CISM Exam Dumps | An anomaly-based intrusion detection system (IDS) operates by gathering data on:

<< Prev Question Next Question >>

Question 4/359

An anomaly-based intrusion detection system (IDS) operates by gathering data on:

A. normal network behavior and using it as a baseline lor measuring abnormal activity

B. abnormal network behavior and issuing instructions to the firewall to drop rogue connections

C. abnormal network behavior and using it as a baseline for measuring normal activity

D. attack pattern signatures from historical data

Question List (359q): Question 1: Which of the following is the MOST important reason for obta...; Question 2: When management changes the enterprise business strategy whi...; Question 3: Which of the following should be the PRIMARY basis for an in...; Question 4: An anomaly-based intrusion detection system (IDS) operates b...; Question 5: An organization's automated security monitoring tool generat...; Question 6: Which of the following should an information security manage...; Question 7: A technical vulnerability assessment on a personnel informat...; Question 8: Which of the following risk scenarios is MOST likely to emer...; Question 9: Predetermined containment methods to be used in a cybersecur...; Question 10: Which of the following is MOST important to consider when de...; Question 11: Which of the following is the BEST way to achieve compliance...; Question 12: Which of the following security processes will BEST prevent ...; Question 13: While conducting a test of a business continuity plan (BCP),...; Question 14: The MOST appropriate time to conduct a disaster recovery tes...; Question 15: Business objectives and organizational risk appetite are MOS...; Question 16: Which of the following is MOST important for guiding the dev...; Question 17: Which of the following is the BEST way lo monitor for advanc...; Question 18: An organization provides notebook PCs, cable wire locks, sma...; Question 19: Which of the following is MOST important to the successful i...; Question 20: Which is following should be an information security manager...; Question 21: When deciding to move to a cloud-based model, the FIRST cons...; Question 22: Which of the following is the BEST control to protect custom...; Question 23: Which of the following BEST helps to ensure the effective ex...; Question 24: When developing an asset classification program, which of th...; Question 25: Which of the following is an information security manager's ...; Question 26: Which of the following incident response phases involves act...; Question 27: Which of the following is the MOST important reason to docum...; Question 28: Which of the following is the MOST important consideration w...; Question 29: When establishing classifications of security incidents for ...; Question 30: Which of the following should include contact information fo...; Question 31: Which of the following is the BEST way to obtain support for...; Question 32: In which cloud model does the cloud service buyer assume the...; Question 33: Which of the following roles is BEST able to influence the s...; Question 34: Which of the following should be done FIRST when implementin...; Question 35: After a ransomware incident an organization's systems were r...; Question 36: When properly implemented, secure transmission protocols pro...; Question 37: Company A, a cloud service provider, is in the process of ac...; Question 38: Which of the following is a PRIMARY function of an incident ...; Question 39: Which of the following will have the GREATEST influence on t...; Question 40: Which of the following tools provides an incident response t...; Question 41: Which of the following trends would be of GREATEST concern w...; Question 42: A common drawback of email software packages that provide na...; Question 43: An organization is experiencing a sharp increase in incident...; Question 44: Which of the following is MOST important to the effectivenes...; Question 45: During the selection of a Software as a Service (SaaS) vendo...; Question 46: Which of the following is MOST important when defining how a...; Question 47: Which of the following is the BEST justification for making ...; Question 48: Which of the following processes is MOST important for the s...; Question 49: An employee has just reported the loss of a personal mobile ...; Question 50: Which of the following is the PRIMARY reason for executive m...; Question 51: Which of the following BEST indicates that information secur...; Question 52: A recent audit found that an organization's new user account...; Question 53: After updating password standards, an information security m...; Question 54: IT projects have gone over budget with too many security con...; Question 55: A newly appointed information security manager has been aske...; Question 56: Meeting which of the following security objectives BEST ensu...; Question 57: When developing a business case to justify an information se...; Question 58: Which of the following is the BEST indication that an organi...; Question 59: Management has announced the acquisition of a new company. T...; Question 60: The MOST important element in achieving executive commitment...; Question 61: Which of the following BEST enables an organization to opera...; Question 62: A recent application security assessment identified a number...; Question 63: Recovery time objectives (RTOs) are an output of which of th...; Question 64: The MOST useful technique for maintaining management support...; Question 65: Which of the following would be MOST useful when determining...; Question 66: Which of the following is MOST important to have in place fo...; Question 67: An information security manager learns that business