Isaca CISM Quiz 259 Topic 5 Questions 1291-1295

Question: 1

The MOST important reason to have a well-documented and tested incident response plan in place is to:

Aoutline external communications

Bpromote a coordinated effort

Cfacilitate the escalation process

Dstandardize the chain of custody procedure.

Show Answer

Question: 2

Which of the following should an information security manager do FIRST when a recent internal audit reveals a security risk is more severe than previously assessed?

AEscalate the finding to the business owner and obtain a remediation plan.

BUpdate the risk register and notify the CISC

CValidate the finding is legitimate and not a false positive.

DReview the remainder of the internal audit report.

Show Answer

Question: 3

What should be the PRIMARY basis for prioritizing incident containment?

AThe business value of affected assets

BInput from senior management

CThe recovery cost of affected assets

DLegal and regulatory requirements

Show Answer

Question: 4

Senior management is concerned a security solution may not adequately protect its multiple global data centers following recent industry breaches. What should be done NEXT?

AConduct a business impact analysis (BIA).

BPerform a gap analysis.

CRequire an internal audit review.

DPerform a risk assessment.

Show Answer

Question: 5

Which of the following poses the GREATEST risk to the operational effectiveness of an incident response team?

AThe lack of automated communication channels

BThe lack of forensic investigation skills

CThe lack of delegated authority

DThe lack of a security information and event management (SIEM) system

Show Answer

Isaca CISM Quiz:259 Topic:5 Questions:1291-1295