A recommended method to document the respective roles of groups and individuals for a given process is to:
You have been promoted to the CISO of a retail store. Which of the following compliance standards is the MOST important to the organization?
When gathering security requirements for an automated business process improvement program, which of the following is MOST important?
An organization correctly configured a Data Loss Prevention (DLP) technology. Afterward, sensitive data was found on public websites. What is the MOST likely reason for this situation?
A university recently hired a CISO. One of the first tasks is to develop a continuity of operations plan (COOP).
In developing the business impact assessment (BIA), which of the following MOST closely relate to the data backup and restoral?
In effort to save your company money which of the following methods of training results in the lowest cost for the organization?
What process evaluates technical and non-technical security controls to validate that an implementation meets a specific set of security requirements?
Scenario: Most industries require compliance with multiple government regulations and/or industry standards to meet data protection and privacy mandates.
What is one proven method to account for common elements found within separate regulations and/or standards?
Which of the following is MOST important when tuning an Intrusion Detection System (IDS)?
Which of the following is the PRIMARY goal of risk management?
Developing effective security controls is a balance between:
You assess the corporate culture and determine there is a pervasive opinion that the security program limits business performance. What is the MOST effective approach to reshape corporate culture to adopt security as a norm?
After a risk assessment is performed, a particular risk is considered to have the potential of costing the organization 1.2 Million USD. This is an example of
A CISO sees abnormally high volumes of exceptions to security requirements and constant pressure from business units to change security processes. Which of the following represents the MOST LIKELY cause of this situation?
Which of the following conditions would be the MOST probable reason for a security project to be rejected by the executive board of an organization?
Many successful cyber-attacks currently include:
The Health Insurance Portability and Accountability Act (HIPAA) requires an agreement between Cloud Service Providers (CCSP) and the covered entity. Based on HIPAA. which document must be completed between the covered entity and the CCSP?
Which of the following are necessary to formulate responses to external audit findings?
Providing oversight of an information security program for the organization is the primary responsibility of which group?
Which of the following is MOST effective when mitigating social engineering risks?
An organization is looking for a framework to measure the efficiency and effectiveness of their Information Security Management System. Which of the following international standards can BEST assist this organization?
What is a difference from the list below between quantitative and qualitative Risk Assessment?
What role does the statement of retained earnings serve within the financial reporting of an organization?
Controls that were implemented to correct prior audit findings are insufficient. Before adjusting controls, what original document should be reviewed?
What is the MOST important result of the management response within the audit process?
Which of the following would be used to measure the effectiveness of an Information Security Management System (ISMS)?
What is the MOST probable explanation for a security policy that is often ignored and unenforced?
Which of the following statements below regarding Key Performance indicators (KPIs) are true?
Which of the following is the MOST important result of a business-aligned security program?
Which of the following is the MOST effective way to measure the effectiveness of security controls on a perimeter network?
ABC Limited has recently suffered a security breach with customers’ social security number available on the dark web for sale. The CISO, during the time of the incident, has been fired, and you have been hired as the replacement. The analysis of the breach found that the absence of an insider threat program, lack of least privilege policy, and weak access control was to blame. You would like to implement key performance indicators to mitigate the risk.
Which metric would meet the requirement?
What type of control is used when patching systems with the latest updates?
An organization has implemented a change management process for all changes to the IT production environment. This change management process follows best practices and is expected to help stabilize the availability and integrity of the organization’s IT environment. Which of the following can be used to measure the effectiveness of this newly implemented process:
Which of the following provides an audit framework?
What should an organization do to ensure that they have a sound Business Continuity (BC) Plan?
When information security falls under the Chief Information Officer (CIO), what is their MOST essential role?
Scenario: You are the CISO and are required to brief the C-level executive team on your information security audit for the year. During your review of the audit findings you discover that many of the controls that were put in place the previous year to correct some of the findings are not performing as needed. You have thirty days until the briefing.
To formulate a remediation plan for the non-performing controls what other document do you need to review before adjusting the controls?
Which regulation or policy governs protection of personally identifiable user data gathered during a cyber investigation?
SCENARIO: Critical servers show signs of erratic behavior within your organization’s intranet. Initial information indicates the systems are under attack from an outside entity. As the Chief Information Security Officer (CISO), you decide to deploy the Incident Response Team (IRT) to determine the details of this incident and take action according to the information available to the team.
During initial investigation, the team suspects criminal activity but cannot initially prove or disprove illegal actions. What is the MOST critical aspect of the team’s activities?
You manage a newly created Security Operations Center (SOC), your team is being inundated with security alerts and don’t know what to do. What is the BEST approach to handle this situation?
Which publication serves as a resource of enterprise security-based standards and BEST practices?
Which of the following best describes a portfolio?
A CISO decides to analyze the IT infrastructure to ensure security solutions adhere to the concepts of how
hardware and software is implemented and managed within the organization. Which of the following principles
does this best demonstrate?
Which of the following is the BEST method to manage data that no longer provides business value?
The primary responsibility for assigning entitlements to a network share lies with which role?
The effectiveness of an audit is measured by?
An information security department is required to remediate system vulnerabilities when they are discovered. Please select the three primary remediation methods that can be used on an affected system.
Which of the following are the MOST important factors for proactively determining system vulnerabilities?
What key technology can mitigate ransomware threats?
Which of the following is MOST useful when developing a business case for security initiatives?
A business unit within your organization intends to deploy a new technology in a manner that places it in violation of existing information security standards. What immediate action should the information security manager take?
A missing/ineffective security control is identified. Which of the following should be the NEXT step?
As the CISO, you have been tasked with the execution of the company’s key management program. You
MUST ensure the integrity of encryption keys at the point of generation. Which principal of encryption key
control will ensure no single individual can constitute or re-constitute a key?
When deploying an Intrusion Prevention System (IPS) the BEST way to get maximum protection from the system is to deploy it
As the Business Continuity Coordinator of a financial services organization, you are responsible for ensuring assets are recovered timely in the event of a disaster. Which is the BEST Disaster Recovery performance indicator to validate that you are prepared for a disaster?
A global health insurance company is concerned about protecting confidential information. Which of the following is of MOST concern to this organization?
A CISO must conduct risk assessments using a method where the Chief Financial Officer (CFO) receives impact data in financial terms to use as input to select the proper level of coverage in a new cybersecurity insurance policy.
What is the MOST effective method of risk analysis to provide the CFO with the information required?
Which of the following is an example of risk transference?
Risk transference is BEST represented by which of the following actions?
Which of the following is the MOST critical step when establishing a security governance program?
Which of the following represents the best method of ensuring business unit alignment with security program requirements?
In accordance with best practices and international standards, how often is security awareness training provided to employees of an organization?
Which risk analysis method is the MOST effective for determining the exact financial impact of risks in an organization?
Scenario: An organization has recently appointed a CISO. This is a new role in the organization and it signals the increasing need to address security consistently at the enterprise level. This new CISO, while confident with skills and experience, is constantly on the defensive and is unable to advance the IT security centric agenda.
The CISO has been able to implement a number of technical controls and is able to influence the Information Technology teams but has not been able to influence the rest of the organization. From an organizational perspective, which of the following is the LIKELY reason for this?
Which of the following BEST describes countermeasures that minimize risk?
What cloud computing environment allows access and use by several organizations for information sharing?
What is the name of a formal statement that defines the strategy, approach, or expectations related to specific concerns within an organization:
Which of the following terms is used to describe the estimate of all direct and indirect costs associated with an asset or acquisition over its entire life cycle?
A customer of a bank has placed a dispute on a payment for a credit card account. The banking system uses digital signatures to safeguard the integrity of their transactions. The bank claims that the system shows proof that the customer in fact made the payment. What is this system capability commonly known as?
Which of the following is considered one of the most frequent failures in project management?
If a competitor wants to cause damage to your organization, steal critical secrets, or put you out of business,
they just have to find a job opening, prepare someone to pass the interview, have that person hired, and they
will be in the organization. How would you prevent such type of attacks?
The purpose of NIST SP 800-53 as part of the NIST System Certification and Accreditation Project is to establish a set of standardized, minimum security controls for IT systems addressing low, moderate, and high levels of concern for
When is an application security development project complete?
Network Forensics is the prerequisite for any successful legal action after attacks on your Enterprise Network. Which is the single most important factor to introducing digital evidence into a court of law?
Which of the following methodologies references the recommended industry standard that Information security project managers should follow?
A global retail company is creating a new compliance management process. Which of the following standards would be of PRIMARY importance?
What is the BEST approach for managing shared elements from multiple regulations and standards?
The mean time to patch, number of virus outbreaks prevented, and number of vulnerabilities mitigated are examples of what type of performance metrics?
Involvement of senior management is MOST important in the development of:
Access Control lists (ACLs), Firewalls, and Intrusion Prevention Systems are examples of
When dealing with risk, the information security practitioner may choose to:
Scenario: Your corporate systems have been under constant probing and attack from foreign IP addresses for more than a week. Your security team and security infrastructure have performed well under the stress. You are confident that your defenses have held up under the test, but rumors are spreading that sensitive customer data has been stolen and is now being sold on the Internet by criminal elements. During your investigation of the rumored compromise you discover that data has been breached and you have discovered the repository of stolen data on a server located in a foreign country. Your team now has full access to the data on the foreign server.
What action should you take FIRST?
Devising controls for information security is a balance between?
What is the MAIN reason for conflicts between Information Technology and Information Security programs?
What type of test is performed by an auditor when a sample of programs is selected to determine if software source and object versions are the same?
Your incident response plan should include which of the following?
Which of the following is critical for maintaining a successful information security management program?
When managing a project, the MOST important activity in managing the expectations of stakeholders is:
IT control objectives are useful to IT auditors as they provide the basis for understanding the:
Which represents PROPER separation of duties in the corporate environment?
Which of the following is the BEST security control for reducing the threat of phishing attacks?
Creating a secondary authentication process for network access would be an example of?
Why is it vitally important that senior management endorse a security policy?
You have purchased a new insurance policy as part of your risk strategy. Which of the following risk strategy options have you engaged in?
The executive board has requested that the CISO define Key Performance Indicators (KPIs) to measure the effectiveness of the security awareness program. Which information would be MOST useful?
An example of professional unethical behavior is:
A security manager regualrly checks work areas after buisness hours for security violations; such as unsecured files or unattended computers with active sessions. This activity BEST demonstrates what part of a security program?
When working in the Payment Card Industry (PCI), how often should security logs be review to comply with the standards?
Which of the following is an accurate description of a balance sheet?
Which of the following can the company implement in order to avoid this type of security issue in the future?
Which of the following is the MOST effective method to counter phishing attacks?
Control Objectives for Information and Related Technology (COBIT) is which of the following?
What standard would you use to help define key performance indicators (KPIs)?
Which of the following is the MOST effective technology to counter phishing attacks?
Which of the following is a benefit of a risk-based approach to audit planning?
The patching and monitoring of systems on a consistent schedule is required by?
When updating the security strategic planning document what two items must be included?
Risk appetite directly affects what part of a vulnerability management program?
During the course of a risk analysis your IT auditor identified threats and potential impacts. Next, your IT auditor should:
What is the primary reason for performing vendor management?
Which of the following is the MOST effective method to measure the effectiveness of security controls in a perimeter network?
When operating under severe budget constraints a CISO will have to be creative to maintain a strong security organization. Which example below is the MOST creative way to maintain a strong security posture during these difficult times?
The Security Operations Center (SOC) just purchased a new intrusion prevention system (IPS) that needs to be deployed in-line for best defense. The IT group is concerned about putting the new IPS in-line because it might negatively impact network availability. What would be the BEST approach for the CISO to reassure the IT group?
If a CISO wants to understand the liabilities of the company, she will refer to the:
Scenario: As you begin to develop the program for your organization, you assess the corporate culture and determine that there is a pervasive opinion that the security program only slows things down and limits the performance of the “real workers.”
Which group of people should be consulted when developing your security program?
What would be the MOST likely reason a CISO sees abnormally high volumes of security exceptions within a number of business functions?