unit le...; Question 68: An information security manager learns through a threat inte...; Question 69: Which of the following is MOST important when developing an ...; Question 70: An organization's security policy is to disable access to US...; Question 71: Who is accountable for approving an information security gov...; Question 72: Which of the following events is MOST likely to require an o...; Question 73: Which type of recovery site is MOST reliable and can support...; Question 74: Which of the following factors has the GREATEST influence on...; Question 75: Which of the following is the BEST indication of information...; Question 76: Which of the following is MOST important to ensuring that in...; Question 77: What should be the FIRST step when implementing data loss pr...; Question 78: Which of the following is the MOST effective way to determin...; Question 79: Which of the following would BEST guide the development and ...; Question 80: An incident management team is alerted to a suspected securi...; Question 81: A data loss prevention (DLP) tool has flagged personally ide...; Question 82: A daily monitoring report reveals that an IT employee made a...; Question 83: A small organization with limited budget hires a new informa...; Question 84: Which of the following is the BEST indicator of an organizat...; Question 85: Which of the following is the BEST approach when creating a ...; Question 86: An organization has introduced a new bring your own device (...; Question 87: Which of the following BEST enables an organization to trans...; Question 88: In a cloud technology environment, which of the following wo...; Question 89: Which of the following is the BEST approach for data owners ...; Question 90: An organization has identified a large volume of old data th...; Question 91: Which of the following is MOST important to include in an in...; Question 92: Which of the following metrics provides the BEST evidence of...; Question 93: An organization has remediated a security flaw in a system. ...; Question 94: To help ensure that an information security training program...; Question 95: Which of the following is the BEST way to assess the risk as...; Question 96: An information security manager finds that a soon-to-be depl...; Question 97: When developing an information security strategy for an orga...; Question 98: Which is the BEST method to evaluate the effectiveness of an...; Question 99: Which of the following parties should be responsible for det...; Question 100: Which of the following is MOST important for the improvement...; Question 101: Which of the following would be the GREATEST obstacle to imp...; Question 102: An organization is going through a digital transformation pr...; Question 103: When establishing an information security governance framewo...; Question 104: While classifying information assets an information security...; Question 105: Which of the following BEST indicates the effectiveness of a...; Question 106: Which of the following BEST supports information security ma...; Question 107: During which phase of an incident response plan is the root ...; Question 108: Which of the following should be done FIRST when establishin...; Question 109: An information security manager has identified that security...; Question 110: Which of the following provides the BEST evidence that a rec...; Question 111: An organization has updated its business goals in the middle...; Question 112: Which of the following is MOST important to convey to employ...; Question 113: Which of the following is MOST important to consider when ch...; Question 114: An organization needs to comply with new security incident r...; Question 115: An organization experienced a loss of revenue during a recen...; Question 116: An organization involved in e-commerce activities operating ...; Question 117: Which of the following would BEST enable a new information s...; Question 118: Which of the following BEST facilitates the effective execut...; Question 119: The PRIMARY advantage of single sign-on (SSO) is that it wil...; Question 120: Which of the following roles is accountable for ensuring the...; Question 121: Which of the following is a viable containment strategy for ...; Question 122: The PRIMARY goal to a post-incident review should be to:...; Question 123: Which of the following is the MOST important outcome of a po...; Question 124: An information security manager is MOST likely to obtain app...; Question 125: Which of the following BEST provides an information security...; Question 126: The PRIMARY benefit of introducing a single point of adminis...; Question 127: Which of the following roles is MOST appropriate to determin...; Question 128: An information security manager has been tasked with develop...; Question 129: Of the following, who is accountable for data loss in the ev...; Question 130: Which of the following would BEST mitigate accidental data l...; Question 131: When establishing metrics for an information security progra...; Question 132: The PRIMARY objective of timely declaration of a disaster is...; Question 133: Information security controls should be designed PRIMARILY b...; Question 134: Which of the following is MOST helpful in determining an org...; Question 135: Which of the following is the BEST method to protect the con...; Question 136: Which of the following BEST indicates the organizational ben...; Question 137: Which of the following is the MOST appropriate metric to dem...; Question 138: Which of the following is the MOST important criterion when ...; Question 139: The PRIMARY objective of performing a post-incident review i...; Question 140: Which of the following should an information security manage...; Question 141: Which of the following