First Attempt Guaranteed Success in CISM-CN Exam 2023
Real CISM-CN Exam Questions are the Best Preparation Material
NEW QUESTION # 233
一位信息安全經理髮現，即將部署的在線應用程序會將風險增加到超出可接受的水平，並且尚未包括必要的控制措施。以下哪一項是信息安全經理的最佳行動方案？
- A. 推薦不同的應用程序。
- B. 對補償控制產品進行招標。
- C. 向高級管理層提供額外控制的業務案例。
- D. 指示 IT 根據緊急業務需求部署控制措施。
Answer: C
NEW QUESTION # 234
以下哪一项 BEST 表示组织已在规定的恢复时间目标 (RTO) 内有效地测试了其业务连续性和灾难恢复计划？
- A. 正在满足风险管理目标。
- B. 正在满足内部合规要求。
- C. 正在满足监管要求。
- D. 业务需求正在得到满足。
Answer: D
NEW QUESTION # 235
信息安全團隊發現用戶與包含敏感信息的應用程序共享登錄帳戶，這違反了訪問策略。業務管理表明，這種做法可以提高運營效率。信息安全經理的最佳行動方案是什麼？
- A. 向高級管理層提出風險。
- B. 為偏差創建例外。
- C. 修改策略。
- D. 執行策略。
Answer: A
NEW QUESTION # 236
在减轻与新兴技术相关的安全风险时，以下哪项应该是主要关注领域？
- A. 与现有访问控制集成
- B. 企业硬化标准的应用
- C. 未知漏洞
- D. 与遗留系统的兼容性
Answer: C
NEW QUESTION # 237
以下哪项是降低与自带设备 (BYOD) 计划相关风险的最佳方式？
- A. 为员工提供有关安全移动设备实践的培训
- B. 实施移动设备政策和标准。
- C. 要求员工安装有效的反恶意软件应用程序。
- D. 实施移动设备管理 (MDM) 解决方案。
Answer: D
Explanation:
The best way to reduce the risk associated with a bring your own device (BYOD) program is to implement a mobile device policy and standard. This policy should include guidelines and rules regarding the use of mobile devices, such as acceptable use guidelines and restrictions on the types of data that can be stored or accessed on the device. Additionally, it should also include requirements for secure mobile device practices, such as the use of strong passwords, encryption, and regular patching. A mobile device management (MDM) solution can also be implemented to help ensure mobile devices meet the organizational security requirements. However, it is not enough to simply implement the policy and MDM solution; employees must also be trained on the secure mobile device practices to ensure the policy is followed.
NEW QUESTION # 238
在使安全意识计划与组织的业务战略保持一致时，以下哪项是最重要的考虑因素？
- A. 人与文化
- B. 执行和董事会指令
- C. 法规和标准
- D. 流程和技术
Answer: A
NEW QUESTION # 239
以下哪一项对在企业内成功集成信息安全影响最大？
- A. 组织的期望状态
- B. 风险承受能力和组织目标
- C. 组织结构和文化
- D. 信息安全人员
Answer: C
Explanation:
The factor that has the greatest influence on the successful integration of information security within the business is organizational structure and culture because they determine how information security is organized, governed, and supported within the organization, and how information security roles and responsibilities are defined, assigned, and communicated across different levels and functions. Risk tolerance and organizational objectives are not very influential because they do not affect how information security is integrated within the business, but rather what information security aims to achieve or protect. The desired state of the organization is not very influential because it does not affect how information security is integrated within the business, but rather what the organization aspires to be or do. Information security personnel are not very influential because they do not affect how information security is integrated within the business, but rather who performs information security tasks or activities. Reference: https://www.isaca.org/resources/isaca-journal/issues/2016/volume-4/technical-security-standards-for-information-systems https://www.isaca.org/resources/isaca-journal/issues/2017/volume-2/how-to-align-security-initiatives-with-business-goals-and-objectives
NEW QUESTION # 240
高級管理層表示擔心組織的入侵防禦系統 (IPS) 可能會反复擾亂業務運營 以下哪項最能表明信息安全經理已調整系統以解決此問題？
- A. 誤報增加
- B. 減少漏報
- C. 減少誤報
- D. 漏報率增加
Answer: C
Explanation:
Decreasing false positives is the best indicator that the information security manager has tuned the system to address senior management's concern that the organization's intrusion prevention system (IPS) may repeatedly disrupt business operations. False positives are alerts generated by the IPS when it mistakenly blocks legitimate traffic or activity, causing disruption or downtime. Decreasing false positives means that the IPS has been configured to reduce such errors and minimize unnecessary interruptions. Increasing false negatives is not a good indicator because it means that the IPS has failed to detect or block malicious traffic or activity, increasing the risk of compromise or damage. Decreasing false negatives is not a good indicator because it does not affect business operations, but rather improves security detection or prevention. Increasing false positives is not a good indicator because it means that the IPS has increased its errors and interruptions, worsening senior management's concern. Reference: https://www.isaca.org/resources/isaca-journal/issues/2017/volume-6/the-value-of-penetration-testing https://www.isaca.org/resources/isaca-journal/issues/2016/volume-5/security-scanning-versus-penetration-testing
