Online Access Free ISMP Exam Questions

When is revision of an employee's access rights mandatory?

• A.At least each year
• B.At all moments stated in the information security policy
• C.After any position change
• D.At hire

The handling of security incidents is done by the incident management process under guidelines of information security management. These guidelines call for several types of mitigation plans.
Which mitigation plan covers short-term recovery after a security incident has occurred?

• A.The disaster recovery plan
• B.The risk treatment plan
• C.The incident response plan
• D.The Business Continuity Plan (BCP)

It is important that an organization is able to prove compliance with information standards and legislation. One of the most important areas is documentation concerning access management. This process contains a number of activities including granting rights, monitoring identity status, logging, tracking access and removing rights. Part of these controls are audit trail records which may be used as evidence for both internal and external audits.
What component of the audit trail is the most important for an external auditor?

• A.System-specific policies for business systems
• B.Log review, consolidation and management
• C.Access criteria and access control mechanisms

In a company a personalized smart card is used for both physical and logical access control.
What is the main purpose of the person's picture on the smart card?

• A.To authenticate the owner of the card
• B.To identify the role of the card owner
• C.To verify the iris of the card owner
• D.To authorize the owner of the card

A security manager just finished the final copy of a risk assessment. This assessment contains a list of identified risks and she has to determine how to treat these risks.
What is the best option for the treatment of risks?

• A.Design appropriate controls to reduce the risk
• B.Begin risk remediation immediately as the organization is currently at risk
• C.Remediate the risk regardless of cost
• D.Decide the criteria for determining if the risk can be accepted