will BEST facilitate the integration ...; Question 142: Determining the risk for a particular threat/vulnerability p...; Question 143: Which of the following BEST enables an incident response tea...; Question 144: Which of the following plans should be invoked by an organiz...; Question 145: An information security team is investigating an alleged bre...; Question 146: Which of the following is the MOST effective way to increase...; Question 147: Which of the following is MOST effective in monitoring an or...; Question 148: To help users apply appropriate controls related to data pri...; Question 149: A new regulatory requirement affecting an organization's inf...; Question 150: Which of the following should an information security manage...; Question 151: Which of the following analyses will BEST identify the exter...; Question 152: Which of the following is the BEST way to help ensure alignm...; Question 153: Which of the following is MOST important to consider when al...; Question 154: Which of the following is MOST important for an information ...; Question 155: Which of the following is the BEST reason for an organizatio...; Question 156: Which of the following BEST facilitates effective strategic ...; Question 157: Application data integrity risk is MOST directly addressed b...; Question 158: Which of the following is MOST important to consider when ch...; Question 159: Which of the following provides the MOST comprehensive insig...; Question 160: Which of the following is the BEST reason for senior managem...; Question 161: Which of the following should be the PRIMARY objective when ...; Question 162: Which of the following metrics is MOST appropriate for evalu...; Question 163: Which of the following should be implemented to BEST reduce ...; Question 164: Which of the following would MOST effectively ensure that a ...; Question 165: Which of the following presents the GREATEST risk associated...; Question 166: A security incident has been reported within an organization...; Question 167: Which or the following is MOST important to consider when de...; Question 168: Security administration efforts will be greatly reduced foll...; Question 169: An organization's research department plans to apply machine...; Question 170: Which of the following is MOST helpful for protecting an ent...; Question 171: When analyzing the emerging risk and threat landscape, an in...; Question 172: The MOST important reason for having an information security...; Question 173: Which of the following will provide the MOST guidance when d...; Question 174: Which of the following would be the BEST way for an informat...; Question 175: Which of the following is the MOST important factor in an or...; Question 176: An organization implemented a number of technical and admini...; Question 177: Which of the following is the MOST effective way to demonstr...; Question 178: Which of the following is the GREATEST benefit of informatio...; Question 179: A small organization has a contract with a multinational clo...; Question 180: Which of the following is MOST important to the effectivenes...; Question 181: Which of the following is MOST critical when creating an inc...; Question 182: A newly appointed information security manager has been aske...; Question 183: The ULTIMATE responsibility for ensuring the objectives of a...; Question 184: Which of the following is the BEST approach for managing use...; Question 185: Which of the following is MOST important to include in an in...; Question 186: The PRIMARY reason for creating a business case when proposi...; Question 187: An information security program is BEST positioned for succe...; Question 188: Which of the following eradication methods is MOST appropria...; Question 189: The PRIMARY reason to properly classify information assets i...; Question 190: Which of the following is the PRIMARY reason to assign a ris...; Question 191: How does an organization PRIMARILY benefit from the creation...; Question 192: Which of the following is the BEST indication of an effectiv...; Question 193: A cloud application used by an organization is found to have...; Question 194: Which of the following would provide the BEST input to a bus...; Question 195: ACISO learns that a third-party service provider did not not...; Question 196: Which of the following is the MOST important outcome of effe...; Question 197: Which of the following is the BEST indication of effective i...; Question 198: Which of the following is necessary to ensure consistent pro...; Question 199: Which of the following is MOST important when conducting a f...; Question 200: An organization wants to integrate information security into...; Question 201: Which of the following would be MOST effective in reducing t...; Question 202: Which of the following is MOST important to include in an in...; Question 203: When building support for an information security program, w...; Question 204: Before approving the implementation of a new security soluti...; Question 205: Which of the following is the MOST effective way to prevent ...; Question 206: Which of the following desired outcomes BEST supports a deci...; Question 207: Which of the following is a function of the information secu...; Question 208: Which of the following is a desired outcome of information s...; Question 209: Which of the following is the MOST important detail to captu...; Question 210: Which of the following is the MOST important reason for an o...; Question 211: Which of the following is the GREATEST challenge with assess...; Question 212: Which of the following is the MOST effective way to ensure t...; Question 213: When developing a categorization method for security inciden...; Question 214: Which of the following should an