the consulting engagement.
• D. This represents a problem with information security management, not the greatest challenge to framework success.

Correct answer: D

Risk scenarios simplify the risk assessment process by focusing on important and relevant risks rather than attempting to enumerate every theoretically possible risk. Scenarios provide a practical, structured approach that concentrates analysis efforts on meaningful threats and vulnerabilities. This focused approach makes assessment manageable while ensuring that significant risks receive appropriate attention, rather than becoming overwhelmed by exhaustive risk enumeration.

Why the other options are wrong:

• A. Scenarios are necessarily selective and do not cover the full range of all possible risks.
• B. Scenarios are assessment tools; mitigation success depends on response to findings, not the scenarios themselves.
• C. Scenarios structure assessment but do not eliminate the need for evaluation and response planning.

Correct answer: C

For security objectives to be effective and actionable, they must first and foremost be clear and understandable to all stakeholders. Without clarity and comprehension, stakeholders cannot properly support, implement, or measure against the objectives. While reassessment, approval, and alignment with frameworks are all important, they are secondary considerations that depend on the foundational requirement of clarity.

Why the other options are wrong:

• A. Reassessment and reporting are important ongoing activities but not the primary consideration when initially developing objectives.
• B. Approval by IT governance is a procedural step that should occur after objectives are properly defined and understood.
• D. Using frameworks is a good practice for developing objectives, but clarity of communication is the most critical foundational element.

Correct answer: A

When faced with a compliance gap requiring significant investment, the information security manager must first understand the full scope of the problem by assessing the business impact. This assessment informs whether remediation should proceed, how urgent it is, and what level of resources to justify. Understanding impact precedes cost determination and is necessary before presenting risk to management or exploring alternatives.

Why the other options are wrong:

• B. Presenting risk to management should follow a thorough understanding of the business impact and available options.
• C. Investigating alternatives is premature before understanding the actual business impact of the noncompliance.
• D. Cost determination should follow impact assessment, as the severity of impact influences priority and investment decisions.

Correct answer: A

A security-aware corporate culture is the foundation that enables effective information security governance. Without cultural awareness and buy-in across the organization, even the best technologies, metrics, and assessments will fail to achieve their objectives. Culture drives behavior, compliance, and support for security initiatives, making it the most enabling factor for governance effectiveness.

Why the other options are wrong:

• B. Advanced technologies are tools that support governance but cannot substitute for cultural understanding and commitment.
• C. Vulnerability assessments are tactical security activities that feed into governance but do not enable it.
• D. Security metrics measure governance effectiveness but are not what enable governance to function in the first place.

Correct answer: B

Reconciliation routines such as checksums, hash totals, and record counts directly address data integrity by detecting unauthorized or accidental modifications to data. These techniques verify that data has not been altered during storage or transmission. The other options address related but different concerns: data dictionaries ensure consistency, audit trails provide accountability, and access controls prevent unauthorized access rather than detecting integrity violations.

Why the other options are wrong:

• A. A data dictionary enforces consistency but does not directly detect integrity violations or modifications.
• C. Audit trails provide accountability and traceability but do not directly validate that data has maintained its integrity.
• D. Access controls prevent unauthorized users from modifying data but do not detect if integrity has been compromised.

Correct answer: B

A risk analysis comprehensively evaluates both threats and vulnerabilities alongside asset value and likelihood to determine the appropriate level of protection needed. Risk analysis produces the quantitative and qualitative basis for protection decisions. While risk appetite influences the decision, a risk analysis is what objectively determines what level of protection is needed based on the actual risk profile of each asset.

Why the other options are wrong:

• A. Risk appetite is a policy guideline that constrains how much risk to accept, but does not determine what protection level each asset needs.
• C. A threat assessment alone does not account for asset value, vulnerability, or likelihood necessary to determine appropriate protection.
• D. A vulnerability assessment alone does not include asset value or threat likelihood needed to determine appropriate protection levels.

Correct answer: B

The first step in developing any business case must be to clearly define the issues and problems that need to be addressed. Without understanding what problems the IDS solution is meant to solve, TCO calculations, cost-benefit analyses, and feasibility studies lack proper context and justification. Problem definition provides the foundation for all subsequent analytical steps.

