CISM Drag & Drop — 10 Questions

Question 1

Order the steps for establishing a security incident response team (IRT).

Accepted Answer

Define roles and responsibilities, then Recruit team members, then Develop incident response procedures, then Acquire necessary tools and resources, then Test and validate the IRT plan. Building an IRT starts with defining roles, then recruiting, developing procedures, acquiring tools, and testing.

Answer

Recruit team members, then Define roles and responsibilities, then Develop incident response procedures, then Acquire tools, then Test

Answer

Define roles, then Acquire tools, then Recruit, then Develop procedures, then Test

Answer

Develop procedures, then Define roles, then Recruit, then Acquire tools, then Test

Question 2

Arrange the steps for implementing a new firewall rule in an enterprise environment.

Accepted Answer

Identify requirement, Submit change request, Test in staging, Implement on production, Verify rule operation. Firewall changes require clear objectives, change control, testing, implementation, and verification.

Answer

Test in staging, Implement on production, Identify requirement, Submit change request, Verify rule operation

Answer

Submit change request, Identify requirement, Test in staging, Implement on production, Verify rule operation

Answer

Identify requirement, Test in staging, Implement on production, Submit change request, Verify rule operation

Question 3

Order the steps for implementing a security awareness training program.

Accepted Answer

Needs Assessment, then Content Development, then Delivery, then Evaluation, then Continuous Improvement. Training programs start with needs assessment, then content development, delivery, evaluation, and continuous improvement.

Answer

Content Development, then Needs Assessment, then Delivery, then Evaluation, then Continuous Improvement

Answer

Needs Assessment, then Content Development, then Delivery, then Continuous Improvement, then Evaluation

Answer

Needs Assessment, then Content Development, then Evaluation, then Delivery, then Continuous Improvement

Question 4

Arrange the steps for responding to a data breach involving personally identifiable information (PII).

Accepted Answer

Step 1: Containment, Step 2: Evidence Preservation, Step 3: Internal Notification, Step 4: Impact Assessment, Step 5: External Notification. Incident response begins with containment, then evidence preservation, internal notification, impact assessment, and external notification.

Answer

Step 1: Impact Assessment, Step 2: Containment, Step 3: Evidence Preservation, Step 4: Internal Notification, Step 5: External Notification

Answer

Step 1: External Notification, Step 2: Internal Notification, Step 3: Containment, Step 4: Evidence Preservation, Step 5: Impact Assessment

Answer

Step 1: Evidence Preservation, Step 2: Containment, Step 3: Internal Notification, Step 4: Impact Assessment, Step 5: External Notification

Question 5

Order the steps for conducting an internal audit of an information security management system (ISMS) based on ISO 27001.

Accepted Answer

Scope definition, then Planning, then Execution, then Documentation, then Reporting. Audits start with scope definition, planning, execution, documentation, and reporting.

Answer

Planning, then Scope definition, then Execution, then Documentation, then Reporting

Answer

Scope definition, then Planning, then Reporting, then Execution, then Documentation

Answer

Scope definition, then Execution, then Planning, then Documentation, then Reporting

Question 6

Arrange the steps for deploying a security patch to critical servers in a production environment.

Accepted Answer

First identify and assess the patch, then test it in a non-production environment, then backup critical systems and data, then deploy the patch to production, and finally verify the patch installation and system functionality.. Patch management involves identification, testing, backup, deployment, and verification.

Answer

First identify and assess the patch, then backup critical systems, then test the patch in non-production, then deploy, then verify.

Answer

First identify and assess the patch, then test, then deploy, then backup, then verify.

Answer

First identify, then test, then verify, then backup, then deploy.

Question 7

Order the steps for a risk assessment process according to ISACA's risk management framework.

Accepted Answer

Step 1: Risk Identification, Step 2: Risk Analysis, Step 3: Risk Evaluation, Step 4: Risk Treatment, Step 5: Risk Monitoring. Risk assessment starts with identification, then analysis, evaluation, treatment, and continuous monitoring.

Answer

Step 1: Risk Identification, Step 2: Risk Evaluation, Step 3: Risk Analysis, Step 4: Risk Treatment, Step 5: Risk Monitoring

Answer

Step 1: Risk Analysis, Step 2: Risk Identification, Step 3: Risk Evaluation, Step 4: Risk Treatment, Step 5: Risk Monitoring

Answer

Step 1: Risk Identification, Step 2: Risk Analysis, Step 3: Risk Evaluation, Step 4: Risk Monitoring, Step 5: Risk Treatment

Question 8

Arrange the steps for performing a vulnerability scan on a network segment.

Accepted Answer

Obtain authorization, configure scan parameters, execute scan, analyze results, prioritize findings. Vulnerability scanning requires authorization, configuration, execution, analysis, and prioritization.

Answer

Configure scan parameters, obtain authorization, execute scan, analyze results, prioritize findings

Answer

Obtain authorization, execute scan, configure scan parameters, analyze results, prioritize findings

Answer

Obtain authorization, configure scan parameters, analyze results, execute scan, prioritize findings

Question 9

Arrange the steps in order for conducting a business impact analysis (BIA) in business continuity management.

Accepted Answer

Identify critical business functions, then determine acceptable downtime, then assess impact of disruptions, then prioritize recovery of critical functions, then document findings. A BIA first identifies critical functions, then determines acceptable downtime, assesses impact, prioritizes recovery, and finally documents findings.

Answer

Identify critical business functions, then assess impact of disruptions, then determine acceptable downtime, then prioritize recovery of critical functions, then document findings

Answer

Identify critical business functions, then document findings, then determine acceptable downtime, then assess impact of disruptions, then prioritize recovery of critical functions

Answer

Document findings, then prioritize recovery of critical functions, then assess impact of disruptions, then determine acceptable downtime, then identify critical business functions

Question 10

Order the steps for implementing a data classification policy in an organization.

Accepted Answer

Define data classification categories, then define classification procedures and guidelines, then train employees on classification, then label data according to classifications, then monitor compliance and update policy.. Data classification starts with defining categories, then procedures, training, labeling, and monitoring.

Answer

Define data classification categories, then label data according to classifications, then define classification procedures and guidelines, then train employees on classification, then monitor compliance and update policy.

Answer

Train employees on classification, then define data classification categories, then define classification procedures and guidelines, then label data according to classifications, then monitor compliance and update policy.

Answer

Define data classification categories, then define classification procedures and guidelines, then label data according to classifications, then train employees on classification, then monitor compliance and update policy.