CISM Question 95

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose D1

  For many reasons. 1. Topology and configuration management is paramount. My consideration of awarding the contract to service provider is influenced by server co-mingling. How do I know if a Bad Actor state is on the same hardware. 2. If there is a security incident, how will forensics have access to the data if other customers data is affected/lost? 3. Logical separation is a great thought, but most Defense in Depth allows horizontal movement, once you in a certain level, horizontal movement normally comes with. So many reasons this is a bad answer.

• Chose C1

  C. Authority of the subscriber to approve access to its data The authority to approve access to the subscriber's data is of paramount importance, as maintaining control over data access is a critical factor in protecting the confidentiality and integrity of the organization's sensitive and proprietary information. Without it, the organization could face risks that threaten its security posture and regulatory compliance.

• Chose C1

  C. Authority of the subscriber to approve access to its data The GREATEST concern for an information security manager in a contract with a multinational cloud computing vendor would be the omission of the authority of the subscriber to approve access to its data (Option C). This is because data security and privacy are paramount concerns when using cloud services. If the subscriber does not have control over who can access their data and under what circumstances, it can lead to significant security and privacy risks.