Why the other options are wrong:

• A. TCO calculations are important but should follow after defining what business problems need solving.
• C. Cost-benefit analysis requires first understanding what issues are being addressed and what benefits are expected.
• D. A feasibility study is premature before clearly defining the business issues and requirements driving the solution.

Correct answer: D

When managing incidents involving cloud services, establishing a clear agreement on the definition of what constitutes a security incident is most critical. Without agreed-upon definitions, the organization and cloud provider may not coordinate effectively on incident detection, reporting, and response. This foundational agreement is essential for any cloud incident management process, particularly given the shared responsibility model of cloud services.

Why the other options are wrong:

• A. Data classification is important but is a prerequisite activity separate from incident management coordination.
• B. Personnel expertise is important but is secondary to having agreed incident definitions and protocols with the cloud provider.
• C. A SIEM is a useful tool but is not specific to cloud incident management and is less critical than agreed incident definitions.

Correct answer: B

Validating the effectiveness of implemented security controls provides the most direct measurement of maturity because it determines whether controls are actually achieving their intended outcomes. Maturity is demonstrated through control effectiveness rather than awareness scores, policy alignment, or incident trends. Effective controls indicate a mature program; ineffective controls indicate gaps regardless of other metrics.

Why the other options are wrong:

• A. Awareness testing indicates training effectiveness but does not measure whether security controls are working as intended.
• C. Policy alignment with standards shows compliance with best practices but does not validate that implemented controls are actually effective.
• D. Incident trending shows historical outcomes but is a lagging indicator; control effectiveness is a more direct measure of program maturity.

Correct answer: D

Multi-factor authentication (MFA) is the most effective preventive control against brute force attacks because it makes credential compromise alone insufficient to gain access. Even if an attacker successfully guesses or obtains a password, they cannot authenticate without the second factor. While options A, B, and C improve detection and monitoring capabilities, they are reactive measures that occur after attack attempts. MFA actively prevents unauthorized access at the authentication layer, which is the most direct defense against brute force attacks.

Why the other options are wrong:

• A. Log monitoring detects attacks but does not prevent them from occurring.
• B. SIEM provides visibility into attacks but is a detection tool, not a prevention mechanism.
• C. Increasing IDS sensitivity improves detection but does not stop attackers from attempting authentication.

Correct answer: A

The information security manager's primary role in supporting the privacy officer is ensuring that appropriate technical and operational controls are in place to protect personal data. This is the foundational responsibility-implementing the mechanisms that enforce privacy requirements. While options B, C, and D are related to privacy management, they are secondary activities or responsibilities that may fall to other roles. The security manager's core function is to operationalize privacy requirements through controls.

Why the other options are wrong:

• B. Monitoring data transfers is an operational activity but not the primary role of the security manager.
• C. Data classification is typically a privacy officer or business function, not the security manager's primary responsibility.
• D. Awareness programs are educational but secondary to implementing the actual technical controls.

Correct answer: B

The most likely reason for lack of senior management commitment is insufficient business engagement during strategy development. When business stakeholders are not involved in creating the security strategy, they do not understand how it aligns with business objectives, do not feel ownership of it, and are unlikely to commit resources. A strategy developed in isolation by security professionals without business input appears disconnected from business priorities and goals, making executive funding difficult to justify regardless of technical merit.

Why the other options are wrong:

• A. While cost-benefit analysis strengthens a business case, its absence is a symptom rather than the root cause of commitment issues.
• C. Compliance with standards is important but does not directly drive senior management funding decisions.
• D. Reporting structure affects implementation but is not the primary reason for lack of commitment to a well-developed strategy.

Correct answer: B

The most significant issue is that the committee lacks sufficient business representation. The composition includes the CIO, IT shared services manager, VP of marketing, and the security manager-only one non-IT executive (marketing VP) represents the broader business. An effective information security steering committee requires representation from multiple business units and departments whose operations depend on information security, not just IT and one marketing executive. Without adequate business representation, the committee cannot properly understand business priorities, risks, and requirements needed to guide security strategy.

Why the other options are wrong:

• A. Having senior executives on a steering committee is appropriate and expected; more executives is not inherently a problem.
• C. While business-IT alignment is important, this is not framed as a conflict but as a potential governance gap.
• D. The CIO's leadership of the committee is actually appropriate; this is not an issue.

