A CISO decides to analyze the IT infrastructure to ensure security solutions adhere to organizational implementation and management requirements. Which of the following principles does this BEST demonstrate?
A Security Operations (SecOps) Manager is considering implementing threat hunting to be able to make better decisions on protecting information and assets.
What is the MAIN goal of threat hunting to the SecOps Manager?
You have been hired as the Information System Security Officer (ISSO) for a US federal government agency. Your role is to ensure the security posture of the system is maintained. One of your tasks is to develop and maintain the system security plan (SSP) and supporting documentation.
Which of the following is NOT documented in the SSP?
An auditor is reviewing the security classifications for a group of assets and finds that many of the assets are not correctly classified.
What should the auditor’s NEXT step be?
You have been promoted to the CISO of a retail store. Which of the following compliance standards is the MOST important to the organization?
What is the purpose of the statement of retained earnings of an organization?
An organization has decided to develop an in-house BCM capability. The organization has determined it is best to follow a BCM standard published by the International Organization for Standardization (ISO).
The BEST ISO standard to follow that outlines the complete lifecycle of BCM is?
What is the primary difference between regulations and standards?
A university recently hired a CISO. One of the first tasks is to develop a continuity of operations plan (COOP).
In developing the business impact assessment (BIA), which of the following MOST closely relate to the data backup and restoral?
Which of the following strategies provides the BEST response to a ransomware attack?
XYZ is a publicly-traded software development company.
Who is ultimately accountable to the shareholders in the event of a cybersecurity breach?
Many successful cyber-attacks currently include:
Which of the following is considered the MOST effective tool against social engineering?
An organization recently acquired a Data Loss Prevention (DLP) solution, and two months after the implementation, it was found that sensitive data was posted to numerous Dark Web sites. The DLP application was checked, and there are no apparent malfunctions and no errors.
What is the MOST likely reason why the sensitive data was posted?
Which of the following is the MOST important to share with an Information Security Steering Committee:
When reviewing a Solution as a Service (SaaS) provider’s security health and posture, which key document should you review?
The alerting, monitoring, and lifecycle management of security-related events are typically managed by the:
A cloud computing environment that is bound together by technology that allows data and applications to be shared between public and private clouds is BEST referred to as a?
When evaluating a Managed Security Services Provider (MSSP), which service(s) is/are most important:
Which of the following provides the BEST approach to achieving positive outcomes while preserving savings?
What are the common data hiding techniques used by criminals?
Who is responsible for verifying that audit directives are implemented?
Which of the following BEST mitigates ransomware threats?
The general ledger setup function in an enterprise resource package allows for setting accounting periods. Access to this function has been permitted to users in finance, the shipping department, and production scheduling. What is the most likely reason for such broad access?
Network Forensics is the prerequisite for any successful legal action after attacks on your Enterprise Network. Which is the single most important factor to introducing digital evidence into a court of law?
The process of identifying and classifying assets is typically included in the
The process of creating a system which divides documents based on their security level to manage access to private data is known as
While designing a secondary data center for your company what document needs to be analyzed to determine to how much should be spent on building the data center?
What is the FIRST step in developing the vulnerability management program?
An access point (AP) is discovered using Wireless Equivalent Protocol (WEP). The ciphertext sent by the AP is encrypted with the same key and cipher used by its stations. What authentication method is being used?
A customer of a bank has placed a dispute on a payment for a credit card account. The banking system uses digital signatures to safeguard the integrity of their transactions. The bank claims that the system shows proof that the customer in fact made the payment. What is this system capability commonly known as?
Which of the following backup sites takes the longest recovery time?
Your incident handling manager detects a virus attack in the network of your company. You develop a signature based on the characteristics of the detected virus. Which of the following phases in the incident handling process will utilize the signature to resolve this incident?
Which of the following statements about Encapsulating Security Payload (ESP) is true?
Which of the following is MOST important when tuning an Intrusion Detection System (IDS)?
