Exin ISMP Exam Questions Instant Access - No Installation Required

Question 1

Recovery Time Objective (RTO) and Recovery Point Objective (RPO) are key terms in business continuity management (BCM). Reducing loss of data is one of the focus areas of a BCM policy.

What requirement is in the data recovery policy to realize minimal data loss?

AMaximize RPO

BReduce RPO

CReduce RTO

DReduce the time between RTO and RPO

Answer : B

Question 2

The ambition of the security manager is to certify the organization against ISO/IEC 27001.

What is an activity in the certification program?

AFormulate the security requirements in the outsourcing contracts

BImplement the security baselines in Secure Systems Development Life Cycle (SecSDLC)

CPerform a risk assessment of the secure internet connectivity architecture of the datacenter

DProduce a Statement of Applicability based on risk assessments

Answer : D

Question 3

It is important that an organization is able to prove compliance with information standards and legislation. One of the most important areas is documentation concerning access management. This process contains a

number of activities including granting rights, monitoring identity status, logging, tracking access and removing rights. Part of these controls are audit trail records which may be used as evidence for both internal and

external audits.

What component of the audit trail is the most important for an external auditor?

AAccess criteria and access control mechanisms

BLog review, consolidation and management

CSystem-specific policies for business systems

Answer : A

Question 4

An experienced security manager is well aware of the risks related to communication over the internet. She also knows that Public Key Infrastructure (PKI) can be used to keep e-mails between employees confidential.

Which is the main risk of PKI?

AThe Certificate Authority (CA) is hacked.

BThe certificate is invalid because it is on a Certificate Revocation List.

CThe users lose their public keys.

DThe HR department wants to be a Registration Authority (RA).

Answer : A

Question 5

The handling of security incidents is done by the incident management process under guidelines of information security management. These guidelines call for several types of mitigation plans.

Which mitigation plan covers short-term recovery after a security incident has occurred?

AThe Business Continuity Plan (BCP)

BThe disaster recovery plan

CThe incident response plan

DThe risk treatment plan

Answer : C

Question 6

Who should be asked to check compliance with the information security policy throughout the company?

AInternal audit department

BExternal forensics investigators

CThe same company that checks the yearly financial statement

Answer : B

Question 7

The security manager of a global company has decided that a risk assessment needs to be completed across the company.

What is the primary objective of the risk assessment?

AIdentify, quantify and prioritize each of the business-critical assets residing on the corporate infrastructure

BIdentify, quantify and prioritize risks against criteria for risk acceptance

CIdentify, quantify and prioritize the scope of this risk assessment

DIdentify, quantify and prioritize which controls are going to be used to mitigate risk

Answer : B

Exin Information Security Management Professional based on ISO/IEC 27001 ISMP Exam Questions