Real CISM-CN dumps - Real ISACA dumps PDF in here [Dec-2023]
Realistic PracticeDump CISM-CN Dumps PDF - 100% Passing Guarantee
NEW QUESTION # 73
以下哪一项是信息安全经理使安全和业务目标保持一致的最佳行动方案？
- A. 定义关键绩效指标 (KPI)
- B. 进行业务影响分析 (BIA)
- C. 审查业务战略
- D. 积极与利益相关者接触
Answer: D
NEW QUESTION # 74
在制定事件响应计划时，应首先考虑以下哪项？
- A. 事件的定义
- B. 遵守法规
- C. 先前报告的事件
- D. 管理支持
Answer: B
NEW QUESTION # 75
當出現以下情況時，滲透測試是最合適的：
- A. 新系統即將上線。
- B. 正在製定安全策略。
- C. 發生安全事件，
- D. 新系統正在設計中。
Answer: A
NEW QUESTION # 76
席位托管组织的数据中心设有服务器、应用程序
为组织制定物理访问控制策略的最佳方法？
- A. 进行风险评估以确定安全风险和缓解控制措施。
- B. 为每个系统和应用制定访问控制要求。
- C. 设计单点登录 (SSO) 或联合访问。
- D. 审查客户的安全政策。
Answer: A
NEW QUESTION # 77
以下哪項對執行災難恢復計劃 (DRP) 的能力具有最大的積極影響？
- A. 將計劃存儲在異地位置
- B. 定期更新計劃
- C. 向所有利益相關者傳達該計劃
- D. 對計劃進行演練
Answer: B
Explanation:
Updating the plan periodically has the greatest positive impact on the ability to execute a disaster recovery plan (DRP). This is because an up-to-date plan is more likely to reflect the current environment, and any potential risks or issues can be addressed before an emergency arises. Storing the plan at an offsite location, communicating the plan to all stakeholders, and conducting a walk-through of the plan are all important steps, but they do not have the same impact as regularly updating the DRP.
NEW QUESTION # 78
实现对信息安全治理计划的执行承诺的最重要因素是：
- A. 定义的安全框架。
- B. 确定的业务驱动因素。
- C. 过程改进模型
- D. 已建立的安全策略。
Answer: B
Explanation:
The most important element in achieving executive commitment to an information security governance program is to align the program with the identified business drivers of the organization. Business drivers are the factors that influence the strategic objectives, goals, and priorities of the organization. They reflect the needs and expectations of the stakeholders, customers, regulators, and other parties that are relevant to the organization's mission and vision. By aligning the information security governance program with the business drivers, the executive can demonstrate the value and benefits of information security to the organization's performance, reputation, and competitiveness. The other options are not the most important element, although they may be part of an information security governance program. A defined security framework is a set of standards, guidelines, and best practices that provide a structure and direction for implementing information security. A process improvement model is a methodology that helps to identify, analyze, and improve the processes related to information security. Established security strategies are the plans and actions that define how information security supports and enables the business objectives and goals. These elements are important for developing and executing an information security governance program, but they do not necessarily ensure executive commitment unless they are aligned with the business drivers
NEW QUESTION # 79
在为组织建立信息安全策略时，以下哪项应该是最重要的考虑因素？
- A. 高层支持政策。
- B. 政策每年更新一次。
- C. 职位描述包括阅读安全策略的要求。
- D. 政策与行业最佳实践保持一致。
Answer: A
NEW QUESTION # 80
对于迁移到基于云的解决方案的组织，以下哪项是事件响应的最佳方法？
- A. 继续使用现有的事件响应程序。
- B. 修改事件响应程序以涵盖云环境。
- C. 采用云提供商的事件响应程序。
- D. 将事件响应的责任转移给云提供商。
Answer: B
NEW QUESTION # 81
事件響應過程中根除階段的主要目標是：
- A. 消除威脅並恢復受影響的系統
- B. 提供有效的事件分類和遏制。
- C. 保持嚴格的監管鏈。
- D. 從受影響的系統獲取取證證據。
Answer: A
Explanation:
