Program Communication and External Management CISM Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which characteristic is MOST important for a security metric to be useful?

   • AIt is easy to calculate
   • BIt is based on industry benchmarks
   • CIt is measurable and relevant to a security objective
   • DIt shows a positive trend
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary purpose of executive-level security reporting?

   • ATo replace the need for a risk register
   • BTo enable informed decisions on risk acceptance and resource allocation
   • CTo list all security incidents in detail
   • DTo provide step-by-step instructions for incident response
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A financial services firm is negotiating a contract with a new payment processor. The processor will handle cardholder data and will use a third-party data center for hosting. The firm's legal team wants to include a right-to-audit clause, but the processor refuses, citing the shared nature of their infrastructure. The CISO must balance the need for assurance with the practicality of the relationship. Which approach best addresses this conflict?

   • AInsist on an unrestricted right to audit the processor's entire infrastructure, including all shared systems, at any time.
   • BRequire the processor to provide a SOC 2 Type II report and a letter of attestation from the data center, and include a contractual right to request a third-party audit if the reports are not satisfactory.
   • CTerminate negotiations and select a different processor that allows full on-site audits of all systems.
   • DAccept the refusal and rely on the processor's annual PCI DSS attestation of compliance (AOC) as sufficient assurance.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which training delivery method is generally MOST effective for reinforcing security awareness on a continuous basis?

   • AShort, periodic micro-learning modules
   • BA comprehensive manual distributed once
   • CA single annual all-day training session
   • DA mandatory online course with no follow-up
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company's primary cloud provider has just announced that it will be using a new sub-processor for log management. The sub-processor will have access to security logs that contain sensitive information. The company's contract with the cloud provider includes a clause that requires the provider to notify customers of sub-processor changes and to allow customers to object. The CISO has 30 days to object. What is the most appropriate action for the CISO to take?

   • ARequest that the cloud provider sign an indemnification clause that holds the company harmless for any breach caused by the sub-processor.
   • BConduct a risk assessment of the sub-processor, including their security posture, data handling practices, and compliance with relevant regulations, and then decide whether to object.
   • CApprove the change without assessment because the cloud provider is a large, reputable company and they would not use an insecure sub-processor.
   • DObject to the change immediately because any new sub-processor introduces unacceptable risk to the security logs.
   Reveal Solution Discussion Select an answer first