Information Security Strategy Development CISM Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   What is the primary purpose of strategy formulation in information security?

   • ATo conduct a current state assessment
   • BTo implement security controls immediately
   • CTo develop strategic objectives and initiatives to close identified gaps
   • DTo monitor security performance metrics
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A financial institution has completed a current state assessment and a target state definition. The gap analysis has identified several deficiencies: (1) no encryption for data at rest in legacy systems, (2) lack of a formal vendor risk management program, and (3) insufficient logging for critical financial transactions. The CISO has limited budget and must prioritize initiatives. The organization is facing an upcoming regulatory audit in six months. Which initiative should be prioritized first?

   • AImplementing encryption for data at rest in legacy systems.
   • BDeferring all initiatives until after the audit to avoid disruption.
   • CEstablishing a vendor risk management program.
   • DEnhancing logging for critical financial transactions.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A CISO has implemented a security strategy with the objective of reducing the mean time to detect (MTTD) and mean time to respond (MTTR) to security incidents. The CISO must define KPIs to monitor the strategy's effectiveness. Which KPI set is most appropriate for this objective?

   • ANumber of security policies updated and the frequency of risk assessments.
   • BPercentage of employees who completed security awareness training.
   • CNumber of security tools deployed and the total security budget spent.
   • DAverage time from initial compromise to detection, and average time from detection to containment.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which of the following BEST describes the target state of information security?

   • AA set of security metrics used to measure performance
   • BA snapshot of the current security environment
   • CA detailed list of all security controls that will be implemented
   • DA desired future security posture that supports business objectives and aligns with risk appetite
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which of the following is a type of resource that should be considered in resource planning for security strategy implementation?

   • AFinancial resources
   • BLegal resources
   • CFacilities resources
   • DMarketing resources
   Reveal Solution Discussion Select an answer first