The primary goal of the eradication phase in an incident response process is to remove the threat and restore affected systems because it eliminates any traces or remnants of malicious activity or compromise from the systems or network, and returns them to their normal or secure state. Maintaining a strict chain of custody is not a goal of the eradication phase, but rather a requirement for preserving and documenting digital evidence throughout the incident response process. Providing effective triage and containment of the incident is not a goal of the eradication phase, but rather a goal of the containment phase, which isolates and stops the spread of malicious activity or compromise. Obtaining forensic evidence from the affected system is not a goal of the eradication phase, but rather a goal of the identification phase, which collects and analyzes data or artifacts related to malicious activity or compromise. Reference: https://www.isaca.org/resources/isaca-journal/issues/2017/volume-5/incident-response-lessons-learned https://www.isaca.org/resources/isaca-journal/issues/2018/volume-3/incident-response-lessons-learned
NEW QUESTION # 82
风险评估活动已确定拒绝服务 (DoS) 攻击的威胁 执行管理层已决定不采取与此风险相关的进一步行动。做出此决定的 MO ST 可能原因是
- A. 报告的漏洞尚未经过验证
- B. 实施控制的成本超过了潜在的财务损失。
- C. 执行管理层没有意识到潜在的影响
- D. 风险评估未定义发生的可能性
Answer: B
Explanation:
Executive management may not take action related to a risk if they have determined that the cost of implementing necessary controls to mitigate the risk exceeds the potential financial losses that the organization may incur if the risk were to materialize. In cases such as this, it is important for the information security team to provide the executive team with thorough cost-benefit analysis that outlines the cost of implementing the controls versus the expected losses from the risk.
NEW QUESTION # 83
已检测到并包含入侵。以下哪个步骤代表了确保恢复系统完整性的最佳实践？
- A. 从原始来源安装操作系统、补丁和应用程序。
- B. 从备份中恢复操作系统、补丁和应用程序。
- C. 从操作系统和应用程序中删除所有入侵迹象。
- D. 从取证副本恢复应用程序和数据。
Answer: B
Explanation:
The BEST practice for ensuring the integrity of the recovered system after an intrusion is to restore the OS, patches, and application from a backup. This will ensure that the system is in a known good state, without any potential residual malicious code or changes from the intrusion. Restoring from a backup also enables the organization to revert to a previous configuration that has been tested and known to be secure. This step should be taken prior to conducting a thorough investigation and forensic analysis to determine the cause and extent of the intrusion.
NEW QUESTION # 84
對於確保組織存儲的信息得到適當保護，以下哪一項最重要？
- A. 定義信息管理角色
- B. 制定記錄保留時間表
- C. 分配信息資產所有權
- D. 定義安全資產分類
Answer: C
NEW QUESTION # 85
以下哪一项是降低实施应用程序安全控制成本的最佳选择？
- A. 包括标准应用程序安全要求
- B. 在开发过程中集成安全活动
- C. 在开发环境中进行安全测试。
- D. 项目完成后进行风险分析。
Answer: B
Explanation:
Integrating security activities within the development process is the best option to lower the cost to implement application security controls because it ensures that security is considered and addressed throughout the software development life cycle (SDLC), from design to deployment, and reduces the likelihood and impact of security flaws or vulnerabilities that may require costly fixes or patches later on. Performing security tests in the development environment is not the best option because it may not detect or prevent all security issues that may arise in different environments or scenarios. Performing a risk analysis after project completion is not a good option because it may be too late to identify or mitigate security risks that may have been introduced during the project. Including standard application security requirements is not a good option because it may not account for specific or unique security needs or challenges of different applications or projects. Reference: https://www.isaca.org/resources/isaca-journal/issues/2017/volume-2/secure-software-development-lifecycle https://www.isaca.org/resources/isaca-journal/issues/2016/volume-4/technical-security-standards-for-information-systems