Which of the following provides enterprise security-based standards and best practices?
How is an Annual Loss Expectancy (ALE) calculated?
Which of the following illustrates an operational control?
The exposure factor of a threat to your organization is defined by?
How often should the SSAE16 report of your vendors be reviewed?
A large number of accounts in a hardened system were suddenly compromised to an external party. Which of
the following is the MOST probable threat actor involved in this incident?
With a focus on the review and approval aspects of board responsibilities, the Data Governance Council recommends that the boards provide strategic oversight regarding information and information security, include these four things:
When a critical vulnerability has been discovered on production systems and needs to be fixed immediately, what is the BEST approach for a CISO to mitigate the vulnerability under tight budget constraints?
Which of the following activities must be completed BEFORE you can calculate risk?
What oversight should the information security team have in the change management process for application security?
What is the primary reason for performing a return on investment analysis?
The ultimate goal of an IT security projects is:
Dataflow diagrams are used by IT auditors to:
When performing a forensic investigation, what are the two MOST common sources for obtaining computer evidence?
What standard provides a framework for information security risk management within organizations?
Scenario: You are the CISO and have just completed your first risk assessment for your organization. You find many risks with no security controls, and some risks with inadequate controls. You assign work to your staff to create or adjust existing security controls to ensure they are adequate for risk mitigation needs.
You have identified potential solutions for all of your risks that do not have security controls. What is the NEXT step?
Which of the following best describes the sensors designed to project and detect a light beam across an area?
Effective information security management programs require the active involvement of_________
What is the FIRST step in developing the vulnerability management program?
When performing a forensic investigation, what are the two MOST common data sources for obtaining evidence from a computer and mobile devices?
Which of the following is a critical operational component of an Incident Response Program (IRP)?
The process to evaluate the technical and non-technical security controls of an IT system to validate that a given design and implementation meet a specific set of security requirements is called
Who is responsible for securing networks during a security incident?
To have accurate and effective information security policies how often should the CISO review the organization policies?
Which of the following compliance standards is the MOST common among retail businesses?
The new CISO was informed of all the Information Security projects that the organization has in progress. Two projects are over a year behind schedule and over budget. Using best business practices for project management you determine that the project correctly aligns with the company goals.
Which of the following needs to be performed NEXT?
During a cyber incident, which non-security personnel might be needed to assist the security team?
Scenario: Your organization employs single sign-on (user name and password only) as a convenience to your employees to access organizational systems and data. Permission to individual systems and databases is vetted and approved through supervisors and data owners to ensure that only approved personnel can use particular applications or retrieve information. All employees have access to their own human resource information, including the ability to change their bank routing and account information and other personal details through the Employee Self-Service application. All employees have access to the organizational VPN.
Once supervisors and data owners have approved requests, information system administrators will implement
Knowing the potential financial loss an organization is willing to suffer if a system fails is a determination of which of the following?
Many times a CISO may have to speak to the Board of Directors (BOD) about their cyber security posture. What would be the BEST choice of security metrics to present to the BOD?
Which security technologies are critical for a zero trust model?
In what phase of an incident management process will malware antivirus signatures be distributed to infrastructure?
Which of the following is an accurate statement regarding capital expenses?
When evaluating a Managed Security Services Provider (MSSP), which service(s) is/are most important:
A Security Operations Center (SOC) manager is informed that a database containing highly sensitive corporate strategy information is under attack. Information has been stolen, and the database server was disconnected. Who must be informed of this incident?
Your IT auditor is reviewing significant events from the previous year and has identified some procedural oversights. Which of the following would be the MOST concerning?
Which of the following is true regarding expenditures?
During an audit, what should the auditor do after identifying threats and potential impact?
Which of the following would be the MOST concerning security audit finding?
An organization has a stated requirement to block certain traffic on networks. The implementation of controls will disrupt a manufacturing process and cause unacceptable delays, resulting in sever revenue disruptions. Which of the following is MOST likely to be responsible for accepting the risk until mitigating controls can be implemented?
