Which of the following MOST commonly falls within the scope of an information security governance steering committee?
Answer(s): C
Prioritizing information security initiatives is the only appropriate item. The interviewing of specialists should be performed by the information security manager, while the developing of program content should be performed by the information security staff. Approving access to critical financial systems is the responsibility of individual system data owners.
Which of the following is the MOST important factor when designing information security architecture?
Answer(s): D
The most important factor for information security is that it advances the interests of the business, as defined by stakeholder requirements. Interoperability and scalability, as well as development methodologies, are all important but are without merit if a technologically-elegant solution is achieved that does not meet the needs of the business.
Which of the following characteristics is MOST important when looking at prospective candidates for the role of chief information security officer (CISO)?
Answer(s): B
Information security will be properly aligned with the goals of the business only with the ability to understand and map organizational needs to enable security technologies. All of the other choices are important but secondary to meeting business security needs.
Which of the following are likely to be updated MOST frequently?
Answer(s): A
Policies and standards should generally be more static and less subject to frequent change. Procedures on the other hand, especially with regard to the hardening of operating systems, will be subject to constant change; as operating systems change and evolve, the procedures for hardening will have to keep pace.
Who should be responsible for enforcing access rights to application data?
As custodians, security administrators are responsible for enforcing access rights to data. Data owners are responsible for approving these access rights. Business process owners are sometimes the data owners as well, and would not be responsible for enforcement. The security steering committee would not be responsible for enforcement.
Post your Comments and Discuss ISACA CISM exam prep with other Community members: