Discuss Isaca CISM Exam Topic 4 Question 66

An organization has introduced a new bring your own device (BYOD) program. The security manager has determined that a small number of employees are utilizing free cloud storage services to store company data through their mobile devices. Which of the following is the MOST effective course of action?

AAllow the practice to continue temporarily for monitoring purposes.

BDisable the employees' remote access to company email and data

CInitiate remote wipe of the devices

DAssess the business need to provide a secure solution

Suggested Answer: D

The most effective course of action when employees are using free cloud storage services to store company data through their mobile devices is to assess the business need to provide a secure solution, such as a corporate-approved cloud service or a virtual desktop environment. Assessing the business need can help understand why employees are using free cloud storage services, what kind of data they are storing, and what are the security risks and requirements. Based on the assessment, the security manager can propose a secure solution that meets the business needs and complies with the BYOD policy. The other options, such as allowing the practice to continue, disabling remote access, or initiating remote wipe, may not address the underlying business need or may cause disruption or data loss. Reference:

https://www.digitalguardian.com/blog/byod-security-expert-tips-policy-mitigating-risks-preventing-breach

https://news.microsoft.com/en-xm/2021/03/18/how-to-have-secure-remote-working-with-a-byod-policy/

https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/-infosec-guide-bring-your-own-device-byod

Get Premium CISM Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

17 comments · newest first

Erick 11 months ago

Remote wipe is overkill, we need a better solution.

Melina 11 months ago

Allowing it temporarily? That could backfire.

Tresa 11 months ago

Surprised they’re using free services for company data!

Yvette 11 months ago

I think assessing the business need is the best move.

Janine 11 months ago

Disabling remote access seems too harsh.

Crista 12 months ago

I’m leaning towards option C, but initiating a remote wipe seems extreme without first understanding the situation better.

Carla 12 months ago

I practiced a similar question where disabling access was the answer, but I feel like that might be too harsh here.

Laila 12 months ago

I think option D makes sense because we need to assess the business need first, but I wonder if that takes too long.

Yuonne 1 year ago

I remember discussing the risks of using free cloud services in class, but I'm not sure if allowing it to continue temporarily is a good idea.

Francesco 1 year ago

Okay, I think I've got a strategy here. I'll focus on finding the most effective solution to mitigate the security risk while also considering the business needs.

Ashanti 1 year ago

Hmm, I'm a bit unsure about this one. I'll need to think through the security implications of each choice and how they might impact the business.

Mitsue 1 year ago

This seems like a tricky one. I'll need to carefully weigh the options and consider the potential risks and consequences of each approach.

Marget 1 year ago

Ah, this is a classic security vs. convenience dilemma. I'll need to strike the right balance and choose the option that best protects the company's data.

Vi 1 year ago

This seems like a straightforward integration problem, but I'll need to carefully consider the volume of calls and the need for reliable authentication between the systems.

Chantell 1 year ago

Hmm, this looks like a tricky one. I'll need to think through the requirements carefully to determine the minimum configuration.

Rana 1 year ago

I think the best approach here is to stick to the facts and not include any unsupported hypotheses. The bug report should be objective and focused on the observed behavior, not the tester's speculations. Option A seems like the safest choice.

Simona 1 year ago

This seems like a straightforward question about incident response team authority. I'll carefully read through the options and think about the key reasons why training employees on this topic is critical.

Isaca CISM Exam - Topic 4 Question 66 Discussion