Program Implementation and Operations CISM Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security team has implemented a new web application firewall (WAF). To evaluate its effectiveness, the team wants to test how well it detects and blocks common attack patterns. Which testing method is most appropriate for this purpose?

   • AReview the WAF configuration and compare it to vendor best practices
   • BPerform a penetration test that simulates real-world attack techniques against the WAF
   • CConduct a vulnerability assessment using automated scanners
   • DAnalyze WAF logs for past attack attempts
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is a key component of planning the implementation of security controls?

   • ASelecting the most expensive control
   • BAllocating resources and scheduling tasks
   • CAvoiding stakeholder involvement
   • DImplementing all controls simultaneously
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A multinational corporation is implementing a security metrics program. The CISO wants a metric that demonstrates the program's value to the business, but the board is concerned about the cost of security. Which metric would best balance these two concerns?

   • ANumber of security incidents prevented by the program
   • BReturn on security investment (ROSI), comparing avoided losses to security costs
   • CPercentage of security controls that passed their annual review
   • DTotal security spending as a percentage of IT budget
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company is implementing a new access control system that will affect all employees. The project manager must create an implementation plan that minimizes disruption. Which element is most important to include in the plan?

   • AA backup plan for the old system in case of failure
   • BA detailed technical specification of the new system
   • CA communication and training schedule for all affected employees
   • DA list of potential vendors for the new system
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is a key characteristic of an effective security metric report?

   • AIt uses complex technical jargon
   • BIt presents data in a clear and actionable format
   • CIt is only shared with the security team
   • DIt includes every data point collected
   Reveal Solution Discussion Select an answer first