Correct answer: B

The primary purpose of an unannounced disaster recovery exercise is to evaluate how personnel react to the situation in real, unscripted conditions. Unannounced drills test actual response capabilities, decision-making, and personnel behavior without the artificial preparation that comes with announced exercises. This reveals true readiness and identifies gaps in training, communication, and procedures. While metrics, SLA assessment, and RTO estimation are valuable byproducts, the core value of the unannounced approach is observing genuine personnel responses and organizational behavior under stress.

Why the other options are wrong:

• A. Providing metrics is an outcome, not the primary purpose of the exercise itself.
• C. SLA assessment can be done through announced or unannounced exercises; it is not what makes unannounced exercises distinctive.
• D. RTO estimation requires controlled testing; unannounced exercises measure actual behavior, not just timing metrics.

Correct answer: C

Labeling information according to security classification enhances the likelihood that people will handle information securely. Clear classification labels guide users on proper handling procedures, access restrictions, and protection measures. When information is visibly labeled with its sensitivity level, individuals are more aware of its value and are more likely to follow appropriate security practices. This awareness-driven behavior change is the primary benefit that directly improves security outcomes across the organization.

Why the other options are wrong:

• A. Classification actually increases the need to identify baseline controls appropriate for each classification level.
• B. Classification typically increases the types of countermeasures required, tailored to different classification levels.
• D. While consequences may be affected, this is not the primary purpose or benefit of classification labeling.

Correct answer: D

The most effective approach for determining whether an information security program supports the strategy is to develop key performance indicators (KPIs) that measure alignment between program activities and strategic objectives. KPIs provide measurable criteria to assess whether program implementation is achieving strategic goals. This allows for objective evaluation of progress and effectiveness. While options A, B, and C are related activities, KPIs create a structured measurement framework that directly demonstrates the connection between program execution and strategy achievement.

Why the other options are wrong:

• A. Ensuring adequate resources is important but does not measure whether the program supports the strategy.
• B. Auditing for deficiencies identifies problems but not whether the program strategically aligns with objectives.
• C. Identifying gaps is part of assessment but KPIs provide a more comprehensive measurement approach.

Correct answer: C

A corporate privacy statement for a public website MUST include an explanation of how information is used. This is a fundamental requirement under privacy regulations and best practices-users must understand what the organization will do with their personal data. This transparency about information usage is a legal and ethical obligation that forms the core of any privacy statement. The other options, while potentially valuable, are not mandatory components of a privacy statement.

Why the other options are wrong:

• A. Liability clauses are legal disclaimers but not required elements of privacy statements.
• B. Access control requirements are internal security measures, not content that must be disclosed in a privacy statement.
• D. While encryption is a good practice, specific encryption requirements are not a mandatory component of a privacy statement.

Correct answer: A

Enforcing standard system configurations based on secure configuration benchmarks is the best preventive control to mitigate vulnerabilities. Secure configuration benchmarks (such as CIS Benchmarks) address known vulnerabilities at the root by hardening systems before they are deployed. This eliminates vulnerabilities proactively rather than detecting or responding to exploitation attempts after the fact.

Why the other options are wrong:

• B. Anomaly monitoring detects attacks but does not prevent vulnerabilities from existing.
• C. Logging and audit trails are detective controls that help with forensics but don't prevent exploitation.
• D. Host-based IDS detects intrusions but is a detective control, not preventive like secure configuration.

Correct answer: D

Defining acceptable information for posting is the most foundational and important step when establishing social networking guidelines. This clarifies what employees can and cannot share, protecting both organizational and personal information. Without clarity on acceptable use, other measures like disciplinary actions lack clear standards to enforce.

Why the other options are wrong:

• A. Identifying secure sites is helpful but doesn't address the core risk of inappropriate information disclosure.
• B. Disciplinary actions should follow policy definition, not precede it.
• C. Vulnerability assessment of social platforms is less critical than defining organizational policy and acceptable use.

Correct answer: A

Including the impact of unpatched software risk as part of regular metrics provides senior management with consistent, quantifiable visibility into the risk over time. This approach integrates security risk into business performance metrics and allows leadership to track trends and make informed decisions based on objective data.

