The ability to hold intruders accountable in a court of law is important. Which of the following activities are needed to ensure the highest possibility for successful prosecution?
Physical security measures typically include which of the following components?
Network Forensics is the prerequisite for any successful legal action after attacks on your Enterprise Network. Which is the single most important factor to introducing digital evidence into a court of law?
An access point (AP) is discovered using Wireless Equivalent Protocol (WEP). The ciphertext sent by the AP is encrypted with the same key and cipher used by its stations. What authentication method is being used?
In terms of supporting a forensic investigation, it is now imperative that managers, first-responders, etc., accomplish the following actions to the computer under investigation:
Which wireless encryption technology makes use of temporal keys?
What type of attack requires the least amount of technical equipment and has the highest success rate?
What is the FIRST step in developing the vulnerability management program?
The process for identifying, collecting, and producing digital information in support of legal proceedings is called
While designing a secondary data center for your company what document needs to be analyzed to determine to how much should be spent on building the data center?
As a CISO you need to understand the steps that are used to perform an attack against a network. Put each step into the correct order.
1.Covering tracks
2.Scanning and enumeration
3.Maintaining Access
4.Reconnaissance
5.Gaining Access
Which of the following is a symmetric encryption algorithm?
Your penetration testing team installs an in-line hardware key logger onto one of your network machines. Which of the following is of major concern to the security organization?
The general ledger setup function in an enterprise resource package allows for setting accounting periods. Access to this function has been permitted to users in finance, the shipping department, and production scheduling. What is the most likely reason for such broad access?
Your incident handling manager detects a virus attack in the network of your company. You develop a signature based on the characteristics of the detected virus. Which of the following phases in the incident handling process will utilize the signature to resolve this incident?
The process of identifying and classifying assets is typically included in the
Which of the following is the MAIN security concern for public cloud computing?
Which of the following is MOST important when tuning an Intrusion Detection System (IDS)?
A customer of a bank has placed a dispute on a payment for a credit card account. The banking system uses digital signatures to safeguard the integrity of their transactions. The bank claims that the system shows proof that the customer in fact made the payment. What is this system capability commonly known as?
The process of creating a system which divides documents based on their security level to manage access to private data is known as
Security related breaches are assessed and contained through which of the following?
Your organization provides open guest wireless access with no captive portals. What can you do to assist with law enforcement investigations if one of your guests is suspected of committing an illegal act using your network?
An anonymity network is a series of?
Which of the following backup sites takes the longest recovery time?
SQL injection is a very popular and successful injection attack method. Identify the basic SQL injection text:
You are having a penetration test done on your company network and the leader of the team says they discovered all the network devices because no one had changed the Simple Network Management Protocol (SNMP) community strings from the defaults. Which of the following is a default community string?
One of your executives needs to send an important and confidential email. You want to ensure that the message cannot be read by anyone but the recipient. Which of the following keys should be used to encrypt the message?
Which of the following statements about Encapsulating Security Payload (ESP) is true?
When reviewing a Solution as a Service (SaaS) provider’s security health and posture, which key document should you review?
A bastion host should be placed:
Who is responsible for verifying that audit directives are implemented?
With a focus on the review and approval aspects of board responsibilities, the Data Governance Council recommends that the boards provide strategic oversight regarding information and information security, include these four things:
ABC Limited has recently suffered a security breach with customers’ social security number available on the dark web for sale. The CISO, during the time of the incident, has been fired, and you have been hired as the replacement. The analysis of the breach found that the absence of an insider threat program, lack of least privilege policy, and weak access control was to blame. You would like to implement key performance indicators to mitigate the risk.
Which metric would meet the requirement?
When obtaining new products and services, why is it essential to collaborate with lawyers, IT security professionals, privacy professionals, security engineers, suppliers, and others?
The main purpose of the SOC is:
Many successful cyber-attacks currently include:
A university recently hired a CISO. One of the first tasks is to develop a continuity of operations plan (COOP).
In developing the business impact assessment (BIA), which of the following MOST closely relate to the data backup and restoral?
XYZ is a publicly-traded software development company.
Who is ultimately accountable to the shareholders in the event of a cybersecurity breach?
As the Risk Manager of an organization, you are task with managing vendor risk assessments. During the assessment, you identified that the vendor is engaged with high profiled clients, and bad publicity can jeopardize your own brand.
Which is the BEST type of risk that defines this event?
When information security falls under the Chief Information Officer (CIO), what is their MOST essential role?
In defining a strategic security plan for an organization, what should a CISO first analyze?
What is the THIRD state of the Tuckman Stages of Group Development?
From the CISO’s perspective in looking at financial statements, the statement of retained earnings of an organization:
When managing a project, the MOST important activity in managing the expectations of stakeholders is:
Which level of data destruction applies logical techniques to sanitize data in all user-addressable storage locations?
What is a Statement of Objectives (SOA)?
The alerting, monitoring, and lifecycle management of security-related events are typically managed by the:
What key technology can mitigate ransomware threats?
Which of the following is the MOST important to share with an Information Security Steering Committee:
Which of the following is the MOST effective method to counter phishing attacks?
What is the purpose of the statement of retained earnings of an organization?
Which of the following provides the BEST approach to achieving positive outcomes while preserving savings?
Of the following types of SOCs (Security Operations Centers), which one would be MOST likely used if the CISO has decided to outsource the infrastructure and administration of it?
A CISO must conduct risk assessments using a method where the Chief Financial Officer (CFO) receives impact data in financial terms to use as input to select the proper level of coverage in a new cybersecurity insurance policy.
What is the MOST effective method of risk analysis to provide the CFO with the information required?
Which of the following are the triple constraints of project management?