SCENARIO: A CISO has several two-factor authentication systems under review and selects the one that is most sufficient and least costly. The implementation project planning is completed and the teams are ready to implement the solution. The CISO then discovers that the product it is not as scalable as originally thought and will not fit the organization’s needs.
What is the MOST logical course of action the CISO should take?
From the CISO’s perspective in looking at financial statements, the statement of retained earnings of an organization:
What is the BEST way to achieve on-going compliance monitoring in an organization?
Due to staff shortages during off-hours, the Security Operations Center (SOC) manager is considering outsourcing off-hour coverage. What type of SOC is being considered?
What does a security control objective provide for auditors?
Which of the following is the BEST reason for having a formal Request for Proposal (RFP) process?
A method to transfer risk is to:
An audit was conducted and many critical applications were found to have no disaster recovery plans in place. You conduct a Business Impact Analysis (BIA) to determine impact to the company for each application. What should be the NEXT step?
What can you do to assist with law enforcement investigations if someone on your guest wireless network is suspected of committing an illegal act using your network?
What is the purpose of a purple security testing team?
Which of the following is a PRIMARY task of a risk management function within the security program?
Which of the following conditions would be the MOST probable reason for a security project to be rejected by the executive board of an organization?
What should an auditor do after discovering that a security analyst is working a late-night shift every week as the senior server administrator?
When gathering security requirements for an enterprise software solution, which of the following is MOST important?
Which of the following is considered to be an IT governance framework and a supporting toolset that allows for managers to bridge the gap between control requirements, technical issues, and business risks?
Which International Organization for Standardization (ISO) below BEST describes the performance of risk management, and includes a five-stage risk management methodology.
An application vulnerability assessment has identified a security flaw in an application. This is a flaw that was previously identified and remediated on a prior release of the application. Which of the following is MOST likely the reason for this recurring issue?
The regular review of a firewall ruleset is considered a
Scenario: Your program is developed around minimizing risk to information by focusing on people, technology, and operations.
An effective way to evaluate the effectiveness of an information security awareness program for end users, especially senior executives, is to conduct periodic:
A system is designed to dynamically block offending Internet IP-addresses from requesting services from a secure website. This type of control is considered
Which wireless encryption technology makes use of temporal keys?
The single most important consideration to make when developing your security program, policies, and processes is:
To reduce the threat of spear phishing, which of the following is the MOST critical security control to implement?
Acme Inc. has engaged a third party vendor to provide 99.999% up-time for their online web presence and had them contractually agree to this service level agreement. What type of risk tolerance is Acme exhibiting? (choose the BEST answer):
Which of the following is considered a project versus a managed process?
The Board of Directors of a publicly-traded company is concerned about the security implications of a strategic project that will migrate 50% of the organization’s information technology assets to the cloud. They have requested a briefing on the project plan and a progress report of the security stream of the project. As the CISO, you have been tasked with preparing the report for the Chief Executive Officer to present.
Using the Earned Value Management (EVM), what does a Cost Variance (CV) of -1,200 mean?
Which of the following is a fundamental component of an audit record?
Which of the following is the MOST effective method for discovering common technical vulnerabilities within the
IT environment?
As the Risk Manager of an organization, you are task with managing vendor risk assessments. During the assessment, you identified that the vendor is engaged with high profiled clients, and bad publicity can jeopardize your own brand.
Which is the BEST type of risk that defines this event?
A newly appointed security officer finds data leakage software licenses that had never been used. The officer decides to implement a project to ensure it gets installed, but the project gets a great deal of resistance across the organization. Which of the following represents the MOST likely reason for this situation?
What are the primary reasons for the development of a business case for a security project?
A severe security threat has been detected on your corporate network. As CISO you quickly assemble key members of the Information Technology team and business operations to determine a modification to security controls in response to the threat. This is an example of:
Credit card information, medical data, and government records are all examples of:
Which of the following tests is an IS auditor performing when a sample of programs is selected to determine if the source and object versions are the same?
Your penetration testing team installs an in-line hardware key logger onto one of your network machines. Which of the following is of major concern to the security organization?
Copyright © 2021-2026 CertsTopics. All Rights Reserved
