Latest CISM-CN Actual Free Exam Questions Updated 672 Questions
Free CISM-CN Exam Braindumps certification guide Q&A
NEW QUESTION # 339
以下哪一项是信息安全经理使安全和业务目标保持一致的最佳行动方案？
- A. 进行业务影响分析 (BIA)
- B. 积极与利益相关者接触
- C. 审查业务战略
- D. 定义关键绩效指标 (KPI)
Answer: B
NEW QUESTION # 340
由於組織環境的變化，安全控制可能不再足夠。信息安全經理的最佳行動方案是什麼？
- A. 執行新的風險評估，
- B. 將新風險轉移給第三方。
- C. 評估減輕新風險的對策。
- D. 回顧之前的風險評估和對策。
Answer: C
NEW QUESTION # 341
以下哪一项需要恢复点目标 (RPO)？
- A. 信息安全计划
- B. 事件响应计划
- C. 灾难恢复计划（DRP）
- D. 业务连续性计划（BCP）
Answer: C
NEW QUESTION # 342
以下哪一项最好地支持针对组织供应链攻击的事件管理流程？
- A. 在供应商合同中包含服务级别协议 (SLA)
- B. 建立与供应商的沟通路径
- C. 需要对供应商员工进行安全意识培训
- D. 与供应商系统进行集成测试
Answer: B
NEW QUESTION # 343
当威胁情报报告显示针对行业的大量勒索软件攻击时，以下哪项是信息安全经理的最佳行动方案？
- A. 审查缓解安全控制措施。
- B. 评估组织面临的风险。
- C. 将威胁通知工作人员。
- D. 增加系统备份的频率。
Answer: B
NEW QUESTION # 344
一家金融機構的管理階層接受了營運風險，導致關鍵監控流程暫時停用。對於這種情況，資安經理最關心的是下列哪一項？
- A. 偏離風險管理最佳實踐
- B. 對合規風險的影響。
- C. 無法確定短期影響。
- D. 對風險文化的影響。
Answer: D
Explanation:
Explanation
Comprehensive and Detailed Explanation = The impact on the risk culture is the greatest concern for the information security manager, because it reflects the attitude and behavior of the organization towards risk management. If management accepts an operational risk that compromises a critical monitoring process, it may indicate a lack of awareness, commitment, or accountability for risk management. This may erode the trust and confidence of the stakeholders, regulators, and customers, and expose the organization to further risks. The impact on compliance risk, the inability to determine short-term impact, and the deviation from risk management best practices are also important, but they are secondary to the impact on the risk culture.
References = CISM Review Manual 15th Edition, page 48. CISM Review Questions, Answers & Explanations Database - 12 Month Subscription, question ID 421.
NEW QUESTION # 345
資訊安全經理確定新發布的行業要求的安全標準存在大量例外。接下來應該執行下列哪項操作？
- A. 修改組織的安全策略。
- B. 進行資訊安全審核。
- C. 記錄風險接受情形。
- D. 評估不合規的後果。
Answer: D
NEW QUESTION # 346
下列哪一項是資訊安全經理協調安全和業務目標的最佳行動方案？
- A. 定義關鍵績效指標 (KPI)
- B. 進行業務影響分析 (BIA)
- C. 審查業務策略
- D. 積極與利害關係人互動
Answer: D
Explanation:
Explanation
= According to the CISM Review Manual, the information security manager should actively engage with stakeholders to align security and business goals. This means understanding the business needs, expectations, and risk appetite of the stakeholders, and communicating the value and benefits of security initiatives to them.
By engaging with stakeholders, the information security manager can also gain their support and commitment for security programs and projects, and ensure that security objectives are aligned with business strategy and priorities. References = CISM Review Manual, 16th Edition, ISACA, 2020, page 23.
NEW QUESTION # 347
下列哪一項是實施組織範圍內的安全意識計畫的最大好處？
- A. 報告的安全事件較少。
- B. 安全行為有改善。
- C. 偵測到更多安全事件。
- D. 安全策略提升。
Answer: B
Explanation:
Explanation
The greatest benefit of conducting an organization-wide security awareness program is to improve the security behavior of the employees, contractors, partners, and other stakeholders who interact with the organization's information assets. Security behavior refers to the actions and decisions that affect the confidentiality, integrity, and availability of information, such as following the security policies and procedures, reporting security incidents, avoiding risky practices, and applying security controls. By improving the security behavior, the organization can reduce the human-related risks and vulnerabilities, enhance the security culture and awareness, and support the security strategy and objectives.
