CISM 試験練習問題

D

Correct answer: Identifies an organization's current incident response and where it aims to be A gap analysis identifies an organization's current incident response and where it aims to be. This allows the organization to identify weaknesses, improve, advance, and identify additional resources needed for this advancement. A gap analysis does not show the change from one point in time to another in the history of incident response plans. It also doesn't address potential or frequent vulnerabilities with commonly used services or identify a lack of patches and security configurations like a vulnerability scanner would.CISM Review Manual, 16th Edition. Pg 270.

D

Correct answer: Mismatch to organizational goals and structure A mismatch to organizational goals and structure is the most likely problem with a fast-growing company. It is simply likely that the IMT and their plans will not keep up with the growth (according to ISACA; this may not be true for your business). The other options are all sources of challenges. They may be what you are facing in your business, but the exam is about what is most likely: the rule, not the exception.CISM Review Manual, 16th Edition. Pg 272–273.

B

Correct answer: Vulnerability A vulnerability is a weakness in a system (or other places). The vulnerability could be exploited and result in a compromise. The compromise would be an incident. The patch is the standard fix for weaknesses within the code of a server, its Operations System (OS), or applications. The threat is the damage that this incident could cause.CISM Review Manual, 16th Edition. Pg 269.

B

Correct answer: Information security manager The information security manager is most likely to be responsible for information security incidents. The Chief Executive Officer (CEO) or Board of Directors (BoD) would be accountable. If not accountable, they would be informed. The Chief Risk Officer (CRO) would be consulted and informed.CISM Review Manual, 16th Edition. Pg 256.

D

Correct answer: Recovery Time Objective (RTO) The RTO has three definitions in the ISACA manual. Due to the way this scenario is constructed, it is the only answer to the question. RTO could be the entire time of nonfunctionality, the time from failure to technical recovery, or, as in this question, the time from disaster declaration to operational status. The RPO is the age of the data that is recovered from something like a backup tape. The MTO is the amount of time that the corporation can tolerate being in the alternate processing mode. The SDO is the percentage of functionality that must be at the alternate processing site.CISM Review Manual, 16th Edition. Pg 286.