NEW QUESTION # 241
以下哪一項是確保符合密碼標準的最佳方法？
- A. 使用密碼破解軟件
- B. 用戶意識計劃
- C. 自動執行密碼語法規則
- D. 實施密碼同步軟件
Answer: C
Explanation:
Automated enforcement of password syntax rules is the best method to ensure compliance with password standards. Password syntax rules define the minimum and maximum length, character types, and construction of passwords. By enforcing these rules automatically, the system can prevent users from creating or using weak or insecure passwords that do not meet the standards. According to NIST, password syntax rules should allow at least 8 characters and up to 64 characters, accept all printable ASCII characters and Unicode characters, and encourage the use of long passphrases1. The other options are not methods to ensure compliance with password standards, but rather methods to verify or improve password security. Implementing password-synchronization software can help users manage multiple passwords across different systems, but it does not ensure that the passwords comply with the standards2. Using password-cracking software can help test the strength of passwords and identify weak or compromised ones, but it does not ensure that users follow the standards3. A user-awareness program can help educate users about the importance of password security and the best practices for creating and using passwords, but it does not ensure that users comply with the standards. Reference: 1: NIST Password Guidelines and Best Practices for 2020 - Auth0 2: Password synchronization - Wikipedia 3:
NEW QUESTION # 242
以下哪项将导致最准确的控制评估？
- A. 高层管理支持
- B. 突击测试
- C. 成熟的变更管理流程
- D. 定义明确的安全策略
Answer: A
NEW QUESTION # 243
以下哪一項最有利於信息安全經理努力獲得高級管理層對信息安全計劃的承諾？
- A. 傳達剩餘風險
- B. 提供固有風險的證據
- C. 報告安全成熟度級別
- D. 提出合規性要求
Answer: D
NEW QUESTION # 244
提供消息本機加密的電子郵件軟件包的一個常見缺點是加密：
- A. 密鑰長度不足。
- B. 無法加密附件
- C. 無法跨產品域互操作。
- D. 沒有密鑰恢復機制。
Answer: C
Explanation:
A common drawback of email software packages that provide native encryption of messages is that the encryption cannot interoperate across product domains. This means that emails sent from one product cannot be read by another product, as the encryption keys used are not compatible. This can be a problem when sending emails to people who use different software packages, as the encrypted emails cannot be read.
NEW QUESTION # 245
用戶報告存儲敏感公司數據的個人移動設備被盜。以下哪項最能最大限度地降低數據暴露的風險？
- A. 刪除用戶對公司數據的訪問權限。
- B. 遠程擦除設備。
- C. 向警方報告該事件。
- D. 阻止用戶使用個人移動設備。
Answer: B
NEW QUESTION # 246
以下哪項是信息安全治理的預期結果？
- A. 改進風險管理
- B. 滲透測試
- C. 業務敏捷性
- D. 成熟度模型
Answer: A
NEW QUESTION # 247
以下哪一項是有效信息安全意識培訓計劃的最佳標誌？
- A. 網絡釣魚測試頻率增加
- B. 事件解決速度加快
- C. 積極的用戶反饋增加
- D. 網絡釣魚模擬期間識別率提高
Answer: D
NEW QUESTION # 248
以下哪項是評估組織中新出現的風險的最大挑戰？
- A. 缺乏風險框架
- B. 威脅識別不完整
- C. 存在已知漏洞
- D. 安全控制無效
Answer: B
Explanation:
The greatest challenge with assessing emerging risk in an organization is the incomplete identification of threats, as emerging risks are often new, unknown, or unfamiliar, and may not be fully understood or assessed. Incomplete identification of threats can lead to gaps in risk analysis and management, and expose the organization to unexpected or unprepared scenarios. The other options, such as lack of a risk framework, ineffective security controls, or presence of known vulnerabilities, are not specific to emerging risks, and may apply to any type of risk assessment. Reference:
https://committee.iso.org/sites/tc262/home/projects/ongoing/iso-31022-guidelines-for-impl-2.html
https://www.isaca.org/resources/news-and-trends/newsletters/atisaca/2023/volume-6/emerging-risk-analysis
https://projectriskcoach.com/emerging-risks/
NEW QUESTION # 249
以下哪一項是證明信息安全策略與業務目標保持一致的最有效方法？
- A. 熱圖
- B. 風險矩陣
- C. 平衡計分卡
- D. 基準測試
Answer: C
Explanation:
The balanced scorecard is a management tool that can be used to demonstrate the alignment of information security strategy with business objectives. The balanced scorecard provides a comprehensive view of an organization's performance by considering multiple dimensions, including financial performance, customer satisfaction, internal processes, and learning and growth.
