CISMP-V9 Exam Questions & Answers

The global pandemic has accelerated the trend of remote work, which inherently increases the risk of information security breaches due to insecure premises (A) and the need for additional tools like VPNs . There's also a higher likelihood of attackers exploiting vulnerabilities during such operational changes (D). However, the need for additional physical security at data centres and corporate headquarters (B) is less likely to be a direct result of a pandemic since the focus shifts to remote work and digital security rather than physical premises that are less occupied.

Security controls are measures taken to safeguard an information system from attacks or to mitigate the impact of a breach. They are commonly classified into three main categories: preventive, detective, and corrective. Preventive controls aim to prevent incidents before they occur, detective controls are designed to discover and detect security events, and corrective controls are intended to restore systems to normal operation after an incident. The term ''nominative'' is not recognized as a standard classification of security controls within the principles of information security management.Instead, the accepted classifications align with the objectives of protecting the confidentiality, integrity, and availability of information.Reference: The BCS Foundation Certificate in Information Security Management Principles outlines the categorization, operation, and effectiveness of controls of different types and characteristics, which does not include ''nominative'' as a classification1.

In the context of Information Security Management Principles, risk acceptance is a strategic option where an organization decides to accept the potential cost of a risk without taking any actions to mitigate it. This decision is typically made when the cost of mitigating the risk exceeds the cost of the risk's potential impact. Acceptance is part of the risk management process, which also includes risk identification, assessment, and treatment. When accepting a risk, it is crucial to document the decision and the rationale behind it, ensuring that it aligns with the organization's risk appetite and overall security policy.

In a security governance framework, the policy is typically at the highest level because it defines the overall direction and principles that govern the security posture of an organization. Policies are high-level statements that provide guidance to all members of an organization and form the foundation upon which standards, procedures, and guidelines are built. They are approved by the highest levels of management and are meant to be more stable over time, providing a consistent framework for security across the organization.

In a shared server environment, such as cloud services, it's crucial to maintain the confidentiality and integrity of client data. The most effective way to prevent one client from accessing another's data is through data isolation and logical storage segregation. This approach aligns with the Information Security Management Principles, specifically under the domain of Technical Security Controls. Data isolation ensures that each client's data is processed and stored separately, while logical storage segregation uses software controls to keep data separate even when stored on the same physical server. This method is part of a broader set of security controls that include encryption, access controls, and regular audits to ensure compliance with security policies.