In terms of supporting a forensic investigation, it is now imperative that managers, first-responders, etc., accomplish the following actions to the computer under investigation:
Which of the following is a countermeasure to prevent unauthorized database access from web applications?
An anonymity network is a series of?
Security related breaches are assessed and contained through which of the following?
Which wireless encryption technology makes use of temporal keys?
Which of the following is the MAIN security concern for public cloud computing?
Which of the following is a symmetric encryption algorithm?
You are having a penetration test done on your company network and the leader of the team says they discovered all the network devices because no one had changed the Simple Network Management Protocol (SNMP) community strings from the defaults. Which of the following is a default community string?
Your organization provides open guest wireless access with no captive portals. What can you do to assist with law enforcement investigations if one of your guests is suspected of committing an illegal act using your network?
The process for identifying, collecting, and producing digital information in support of legal proceedings is called
One of your executives needs to send an important and confidential email. You want to ensure that the message cannot be read by anyone but the recipient. Which of the following keys should be used to encrypt the message?
A large number of accounts in a hardened system were suddenly compromised to an external party. Which of
the following is the MOST probable threat actor involved in this incident?
What is meant by password aging?
A digital signature addresses which of the following concerns?
A consultant is hired to do physical penetration testing at a large financial company. In the first day of his
assessment, the consultant goes to the company’s building dressed like an electrician and waits in the lobby for
an employee to pass through the main access gate, then the consultant follows the employee behind to get into
the restricted area. Which type of attack did the consultant perform?
When analyzing and forecasting a capital expense budget what are not included?
A newly-hired CISO needs to understand the organization’s financial management standards for business units
and operations. Which of the following would be the best source of this information?
Which of the following is used to lure attackers into false environments so they can be monitored, contained, or blocked from reaching critical systems?
Scenario: Your corporate systems have been under constant probing and attack from foreign IP addresses for more than a week. Your security team and security infrastructure have performed well under the stress. You are confident that your defenses have held up under the test, but rumors are spreading that sensitive customer data has been stolen and is now being sold on the Internet by criminal elements. During your investigation of the rumored compromise you discover that data has been breached and you have discovered the repository of stolen data on a server located in a foreign country. Your team now has full access to the data on the foreign server.
Your defenses did not hold up to the test as originally thought. As you investigate how the data was compromised through log analysis you discover that a hardworking, but misguided business intelligence analyst posted the data to an obfuscated URL on a popular cloud storage service so they could work on it from home during their off-time. Which technology or solution could you deploy to prevent employees from removing corporate data from your network? Choose the BEST answer.
You are just hired as the new CISO and are being briefed on all the Information Security projects that your section has on going. You discover that most projects are behind schedule and over budget.
Using the best business practices for project management you determine that the project correctly aligns with the company goals and the scope of the project is correct. What is the NEXT step?
Bob waits near a secured door, holding a box. He waits until an employee walks up to the secured door and
uses the special card in order to access the restricted area of the target company. Just as the employee opens
the door, Bob walks up to the employee (still holding the box) and asks the employee to hold the door open so
that he can enter. What is the best way to undermine the social engineering activity of tailgating?
What is the primary reason for performing vendor management?
Scenario: Most industries require compliance with multiple government regulations and/or industry standards to meet data protection and privacy mandates.
When multiple regulations or standards apply to your industry you should set controls to meet the:
Which of the following best describes revenue?
Scenario: You are the newly hired Chief Information Security Officer for a company that has not previously had a senior level security practitioner. The company lacks a defined security policy and framework for their Information Security Program. Your new boss, the Chief Financial Officer, has asked you to draft an outline of a security policy and recommend an industry/sector neutral information security control framework for implementation.
Which of the following industry / sector neutral information security control frameworks should you recommend for implementation?
Which of the following is the MOST logical method of deploying security controls within an organization?
