MENU
Which of the following provides the MOST useful information for identifying security control gaps on an application server?
Suggested Answer: A
Get Premium CISM Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
12 comments · newest first
RO
Rosalia
11 months ago
Surprised that threat models aren't getting more love here!
DO
Dorsey
12 months ago
Internal audit reports can be useful too, though!
EM
Emelda
12 months ago
Wait, aren't penetration tests more effective for this?
HA
Hassie
12 months ago
Totally agree, they give a comprehensive view!
LA
Lacresha
1 year ago
I think risk assessments are key for identifying gaps.
DE
Devon
1 year ago
Threat models seem relevant, but I feel like penetration testing would give more direct evidence of vulnerabilities.
DA
Darrin
1 year ago
I remember practicing a question where risk assessments were highlighted as crucial for identifying security gaps. That might be the answer here.
MA
Malinda
1 year ago
I think internal audit reports might provide some insights, but I'm not sure if they're the most comprehensive for identifying gaps.
CE
Celestina
1 year ago
I’m a bit confused; I thought penetration testing was more about testing existing controls rather than identifying gaps. Maybe risk assessments are better?
CO
Cortney
1 year ago
Hmm, I'm a bit unsure about this one. The options seem to cover different aspects of managing an Oracle VM environment. I'll need to think through the purpose of priority and process cap % to figure out the right scenario.
MA
Margret
1 year ago
Okay, let me see. "Encryption and Key Management" sounds like it could be a control specification, but I think it's more likely a domain. I'll go with B.
RE
Reed
1 year ago
I think I can handle this one. I just need to figure out the right COUNTIFS function to use.