Program Implementation and Operations CISM Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the PRIMARY basis for designing security controls?

   • AThe latest security trends
   • BThe results of a risk assessment
   • CThe preferences of the security team
   • DThe budget available for security
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A financial services firm wants to measure the effectiveness of its new endpoint detection and response (EDR) program. The CISO wants a metric that directly reflects the program's contribution to reducing business risk. Which metric would best align with this objective?

   • ATotal cost of EDR licenses and maintenance
   • BPercentage of endpoints with EDR agent installed
   • CMean time to respond (MTTR) to confirmed incidents
   • DNumber of EDR alerts generated per month
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company has implemented a new firewall and wants to verify that it is correctly blocking unauthorized traffic. Which testing method would provide the most direct evidence of the firewall's effectiveness?

   • AAttempt to connect to blocked ports from outside the network
   • BAnalyze firewall logs for denied connections
   • CReview the firewall's configuration against the security policy
   • DUse a vulnerability scanner to identify open ports
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the FIRST step after identifying a control deficiency during testing?

   • AImmediately implement a fix
   • BReport the deficiency to law enforcement
   • CIgnore the deficiency if it is minor
   • DEvaluate the risk associated with the deficiency
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the PRIMARY difference between a vulnerability assessment and a penetration test?

   • AA vulnerability assessment is more expensive
   • BA penetration test is always automated
   • CA vulnerability assessment is only for external systems
   • DA penetration test attempts to exploit vulnerabilities to determine impact
   Reveal Solution Discussion Select an answer first