New (2025) Download free CISM PDF for ISACA Practice Tests [Q324-Q343] : Latest Exam Prep : http://certify.vceprep.com

QUESTION 324
The PRIORITY action to be taken when a server is infected with a virus is to:

isolate the infected server(s) from the network.

identify all potential damage caused by the infection.

ensure that the virus database files are current.

establish security weaknesses in the firewall.

QUESTION 325
When developing a categorization method for security incidents, the categories MUST:

align with industry standards.

be created by the incident handler.

have agreed-upon definitions.

align with reporting requirements.

QUESTION 326
Which of the following should be established FIRST when implementing an information security governance framework?

Security incident management team

Security policies

Security awareness training program

Security architecture

QUESTION 327
While responding to a high-profile security incident, an information security manager observed several deficiencies in the current incident response plan. When would be the BEST time to update the plan?

While responding to the incident

During a tabletop exercise

During post-incident review

After a risk reassessment

QUESTION 328
An organization’s marketing department has requested access to cloud-based collaboration sites for exchanging media files with external marketing companies. As a result, the information security manager has been asked to perform a risks assessment. Which of the following should be the MOST important consideration?

The information to be exchanged

Methods for transferring the information

Reputations of the external marketing companies

The security of the third-party cloud provider

QUESTION 329
When an organization is implementing an information security governance program, its board of directors should be responsible for:

drafting information security policies.

reviewing training and awareness programs.

setting the strategic direction of the program.

auditing for compliance.

QUESTION 330
Senior management commitment and support for information security will BEST be attained by an information security manager by emphasizing:

organizational risk.

organization wide metrics.

security needs.

the responsibilities of organizational units.

QUESTION 331
Web application firewalls are needed in addition to other intrusion prevention and detection technology PRIMARILY because:

web services require unique forensic evidence

they prevent modification of application source code

they recognize web application protocols.

web services are prone to attacks.

QUESTION 332
Which of the following is the MOST effective defense against malicious insiders compromising confidential information?

Regular audits of access controls

Strong background checks when hiring staff

Prompt termination procedures

Role-based access control4

QUESTION 333
When evaluating vendors for sensitive data processing, which of the following should be the FIRST step to ensure the correct level of information security is provided?

Include information security clauses in the vendor contract.

Develop metrics for vendor performance.

Include information security criteria as part of vendor selection.

Review third-party reports of potential vendors.

QUESTION 334
IT projects have gone over budget with too many security controls being added post-production.
Which of the following would MOST help to ensure that relevant to a project?

Involving information security at each stage of project management

Creating a data classification framework and providing it to stakeholders

Identifying responsibilities during the project business case analysis

Providing stakeholders with minimum information security requirements

QUESTION 335
Which of the following devices should be placed within a DMZ?

Proxy server

Application server

Departmental server

Data warehouse server

QUESTION 336
Which of the following is the MOST effective way to ensure information security policies are understood?

Implement a whistle-blower program.

Provide regular security awareness training.

Include security responsibilities in job descriptions.

Document security procedures.

QUESTION 337
A risk has been formally accepted and documented.
Which of the following is the MOST important action for an information security manager?

Update risk tolerance levels.

Notify senior management and the board.

Monitor the environment for changes.

Re-evaluate the organization’s risk appetite.

QUESTION 338
Which of the following is the MOST important requirement for a successful security program?

Mapping security processes to baseline security standards

Penetration testing on key systems

Management decision on asset value

Nondisclosure agreements (NDA) with employees

QUESTION 339
An anomaly-based intrusion detection system (IDS) operates by gathering data on:

normal network behavior and using it as a baseline lor measuring abnormal activity

abnormal network behavior and issuing instructions to the firewall to drop rogue connections

abnormal network behavior and using it as a baseline for measuring normal activity

attack pattern signatures from historical data

QUESTION 340
The root cause of a successful cross site request forgery (XSRF) attack against an application is that the vulnerable application:

uses multiple redirects for completing a data commit transaction.

has implemented cookies as the sole authentication mechanism.

has been installed with a non-1egitimate license key.

is hosted on a server along with other applications.

QUESTION 341
Which of the following should be an information security manager’s MOST important concern to ensure admissibility of information security evidence from cyber crimes?

Chain of custody

Tools used for evidence analysis

Forensics contractors

Efficiency of the forensics team

QUESTION 342
Which of the following is the BEST course of action when an online company discovers a network attack in progress?

Dump all event logs to removable media

Isolate the affected network segment

Enable trace logging on ail events

Shut off all network access points

QUESTION 343
Which of the following should an information security manager do FIRST when creating an organization’s disaster recovery plan (DRP)?

Conduct a business impact analysis (BIA)

Identify the response and recovery learns.

Review the communications plan.

Develop response and recovery strategies.