NEW QUESTION # 86
隨著對遠程訪問安全性的需求不斷增加，組織發現有必要快速轉向在家工作模式。
應立即關注以下哪項？
- A. 加強端點安全
- B. 轉向零信任訪問模型
- C. 增強網絡響應能力
- D. 啟用網絡級身份驗證
Answer: A
NEW QUESTION # 87
在提出信息安全策略時，為了獲得高層領導的支持，以下哪一項最重要？
- A. 該策略涉及組織成熟度和威脅環境。
- B. 該策略符合管理層可接受的風險水平。
- C. 該策略解決了無效的信息安全控制問題。
- D. 該戰略符合行業基準和標準。
Answer: B
Explanation:
The most important factor to obtain senior leadership support when presenting an information security strategy is that the strategy aligns with management's acceptable level of risk because it ensures that the strategy is consistent and compatible with the organization's risk appetite and thresholds, and reflects management's expectations and priorities for security risk management. The strategy addresses ineffective information security controls is not a very important factor because it does not indicate how the strategy will improve or enhance the security controls or performance. The strategy aligns with industry benchmarks and standards is not a very important factor because it does not indicate how the strategy will differentiate or innovate the organization's security capabilities or practices. The strategy addresses organizational maturity and the threat environment is not a very important factor because it does not indicate how the strategy will advance or adapt the organization's security posture or resilience. Reference: https://www.isaca.org/resources/isaca-journal/issues/2016/volume-4/technical-security-standards-for-information-systems https://www.isaca.org/resources/isaca-journal/issues/2017/volume-2/how-to-align-security-initiatives-with-business-goals-and-objectives
NEW QUESTION # 88
一個組織正在經歷數字化轉型過程，這將 IT 組織置於一個不熟悉的風險環境中。信息安全經理的任務是領導 IT 風險管理流程。以下哪一項應被給予最高優先級？
- A. 關鍵風險指標（KRI）的設計
- B. 風險處理方案的選擇
- C. 風險識別
- D. 控制差距分析
Answer: C
NEW QUESTION # 89
以下哪项是确保在勒索软件攻击后能够恢复干净数据的最佳方法？
- A. 对备份执行完整性检查
- B. 购买网络保险
- C. 加密敏感生产数据
- D. 维护多个离线备份
Answer: D
Explanation:
Maintaining multiple offline backups is the best way to ensure the capability to restore clean data after a ransomware attack. This is because offline backups are not connected to the network and thus cannot be compromised by the ransomware. Additionally, performing integrity checks on backups will help to ensure that any backups that have been potentially corrupted by the ransomware can be identified and discarded. Encrypting sensitive production data and purchasing cyber insurance can help to protect against a ransomware attack, but are not the best way to ensure the capability to restore clean data after an attack.
NEW QUESTION # 90
以下哪一项是风险负责人的责任？
- A. 确保监控有效性
- B. 实施控制措施以降低风险
- C. 确定组织的风险偏好
- D. 进行风险评估以指导风险应对
Answer: B
Explanation:
A risk owner is a person or entity that is responsible for ensuring that risk is managed effectively. One of the primary responsibilities of a risk owner is to implement controls that will help mitigate or manage the risk. While risk assessments, determining the organization's risk appetite, and monitoring control effectiveness are all important aspects of managing risk, it is the responsibility of the risk owner to take the necessary actions to manage the risk.
NEW QUESTION # 91
有关信息安全投资的管理决策在基于以下内容时将是最有效的：
- A. 识别和分析威胁和漏洞的过程。
- B. 一致和定期的风险评估报告。
- C. 管理层对风险分析的正式接受，
- D. 根据安全事件历史确定的年损失预期 (ALE)，
Answer: B
NEW QUESTION # 92
......
Verified CISM-CN dumps Q&As Latest CISM-CN Download: https://www.practicedump.com/CISM-CN_actualtests.html
Free ISACA CISM-CN Exam Questions and Answer: https://drive.google.com/open?id=1FsDhzn4qsgqzKwbbd8hd-tReujjdKhDE