information security manage...; Question 215: Which of the following presents the GREATEST challenge to th...; Question 216: Which of the following BEST enables an information security ...; Question 217: Which of the following should be triggered FIRST when unknow...; Question 218: For the information security manager, integrating the variou...; Question 219: Which of the following should an information security manage...; Question 220: Which of the following should an organization do FIRST upon ...; Question 221: When remote access to confidential information is granted to...; Question 222: A balanced scorecard MOST effectively enables information se...; Question 223: Which of the following should be the PRIMARY outcome of an i...; Question 224: Which of the following is the BEST way to reduce the risk of...; Question 225: The results of a risk assessment for a potential network rec...; Question 226: Which of the following is the MOST important role of the inf...; Question 227: A user reports a stolen personal mobile device that stores s...; Question 228: During the initiation phase of the system development life c...; Question 229: Which of the following is the MOST important consideration w...; Question 230: The fundamental purpose of establishing security metrics is ...; Question 231: During which of the following development phases is it MOST ...; Question 232: Of the following, who is BEST suited to own the risk discove...; Question 233: Which of the following is MOST effective for communicating f...; 1 commentQuestion 234: Which of the following functions is MOST critical when initi...; Question 235: How does an incident response team BEST leverage the results...; Question 236: What should be an information security manager's MOST import...; Question 237: Which of the following is MOST important to consider when de...; Question 238: An incident management team leader sends out a notification ...; Question 239: An international organization with remote branches is implem...; Question 240: An organization permits the storage and use of its critical ...; Question 241: Which of the following roles is BEST suited to validate user...; Question 242: What is the PRIMARY objective of implementing standard secur...; Question 243: When remote access is granted to a company's internal networ...; Question 244: A new information security manager finds that the organizati...; Question 245: Which of the following BEST enables an organization to provi...; Question 246: Which of the following should be established FIRST when impl...; Question 247: An organization has decided to outsource IT operations. Whic...; Question 248: Which of the following is the MOST effective way to detect i...; Question 249: Which of the following is the PRIMARY responsibility of the ...; Question 250: An organization that conducts business globally is planning ...; Question 251: Which of the following is the PRIMARY preventive method to m...; Question 252: Which of the following activities MUST be performed by an in...; Question 253: Which of the following is MOST effective in preventing the i...; Question 254: Which of the following is the PRIMARY reason to regularly up...; Question 255: An information security manager believes that information ha...; Question 256: Which of the following BEST enables an organization to maint...; Question 257: Which of the following metrics would provide an accurate mea...; Question 258: Which of the following MUST be defined in order for an infor...; 1 commentQuestion 259: Which of the following is the MOST important reason for logg...; Question 260: Which of the following would be of GREATEST assistance in de...; Question 261: To help ensure that an information security training program...; Question 262: Which of the following components of an information security...; Question 263: Recovery time objectives (RTOs) are BEST determined by:...; Question 264: Which of the following BEST illustrates residual risk within...; Question 265: Which of the following MUST be established to maintain an ef...; Question 266: The PRIMARY purpose of conducting a business impact analysis...; Question 267: A business unit recently integrated the organization's new s...; Question 268: Internal audit has reported a number of information security...; Question 269: Which of the following would BEST enable the timely executio...; Question 270: An information security manager learns of a new standard rel...; Question 271: To overcome the perception that security is a hindrance to b...; Question 272: Which of the following is the BEST method to ensure complian...; Question 273: Prior to implementing a bring your own device (BYOD) program...; Question 274: Which of the following is the BEST indication ofa successful...; Question 275: An organization has implemented a new customer relationship ...; Question 276: Which of the following is an example of risk mitigation?...; Question 277: Senior management has expressed concern that the organizatio...; Question 278: Which of the following is the MOST important benefit of usin...; Question 279: Which of the following BEST facilitates an information secur...; Question 280: What should be the FIRST step when an Internet of Things (lo...; Question 281: Which of the following is MOST useful to an information secu...; 1 commentQuestion 282: Which of the following should be the PRIMARY consideration w...; 1 commentQuestion 283: Which of the following should be considered FIRST when recov...; Question 284: An organization has received complaints from users that some...; Question 285: Which is MOST important to identify when developing an effec...; Question 286: Within the confidentiality, integrity, and availability (CIA...; Question 287: An organization is