Scenario: You are the CISO and have just completed your first risk assessment for your organization. You find many risks with no security controls, and some risks with inadequate controls. You assign work to your staff to create or adjust existing security controls to ensure they are adequate for risk mitigation needs.
When adjusting the controls to mitigate the risks, how often should the CISO perform an audit to verify the controls?
Which of the following is the MOST important reason for performing assessments of the security portfolio?
Scenario: You are the CISO and have just completed your first risk assessment for your organization. You find many risks with no security controls, and some risks with inadequate controls. You assign work to your staff to create or adjust existing security controls to ensure they are adequate for risk mitigation needs.
When formulating the remediation plan, what is a required input?
What is the difference between encryption and tokenization?
The ability to demand the implementation and management of security controls on third parties providing services to an organization is
Scenario: You are the newly hired Chief Information Security Officer for a company that has not previously had a senior level security practitioner. The company lacks a defined security policy and framework for their Information Security Program. Your new boss, the Chief Financial Officer, has asked you to draft an outline of a security policy and recommend an industry/sector neutral information security control framework for implementation.
Your Corporate Information Security Policy should include which of the following?
Scenario: An organization has made a decision to address Information Security formally and consistently by adopting established best practices and industry standards. The organization is a small retail merchant but it is expected to grow to a global customer base of many millions of customers in just a few years.
This global retail company is expected to accept credit card payments. Which of the following is of MOST concern when defining a security program for this organization?
Which of the following is considered the foundation for the Enterprise Information Security Architecture (EISA)?
When entering into a third party vendor agreement for security services, at what point in the process is it BEST to understand and validate the security posture and compliance level of the vendor?
You manage a newly created Security Operations Center (SOC), your team is being inundated with security alerts and don’t know what to do. What is the BEST approach to handle this situation?
Which of the following represents the BEST method for obtaining business unit acceptance of security controls within an organization?
The organization does not have the time to remediate the vulnerability; however it is critical to release the application. Which of the following needs to be further evaluated to help mitigate the risks?
Risk appetite is typically determined by which of the following organizational functions?
Information Security is often considered an excessive, after-the-fact cost when a project or initiative is completed. What can be done to ensure that security is addressed cost effectively?
Which of the following best summarizes the primary goal of a security program?
A recommended method to document the respective roles of groups and individuals for a given process is to:
You are the CISO of a commercial social media organization. The leadership wants to rapidly create new methods of sharing customer data through creative linkages with mobile devices. You have voiced concern about privacy regulations but the velocity of the business is given priority. Which of the following BEST describes this organization?
To get an Information Security project back on schedule, which of the following will provide the MOST help?
Which of the following is critical in creating a security program aligned with an organization’s goals?
When operating under severe budget constraints a CISO will have to be creative to maintain a strong security organization. Which example below is the MOST creative way to maintain a strong security posture during these difficult times?
As the CISO for your company you are accountable for the protection of information resources commensurate with:
How often should the SSAE16 report of your vendors be reviewed?
When should IT security project management be outsourced?
Which of the following functions evaluates risk present in IT initiatives and/or systems when implementing an information security program?
The company decides to release the application without remediating the high-risk vulnerabilities. Which of the following is the MOST likely reason for the company to release the application?
Which of the following is a major benefit of applying risk levels?
In effort to save your company money which of the following methods of training results in the lowest cost for the organization?
A department within your company has proposed a third party vendor solution to address an urgent, critical business need. As the CISO you have been asked to accelerate screening of their security control claims. Which of the following vendor provided documents is BEST to make your decision:
Your company has a “no right to privacy” notice on all logon screens for your information systems and users sign an Acceptable Use Policy informing them of this condition. A peer group member and friend comes to you and requests access to one of her employee’s email account. What should you do? (choose the BEST answer):
A CISO has recently joined an organization with a poorly implemented security program. The desire is to base the security program on a risk management approach. Which of the following is a foundational requirement in order to initiate this type of program?
Which of the following are not stakeholders of IT security projects?
