A test plan to validate the security controls of a new system should be developed during which phase of the project?
Answer(s): C
In the design phase, security checkpoints are defined and a test plan is developed. The testing phase is too late since the system has already been developed and is in production testing. In the initiation phase, the basic security objective of the project is acknowledged. Development is the coding phase and is too late to consider test plans.
The MOST effective way to ensure that outsourced service providers comply with the organization's information security policy would be:
Regular audit exercise can spot any gap in the information security compliance. Service level monitoring can only pinpoint operational issues in the organization's operational environment. Penetration testing can identify security vulnerability but cannot ensure information compliance Training can increase users' awareness on the information security policy, but is not more effective than auditing.
In order to protect a network against unauthorized external connections to corporate systems, the information security manager should BEST implement:
Answer(s): A
Strong authentication will provide adequate assurance on the identity of the users, while IP antispoofing is aimed at the device rather than the user. Encryption protocol ensures data confidentiality and authenticity while access lists of trusted devices are easily exploited by spoofed identity of the clients.
The PRIMARY driver to obtain external resources to execute the information security program is that external resources can:
Choice A represents the primary driver for the information security manager to make use of external resources. The information security manager will continue to be responsible for meeting the security program requirements despite using the services of external resources. The external resources should never completely replace the role of internal resources from a strategic perspective. The external resources cannot have a better knowledge of the business of the information security manager's organization than do the internal resources.
Priority should be given to which of the following to ensure effective implementation of information security governance?
Answer(s): D
Planning is the key to effective implementation of information security governance. Consultation, negotiation and facilitation come after planning.
Post your Comments and Discuss ISACA CISM exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CISM content, but please register or login to continue.