Isaca CISM Exam - Topic 4 Question 66 Discussion

Actual exam question for Isaca's CISM exam

Question #: 66
Topic #: 4

[All CISM Questions]

An organization has introduced a new bring your own device (BYOD) program. The security manager has determined that a small number of employees are utilizing free cloud storage services to store company data through their mobile devices. Which of the following is the MOST effective course of action?

AAllow the practice to continue temporarily for monitoring purposes.

BDisable the employees' remote access to company email and data

CInitiate remote wipe of the devices

DAssess the business need to provide a secure solution

Show Suggested Answer

Suggested Answer: D

The most effective course of action when employees are using free cloud storage services to store company data through their mobile devices is to assess the business need to provide a secure solution, such as a corporate-approved cloud service or a virtual desktop environment. Assessing the business need can help understand why employees are using free cloud storage services, what kind of data they are storing, and what are the security risks and requirements. Based on the assessment, the security manager can propose a secure solution that meets the business needs and complies with the BYOD policy. The other options, such as allowing the practice to continue, disabling remote access, or initiating remote wipe, may not address the underlying business need or may cause disruption or data loss. Reference:

https://www.digitalguardian.com/blog/byod-security-expert-tips-policy-mitigating-risks-preventing-breach

https://news.microsoft.com/en-xm/2021/03/18/how-to-have-secure-remote-working-with-a-byod-policy/

https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/-infosec-guide-bring-your-own-device-byod

by Talia at Dec 10, 2023, 06:38 AM

Limited Time Offer

25%

Off

Get Premium CISM Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Erick

3 months ago

Remote wipe is overkill, we need a better solution.

upvoted 0 times

...

Melina

3 months ago

Allowing it temporarily? That could backfire.

upvoted 0 times

...

Tresa

3 months ago

Surprised they’re using free services for company data!

upvoted 0 times

...

Yvette

4 months ago

I think assessing the business need is the best move.

upvoted 0 times

...

Janine

4 months ago

Disabling remote access seems too harsh.

upvoted 0 times

...

Crista

4 months ago

I’m leaning towards option C, but initiating a remote wipe seems extreme without first understanding the situation better.

upvoted 0 times

...

Carla

4 months ago

I practiced a similar question where disabling access was the answer, but I feel like that might be too harsh here.

upvoted 0 times

...

Laila

4 months ago

I think option D makes sense because we need to assess the business need first, but I wonder if that takes too long.

upvoted 0 times

...

Yuonne

5 months ago

I remember discussing the risks of using free cloud services in class, but I'm not sure if allowing it to continue temporarily is a good idea.

upvoted 0 times

...

Francesco

5 months ago

Okay, I think I've got a strategy here. I'll focus on finding the most effective solution to mitigate the security risk while also considering the business needs.

upvoted 0 times

...

Ashanti

5 months ago

Hmm, I'm a bit unsure about this one. I'll need to think through the security implications of each choice and how they might impact the business.

upvoted 0 times

...

Mitsue

5 months ago

This seems like a tricky one. I'll need to carefully weigh the options and consider the potential risks and consequences of each approach.

upvoted 0 times

...

Marget

5 months ago

Ah, this is a classic security vs. convenience dilemma. I'll need to strike the right balance and choose the option that best protects the company's data.

upvoted 0 times

...

Vi

5 months ago

This seems like a straightforward integration problem, but I'll need to carefully consider the volume of calls and the need for reliable authentication between the systems.

upvoted 0 times

...

Chantell

5 months ago

Hmm, this looks like a tricky one. I'll need to think through the requirements carefully to determine the minimum configuration.

upvoted 0 times

...

Rana

5 months ago

I think the best approach here is to stick to the facts and not include any unsupported hypotheses. The bug report should be objective and focused on the observed behavior, not the tester's speculations. Option A seems like the safest choice.

upvoted 0 times

...

Simona

5 months ago

This seems like a straightforward question about incident response team authority. I'll carefully read through the options and think about the key reasons why training employees on this topic is critical.

upvoted 0 times

...