The other options are not as beneficial as improving the security behavior, although they may also be outcomes or objectives of a security awareness program. Promoting the security strategy is important to communicate the vision, mission, and goals of the security function, as well as to align the security activities with the business needs and expectations. However, promoting the security strategy alone is not enough to ensure its implementation and effectiveness, as it also requires the involvement and commitment of the stakeholders, especially the senior management. Reporting fewer security incidents may indicate a lower level of security breaches or threats, but it may also reflect a lack of detection, reporting, or awareness mechanisms.
Moreover, reporting fewer security incidents is not a reliable measure of the security performance or maturity, as it does not account for the impact, severity, or root causes of the incidents. Detecting more security incidents may indicate a higher level of security monitoring, alerting, or awareness capabilities, but it may also reflect a higher level of security exposures or attacks. Moreover, detecting more security incidents is not a desirable goal of a security awareness program, as it also implies a higher level of security incidents that need to be responded to and resolved. References = CISM Review Manual, 16th Edition, ISACA, 2022, pp. 201-202, 207-208.
CISM Questions, Answers & Explanations Database, ISACA, 2022, QID 1006.
The Benefits of Information Security and Privacy Awareness Training Programs, ISACA Journal, Volume 1, 2019, 1.
NEW QUESTION # 348
下列哪一項是監控組織中進階持續性威脅 (APT) 的最佳方法？
- A. 瀏覽網路以尋找潛在事件的團隊
- B. 搜尋環境中的威脅特徵。
- C. 與業內同行建立聯繫，分享資訊。
- D. 搜尋環境中的異常狀況
Answer: D
Explanation:
Explanation
An advanced persistent threat (APT) is a stealthy and sophisticated attack that aims to compromise and maintain access to a target network or system over a long period of time, often for espionage or sabotage purposes. APTs are difficult to detect by conventional security tools, such as antivirus or firewalls, that rely on signatures or rules to identify threats. Therefore, the best way to monitor for APTs is to search for anomalies in the environment, such as unusual network traffic, user behavior, file activity, or system configuration changes, that may indicate a compromise or an ongoing attack. References: https://www.isaca.org/credentialing/cism
https://www.nist.gov/publications/information-security-handbook-guide-managers
NEW QUESTION # 349
下列哪一種方法是證明資訊安全計畫提供適當覆蓋範圍的最佳方法？
- A. 安全風險分析
- B. 漏洞掃描報告
- C. 成熟度評估
- D. 差距評估
Answer: C
NEW QUESTION # 350
讓高級管理層審查和批准信息安全戰略計劃的主要原因是為了確保：
- A. 員工參與信息安全工作。
- B. 組織有實施計劃所需的資金。
- C. 符合法律法規要求。
- D. 該計劃符合公司治理。
Answer: D
Explanation:
Senior management review and approval of an information security strategic plan is important to ensure that the plan is aligned with the organization's overall corporate governance objectives. It is also important to ensure that the plan takes into account any legal and regulatory requirements, as well as the resources and staff needed to properly implement the plan.