aligning its incident response capability...; Question 288: Which of the following is the GREATEST concern resulting fro...; Question 289: Which of the following is the MOST critical factor for infor...; Question 290: Management decisions concerning information security investm...; Question 291: Which of the following will BEST enable an effective informa...; Question 292: Which of the following is the PRIMARY objective of a cyber r...; Question 293: The BEST way to ensure that frequently encountered incidents...; Question 294: Which of the following presents the GREATEST challenge to a ...; Question 295: Which of the following is the BEST source of information to ...; Question 296: Which of the following is the BEST way for an organization t...; Question 297: Due to changes in an organization's environment, security co...; Question 298: Which of the following has the GREATEST impact on efforts to...; Question 299: Which of the following should be the PRIMARY focus of a stat...; Question 300: Which of the following defines the MOST comprehensive set of...; Question 301: An organization has purchased an Internet sales company to e...; Question 302: Following a breach where the risk has been isolated and fore...; Question 303: Which of the following is a PRIMARY benefit of managed secur...; Question 304: Which of the following has The GREATEST positive impact on T...; Question 305: Which of the following would provide the MOST effective secu...; Question 306: Which of the following should an information security manage...; Question 307: Which of the following is MOST appropriate to communicate to...; Question 308: An organization is creating a risk mitigation plan that cons...; Question 309: The PRIMARY advantage of involving end users in continuity p...; Question 310: Which of the following should an information security manage...; Question 311: An organization is increasingly using Software as a Service ...; Question 312: Which of the following should be the PRIMARY area of focus w...; Question 313: Which of the following factors would have the MOST significa...; Question 314: A forensic examination of a PC is required, but the PC has b...; Question 315: Which of the following is MOST important for the information...; Question 316: Reevaluation of risk is MOST critical when there is:...; Question 317: When assigning a risk owner, the MOST important consideratio...; Question 318: Which of the following BEST enables an organization to effec...; Question 319: An organization learns that a third party has outsourced cri...; Question 320: Which of the following is the BEST course of action when an ...; Question 321: Which of the following service offerings in a typical Infras...; Question 322: A newly appointed information security manager of a retailer...; Question 323: Which of the following BEST determines an information asset'...; Question 324: Which of the following is the MOST important reason to ensur...; Question 325: The PRIMARY objective of timely declaration of a disaster is...; Question 326: Which of the following is the MOST important objective when ...; Question 327: Which of the following would BEST help to ensure compliance ...; Question 328: Which of the following BEST enables an organization to enhan...; 1 commentQuestion 329: When integrating security risk management into an organizati...; Question 330: Which of the following would be the MOST effective way to pr...; Question 331: Which of the following is the PRIMARY responsibility of an i...; Question 332: A software vendor has announced a zero-day vulnerability tha...; Question 333: Which of the following is the BEST way to enhance training f...; Question 334: An organization uses a security standard that has undergone ...; Question 335: An organization is considering using a third party to host s...; Question 336: Which of the following considerations is MOST important when...; Question 337: Which of the following would BEST support the business case ...; Question 338: Which of the following is MOST important to maintain integra...; Question 339: Which of the following should have the MOST influence on an ...; Question 340: Which of the following processes BEST supports the evaluatio...; Question 341: Which of the following should be the PRIMARY basis for a sev...; Question 342: Which of the following should be done FIRST when developing ...; Question 343: Which of the following is the PRIMARY purpose of a business ...; Question 344: An information security manager has identified that privileg...; Question 345: Which of the following will result in the MOST accurate cont...; Question 346: Which of the following is the MOST important consideration w...; Question 347: To effectively manage an organization's information security...; Question 348: A finance department director has decided to outsource the o...; Question 349: Which of the following should be the MOST important consider...; Question 350: Which of the following is the BEST approach for governing no...; Question 351: Which of the following MUST happen immediately following the...; Question 352: Which of the following is the MOST important issue in a pene...; Question 353: An incident response team has been assembled from a group of...; Question 354: Several months after the installation of a new firewall with...; Question 355: To inform a risk treatment decision, which of the following ...; Question 356: An information security manager has become aware that a thir...; Question 357: A business requires a legacy version of an application to op...; Question 358: In addition to executive sponsorship and business alignment,...; Question 359: An information security manager learns that a risk owner has...

Question 4/359

LEAVE A REPLY

Download PDF File