Which of the following is the MOST effective way to measure the effectiveness of security controls on a perimeter network?
The BEST organization to provide a comprehensive, independent and certifiable perspective on established security controls in an environment is
The executive board has requested that the CISO of an organization define and Key Performance Indicators (KPI) to measure the effectiveness of the security awareness program provided to call center employees. Which of the following can be used as a KPI?
Creating a secondary authentication process for network access would be an example of?
Which of the following illustrates an operational control process:
With respect to the audit management process, management response serves what function?
At which point should the identity access management team be notified of the termination of an employee?
The effectiveness of an audit is measured by?
When a CISO considers delaying or not remediating system vulnerabilities which of the following are MOST important to take into account?
When working in the Payment Card Industry (PCI), how often should security logs be review to comply with the standards?
You work as a project manager for TYU project. You are planning for risk mitigation. You need to quickly identify high-level risks that will need a more in-depth analysis. Which of the following activities will help you in this?
Which of the following is the PRIMARY purpose of International Organization for Standardization (ISO) 27001?
The regular review of a firewall ruleset is considered a
Which of the following set of processes is considered to be one of the cornerstone cycles of the International Organization for Standardization (ISO) 27001 standard?
How often should an environment be monitored for cyber threats, risks, and exposures?
Which of the following is a fundamental component of an audit record?
The remediation of a specific audit finding is deemed too expensive and will not be implemented. Which of the following is a TRUE statement?
The patching and monitoring of systems on a consistent schedule is required by?
You are the Chief Information Security Officer of a large, multinational bank and you suspect there is a flaw in a two factor authentication token management process. Which of the following represents your BEST course of action?
Which of the following activities results in change requests?
As a new CISO at a large healthcare company you are told that everyone has to badge in to get in the building. Below your office window you notice a door that is normally propped open during the day for groups of people to take breaks outside. Upon looking closer you see there is no badge reader. What should you do?
Which of the following is the MOST important reason to measure the effectiveness of an Information Security Management System (ISMS)?
The CIO of an organization has decided to assign the responsibility of internal IT audit to the IT team. This is consider a bad practice MAINLY because
Which of the following provides an audit framework?
Which of the following is the MOST important for a CISO to understand when identifying threats?
When managing an Information Security Program, which of the following is of MOST importance in order to influence the culture of an organization?
When briefing senior management on the creation of a governance process, the MOST important aspect should be:
Quantitative Risk Assessments have the following advantages over qualitative risk assessments:
Which of the following has the GREATEST impact on the implementation of an information security governance model?
Developing effective security controls is a balance between:
When deploying an Intrusion Prevention System (IPS) the BEST way to get maximum protection from the system is to deploy it
Which of the following functions MUST your Information Security Governance program include for formal organizational reporting?
Who is responsible for securing networks during a security incident?
An organization’s firewall technology needs replaced. A specific technology has been selected that is less costly than others and lacking in some important capabilities. The security officer has voiced concerns about sensitive data breaches but the decision is made to purchase. What does this selection indicate?
The PRIMARY objective of security awareness is to:
In which of the following cases, would an organization be more prone to risk acceptance vs. risk mitigation?
Which of the following are the MOST important factors for proactively determining system vulnerabilities?
The Information Security Management program MUST protect:
What is the main purpose of the Incident Response Team?
One of the MAIN goals of a Business Continuity Plan is to
What is the relationship between information protection and regulatory compliance?
The establishment of a formal risk management framework and system authorization program is essential. The LAST step of the system authorization process is:
A security manager regualrly checks work areas after buisness hours for security violations; such as unsecured files or unattended computers with active sessions. This activity BEST demonstrates what part of a security program?
When dealing with a risk management process, asset classification is important because it will impact the overall:
Which of the following is of MOST importance when security leaders of an organization are required to align security to influence the culture of an organization?
What is the first thing that needs to be completed in order to create a security program for your organization?