NEW QUESTION # 351
信息安全經理髮現安全風險沒有得到及時處理。以下哪一個
- A. 創建緩解控制措施來管理風險。
- B. 定期重新執行風險分析。
- C. 定期更新有關風險當前狀態的信息。
- D. 為每個風險分配一個風險負責人
Answer: B
Explanation:
An email digital signature will verify to recipient the integrity of an email message because it ensures that the message has not been altered or tampered with during transit, and confirms that the message originated from the sender and not an imposter. An email digital signature will not protect the confidentiality of an email message because it does not encrypt or hide the message content from unauthorized parties. An email digital signature will not automatically correct unauthorized modification of an email message because it does not change or restore the message content if it has been altered or tampered with. An email digital signature will not prevent unauthorized modification of an email message because it does not block or stop any attempts to alter or tamper with the message content. Reference: https://support.microsoft.com/en-us/office/secure-messages-by-using-a-digital-signature-549ca2f1-a68f-4366-85fa-b3f4b5856fc6 https://www.techtarget.com/searchsecurity/definition/digital-signature
NEW QUESTION # 352
以下哪項最有利於有效的事件響應測試？
- A. 模擬真實的測試場景
- B. 重大業務變更後的測試
- C. 每季度審查一次測試結果
- D. 包括測試中的所有業務部門
Answer: A
NEW QUESTION # 353
以下哪项最佳方法能够使信息安全经理获得组织对实施安全控制的支持？
- A. 定义组织的风险管理框架
- B. 定期进行脆弱性评估
- C. 建立有效的利益相关者关系
- D. 传达业务影响分析 (BIA) 结果
Answer: C
Explanation:
The best way to obtain organizational support for the implementation of security controls is to establish effective stakeholder relationships. Stakeholders are the individuals or groups that have an interest or influence in the organization's information security objectives, activities, and outcomes. They may include senior management, business owners, users, customers, regulators, auditors, vendors, and others. By establishing effective stakeholder relationships, the information security manager can communicate the value and benefits of security controls to the organization's performance, reputation, and competitiveness. The information security manager can also solicit feedback and input from stakeholders to ensure that the security controls are aligned with the organization's needs and expectations. The information security manager can also foster collaboration and cooperation among stakeholders to facilitate the implementation and operation of security controls. The other options are not the best way to obtain organizational support for the implementation of security controls, although they may be some steps or outcomes of the process. Conducting periodic vulnerability assessments is a technical activity that can help identify and prioritize the security weaknesses and gaps in the organization's information assets and systems. However, it does not necessarily obtain organizational support for the implementation of security controls unless the results are communicated and justified to the stakeholders. Communicating business impact analysis (BIA) results is a reporting activity that can help demonstrate the potential consequences of disruptions or incidents on the organization's critical business processes and functions. However, it does not necessarily obtain organizational support for the implementation of security controls unless the results are linked to the organization's risk appetite and tolerance. Defining the organization's risk management framework is a strategic activity that can help establish the policies, procedures, roles, and responsibilities for managing information security risks in a consistent and effective manner. However, it does not necessarily obtain organizational support for the implementation of security controls unless the framework is endorsed and enforced by the stakeholders
NEW QUESTION # 354
以下哪项最重要，可以作为开发支持组织业务目标的有效信息安全计划的基础？
- A. 驱动信息安全程序的指标
- B. 信息安全策略
- C. 定义的安全组织结构
- D. 信息安全策略
Answer: D
NEW QUESTION # 355
以下哪一项最有助于保护企业免受高级持续性威胁 (APT) 的侵害？
- A. 威胁情报
- B. 定义的安全标准
- C. 定期防病毒更新
- D. 更新的安全策略
Answer: B
NEW QUESTION # 356
下列哪一項是對面向公眾的 Web 伺服器的分散式阻斷服務 (DDoS) 攻擊造成的最大威脅？
- A. 未經授權存取資源
- B. 執行未經授權的命令
- C. 防止授權訪問
- D. 篡改網站內容
Answer: C
Explanation:
Explanation
Prevention of authorized access is the greatest threat posed by a distributed denial of service (DDoS) attack on a public-facing web server because it prevents legitimate users or customers from accessing the web services or resources, causing disruption, dissatisfaction, and potential loss of revenue or reputation. Execution of unauthorized commands is not a threat posed by a DDoS attack, but rather by a remote code execution (RCE) attack. Defacement of website content is not a threat posed by a DDoS attack, but rather by a web application attack. Unauthorized access to resources is not a threat posed by a DDoS attack, but rather by a brute force attack or an authentication bypass attack. References:
https://www.isaca.org/resources/isaca-journal/issues/2017/volume-6/the-value-of-penetration-testing
https://www.isaca.org/resources/isaca-journal/issues/2016/volume-5/security-scanning-versus-penetration-testing
NEW QUESTION # 357
以下哪项提供了对组织面临的持续威胁的最全面洞察？
- A. 渗透测试
- B. 风险登记册
- C. 漏洞评估
- D. 业务影响分析（BIA）
Answer: B
Explanation:
A risk register provides the MOST comprehensive insight into ongoing threats facing an organization. This is because a risk register is a document that records and tracks the identified risks, their likelihood, impact, mitigation strategies, and status. A risk register helps an organization to monitor and manage the threats that could affect its objectives, assets, and operations. A risk register also helps an organization to prioritize its response efforts and allocate its resources accordingly.