By integrating information security objectives and metrics into the balanced scorecard, organizations can demonstrate how their information security investments support and align with their overall business objectives. This can help to gain the support and commitment of senior management and other stakeholders, as well as ensure that information security investments are effectively managed and optimized to deliver maximum value to the organization.
While other tools, such as risk matrices, benchmarking, and heat maps, can also provide valuable information, the balanced scorecard provides a more holistic and integrated view of organizational performance and the alignment of information security with business objectives.
NEW QUESTION # 250
组织正在实施信息安全治理框架。为了向利益相关者传达计划的有效性，最重要的是建立：
- A. 安全策略的监控进程。
- B. 自动向利益相关者报告。
- C. 每个里程碑的指标。
- D. 控制自我评估（CSA）过程。
Answer: C
NEW QUESTION # 251
以下哪一項最能幫助及時執行事件響應計劃？
- A. 明確定義的數據分類過程
- B. 集中服務台
- C. 決策支持工具的引入
- D. 觸發事件定義
Answer: D
Explanation:
Definition of trigger events is the best way to enable the timely execution of an incident response plan because it helps to specify the conditions or criteria that initiate the incident response process. Trigger events are predefined scenarios or indicators that signal the occurrence or potential occurrence of a security incident, such as a ransomware attack, a data breach, a denial-of-service attack, or an unauthorized access attempt. Definition of trigger events helps to ensure that the incident response team is alerted and activated as soon as possible, as well as to determine the appropriate level and scope of response based on the severity and impact of the incident. Therefore, definition of trigger events is the correct answer.
Reference:
https://www.atlassian.com/incident-management/kpis/common-metrics
https://www.varonis.com/blog/incident-response-plan/
https://holierthantao.com/2023/05/03/minimizing-disruptions-a-comprehensive-guide-to-incident-response-planning-and-execution/
NEW QUESTION # 252
為了幫助確保信息安全培訓計劃最有效，其內容應該是
- A. 基於員工角色
- B. 關注信息安全政策。
- C. 基於最近發生的事件
- D. 與業務流程保持一致
Answer: A
Explanation:
"An information security training program should be tailored to the specific roles and responsibilities of employees. This will help them understand how their actions affect information security and what they need to do to protect it. A generic training program that is focused on policy, business processes or recent incidents may not be relevant or effective for all employees."
NEW QUESTION # 253
以下哪項是針對分佈式拒絕服務 (DDoS) 攻擊的可行遏制策略？
- A. 重定向攻擊者的流量
- B. 關閉受影響的服務器
- C. 阻止攻擊者使用的 IP 地址
- D. 禁用攻擊者利用的防火牆端口。
Answer: A
Explanation:
Redirecting the attacker's traffic is a viable containment strategy for a distributed denial of service (DDoS) attack because it helps to divert the malicious traffic away from the target server and reduce the impact of the attack. A DDoS attack is an attempt by attackers to overwhelm a server or a network with a large volume of requests or packets, preventing legitimate users from accessing the service or resource. Redirecting the attacker's traffic is a technique that involves changing the DNS settings or routing tables to send the attacker's traffic to another destination, such as a sinkhole, a honeypot, or a scrubbing center. A sinkhole is a server that absorbs and discards the malicious traffic. A honeypot is a decoy server that mimics the target server and collects information about the attacker's behavior and techniques. A scrubbing center is a service that filters out the malicious traffic and forwards only the legitimate traffic to the target server. Redirecting the attacker's traffic helps to contain the DDoS attack by reducing the load on the target server and preserving its availability and performance. Therefore, redirecting the attacker's traffic is the correct answer.
Reference:
https://www.fortinet.com/resources/cyberglossary/implement-ddos-mitigation-strategy
https://learn.microsoft.com/en-us/azure/ddos-protection/ddos-response-strategy
https://www.cloudflare.com/learning/ddos/glossary/sinkholing/.
NEW QUESTION # 254
......
Practice LATEST CISM-CN Exam Updated 417 Questions: https://www.easy4engine.com/CISM-CN-test-engine.html
Download Latest CISM-CN Dumps with Authentic Real Exam QA's: https://drive.google.com/open?id=19sCUI5Tim83WXDO7dKuXhSyaghQuRqe9