Why the other options are wrong:

• B. Direct notifications without context or metrics are less effective than integrated reporting.
• C. While a steering committee review may occur, it doesn't directly help management understand the risk.
• D. Updating risk assessment is important but doesn't specifically communicate the risk to senior management as effectively as metrics integration.

Correct answer: A

Tabletop exercises are the best method to prepare incident response teams for a variety of scenarios. They simulate realistic security incidents in a controlled environment, allowing teams to practice procedures, identify gaps, and improve coordination without the costs and risks of live drills or penetration tests.

Why the other options are wrong:

• B. Forensics certification develops individual expertise but doesn't prepare the team for varied scenarios.
• C. Penetration tests validate security defenses but don't specifically prepare the response team for incident handling.
• D. Disaster recovery drills focus on business continuity, not incident response team preparedness.

Correct answer: A

Security strategy training (user awareness training) is the most effective defense against phishing attacks. Phishing exploits human psychology through social engineering, and training users to recognize phishing indicators, verify sender identity, and avoid suspicious links/attachments directly addresses the attack vector. This controls the weakest link-the user.

Why the other options are wrong:

• B. Email filtering can reduce phishing volume but sophisticated attacks evade filters.
• C. Network encryption protects data in transit but doesn't prevent phishing attacks themselves.
• D. Application whitelisting controls executable software but doesn't prevent users from clicking malicious links.

Correct answer: D

Screening prospective employees is the most effective method of preventing deliberate internal security breaches. Background checks, reference verification, and integrity assessments identify individuals with malicious intent or high-risk profiles before they gain access to systems and data. This prevents the threat from existing in the first place.

Why the other options are wrong:

• A. IDS detects attacks but cannot prevent an authorized insider from deliberately breaching security.
• B. Biometric controls restrict physical access but do not prevent authorized employees from causing breaches.
• C. Firewalls protect network perimeter but cannot prevent insiders with legitimate access from breaching security.

Correct answer: D

Applying a risk-based approach is most important when designing security controls. This ensures resources are allocated to address the greatest risks first, balancing security investments with business needs. A risk-based approach considers likelihood, impact, and organizational priorities rather than implementing controls uniformly or arbitrarily.

Why the other options are wrong:

• A. While preventive controls are valuable, detective and corrective controls are also essential in a layered approach.
• B. Controls should protect all sensitive information based on risk, not just confidential information.
• C. Cost evaluation is important but secondary to risk assessment in determining which controls to implement.

Correct answer: C

Assessing business impact against security risk is the best course of action when there is a conflict between security and user experience. This involves quantifying both the security benefit of increased complexity and the business cost of reduced usability, allowing informed decision-making about whether to implement the change or seek alternative solutions.

Why the other options are wrong:

• A. Evaluating compensating controls may follow risk assessment but doesn't directly address the core conflict.
• B. Quantifying security risk alone ignores the business impact dimension needed to make a decision.
• D. Industry benchmarking provides context but doesn't resolve the specific trade-off between security and usability.

Correct answer: A

The PRIMARY responsibility of an information security manager is to establish the governance and policy framework for mobile device security. While options B and D are important technical controls and option C is important training, reviewing and updating existing security policies is the foundational responsibility that encompasses strategy, compliance, and oversight for the entire mobile device implementation program.

Why the other options are wrong:

• B. Enforcing passwords and encryption is a technical implementation task, not the primary management responsibility.
• C. Security awareness training is important but is a supporting activity, not the primary responsibility.
• D. Requiring remote wipe capabilities is a specific technical control, not the overarching primary responsibility.

Correct answer: A

Key Performance Indicators (KPIs) are specifically designed to measure and communicate the status of security compliance in a way that senior management can understand and track progress. KPIs translate security activities into business-relevant metrics that show whether compliance objectives are being met. While risk assessments and benchmarks provide input, and BIA shows impact, KPIs are the MOST useful vehicle for communicating status.

Why the other options are wrong:

• B. Risk assessment results identify what needs to be done but don't clearly communicate compliance status.
• C. Industry benchmarks provide comparisons but don't show internal organizational compliance status.
• D. Business impact analysis results focus on potential consequences rather than current compliance status.