NEW QUESTION # 358
下列哪一項是確定防火牆是否已配置為提供全面外圍防禦的最佳方法9
- A. 從內部來源對防火牆進行連接埠掃描
- B. 針對防火牆的類比拒絕服務 (DoS) 攻擊
- C. 目前防火牆規則集的驗證
- D. 來自外部來源的 ping 測試
Answer: C
Explanation:
Explanation
A validation of the current firewall rule set is the best method for determining whether a firewall has been configured to provide a comprehensive perimeter defense because it verifies that the firewall rules are consistent, accurate, and effective in allowing or blocking traffic according to the security policies and standards of the organization. A port scan of the firewall from an internal source is not a good method because it does not test the firewall's behavior from an external perspective, which is more relevant for perimeter defense. A ping test from an external source is not a good method because it only tests the firewall's availability and responsiveness, not its security or functionality. A simulated denial of service (DoS) attack against the firewall is not a good method because it only tests the firewall's resilience and performance under high traffic load, not its security or functionality. References:
https://www.isaca.org/resources/isaca-journal/issues/2016/volume-4/technical-security-standards-for-information
https://www.isaca.org/resources/isaca-journal/issues/2017/volume-2/the-value-of-penetration-testing
https://www.isaca.org/resources/isaca-journal/issues/2016/volume-5/security-scanning-versus-penetration-testing
NEW QUESTION # 359
在確定內部關鍵應用程式、資料庫或伺服器的復原時間目標 (RTO) 時，下列哪一項應該是最重要的考量？
- A. 恢復測試結果
- B. 高階管理層的指示
- C. 服務中斷的影響
- D. 確定復原點目標 (RPO)
Answer: C
NEW QUESTION # 360
以下哪一項是業務影響分析 (BIA) 的主要目標？
- A. 確認控制有效性。
- B. 分析漏洞。
- C. 確定恢復優先級。
- D. 定義恢復點目標 (RPO)。
Answer: C
Explanation:
The primary objective of a business impact analysis (BIA) is to determine recovery priorities. The BIA is used to identify and analyze the potential effects of an incident on the organization, including the financial impact, operational impact, and reputational impact. The BIA also helps to identify critical resources and processes, determine recovery objectives and strategies, and develop recovery plans. Reference: Certified Information Security Manager (CISM) Study Manual, Chapter 4, Business Impact Analysis.
NEW QUESTION # 361
實施數據丟失防護 (DLP) 解決方案的主要好處是：
- A. 減少對安全意識計劃的需求。
- B. 補充組織的偵探控制。
- C. 消除數據丟失的風險。
- D. 增強組織的防病毒控制。
Answer: C
NEW QUESTION # 362
一個組織在不同部門擁有多個數據存儲庫。信息安全經理的任務是製定保護數據的企業戰略。以下哪項信息安全計劃應該是組織的最高優先級？
- A. 數據屏蔽
- B. 數據加密標準
- C. 數據丟失防護 (DLP)
- D. 數據保留策略
Answer: B
Explanation:
Data encryption standards are the best information security initiative for creating an enterprise strategy for protecting data across multiple data repositories and different departments because they help to ensure the confidentiality, integrity, and availability of data in transit and at rest. Data encryption is a process of transforming data into an unreadable format using a secret key or algorithm, so that only authorized parties can access and decrypt it. Data encryption standards are the rules or specifications that define how data encryption should be performed, such as the type, strength, and mode of encryption, the key management and distribution methods, and the compliance requirements. Data encryption standards help to protect data from unauthorized access, modification, or theft, as well as to meet the regulatory obligations for data privacy and security. Therefore, data encryption standards are the correct answer.
Reference:
https://www.techtarget.com/searchdatabackup/tip/20-keys-to-a-successful-enterprise-data-protection-strategy
https://cloudian.com/guides/data-protection/data-protection-strategy-10-components-of-an-effective-strategy/
https://www.veritas.com/information-center/enterprise-data-protection
NEW QUESTION # 363
在決定信息資產的保護級別時，以下哪一項將提供最多的指導？
- A. 對信息安全計劃的影響
- B. 更換成本
- C. 控製成本
- D. 對業務功能的影響
Answer: D
Explanation:
When deciding the level of protection for an information asset, the most important factor to consider is the impact to the business function. The value of the asset should be evaluated in terms of its importance to the organization's operations and how its security posture affects the organization's overall security posture. Additionally, the cost of implementing controls, the potential impact on the information security program, and the cost to replace the asset should be taken into account when determining the appropriate level of protection for the asset.
NEW QUESTION # 364
......
CISM-CN Certification Overview Latest CISM-CN PDF Dumps: https://www.actualtorrent.com/CISM-CN-questions-answers.html