When evaluating a Managed Security Services Provider (MSSP), which service(s) is/are most important:
Scenario: An organization has made a decision to address Information Security formally and consistently by adopting established best practices and industry standards. The organization is a small retail merchant but it is expected to grow to a global customer base of many millions of customers in just a few years.
This global retail company is expected to accept credit card payments. Which of the following is of MOST concern when defining a security program for this organization?
What are the three hierarchically related aspects of strategic planning and in which order should they be done?
Access Control lists (ACLs), Firewalls, and Intrusion Prevention Systems are examples of
When project costs continually increase throughout implementation due to large or rapid changes in customer
or user requirements, this is commonly known as:
Scenario: You are the CISO and have just completed your first risk assessment for your organization. You find many risks with no security controls, and some risks with inadequate controls. You assign work to your staff to create or adjust existing security controls to ensure they are adequate for risk mitigation needs.
You have identified potential solutions for all of your risks that do not have security controls. What is the NEXT step?
A CISO decides to analyze the IT infrastructure to ensure security solutions adhere to the concepts of how
hardware and software is implemented and managed within the organization. Which of the following principles
does this best demonstrate?
Scenario: The new CISO was informed of all the Information Security projects that the section has in progress. Two projects are over a year behind schedule and way over budget.
Which of the following will be most helpful for getting an Information Security project that is behind schedule back on schedule?
Scenario: You are the CISO and are required to brief the C-level executive team on your information security audit for the year. During your review of the audit findings you discover that many of the controls that were put in place the previous year to correct some of the findings are not performing as needed. You have thirty days until the briefing.
To formulate a remediation plan for the non-performing controls what other document do you need to review before adjusting the controls?
Scenario: Your company has many encrypted telecommunications links for their world-wide operations. Physically distributing symmetric keys to all locations has proven to be administratively burdensome, but symmetric keys are preferred to other alternatives.
How can you reduce the administrative burden of distributing symmetric keys for your employer?
Which of the following defines the boundaries and scope of a risk assessment?
What is the primary reason for performing vendor management?
When creating contractual agreements and procurement processes why should security requirements be included?
What are the primary reasons for the development of a business case for a security project?
An organization has a number of Local Area Networks (LANs) linked to form a single Wide Area Network
(WAN). Which of the following would BEST ensure network continuity?
SCENARIO: A Chief Information Security Officer (CISO) recently had a third party conduct an audit of the security program. Internal policies and international standards were used as audit baselines. The audit report was presented to the CISO and a variety of high, medium and low rated gaps were identified.
The CISO has implemented remediation activities. Which of the following is the MOST logical next step?
Scenario: An organization has made a decision to address Information Security formally and consistently by adopting established best practices and industry standards. The organization is a small retail merchant but it is expected to grow to a global customer base of many millions of customers in just a few years.
Which of the following frameworks and standards will BEST fit the organization as a baseline for their security program?
Which of the following is the MOST effective method for discovering common technical vulnerabilities within the
IT environment?
Which of the following provides an independent assessment of a vendor’s internal security controls and overall posture?
A system is designed to dynamically block offending Internet IP-addresses from requesting services from a secure website. This type of control is considered
Involvement of senior management is MOST important in the development of:
Which of the following best describes the sensors designed to project and detect a light beam across an area?
Scenario: Your company has many encrypted telecommunications links for their world-wide operations. Physically distributing symmetric keys to all locations has proven to be administratively burdensome, but symmetric keys are preferred to other alternatives.
Symmetric encryption in general is preferable to asymmetric encryption when:
Which of the following is the MOST important reason for performing assessments of the security portfolio?
Scenario: You are the CISO and have just completed your first risk assessment for your organization. You find many risks with no security controls, and some risks with inadequate controls. You assign work to your staff to create or adjust existing security controls to ensure they are adequate for risk mitigation needs.
When adjusting the controls to mitigate the risks, how often should the CISO perform an audit to verify the controls?
A large number of accounts in a hardened system were suddenly compromised to an external party. Which of
the following is the MOST probable threat actor involved in this incident?
Which of the following is a common technology for visual monitoring?
Scenario: Your organization employs single sign-on (user name and password only) as a convenience to your employees to access organizational systems and data. Permission to individual systems and databases is vetted and approved through supervisors and data owners to ensure that only approved personnel can use particular applications or retrieve information. All employees have access to their own human resource information, including the ability to change their bank routing and account information and other personal details through the Employee Self-Service application. All employees have access to the organizational VPN.
Recently, members of your organization have been targeted through a number of sophisticated phishing attempts and have compromised their system credentials. What action can you take to prevent the misuse of compromised credentials to change bank account information from outside your organization while still allowing employees to manage their bank information?
Scenario: You are the newly hired Chief Information Security Officer for a company that has not previously had a senior level security practitioner. The company lacks a defined security policy and framework for their Information Security Program. Your new boss, the Chief Financial Officer, has asked you to draft an outline of a security policy and recommend an industry/sector neutral information security control framework for implementation.
Which of the following industry / sector neutral information security control frameworks should you recommend for implementation?
Which of the following set of processes is considered to be one of the cornerstone cycles of the International Organization for Standardization (ISO) 27001 standard?
A method to transfer risk is to:
An organization licenses and uses personal information for business operations, and a server containing that information has been compromised. What kind of law would require notifying the owner or licensee of this incident?
Which of the following are the MOST important factors for proactively determining system vulnerabilities?
An audit was conducted and many critical applications were found to have no disaster recovery plans in place. You conduct a Business Impact Analysis (BIA) to determine impact to the company for each application. What should be the NEXT step?
You have purchased a new insurance policy as part of your risk strategy. Which of the following risk strategy options have you engaged in?
Dataflow diagrams are used by IT auditors to:
Creating a secondary authentication process for network access would be an example of?
During the course of a risk analysis your IT auditor identified threats and potential impacts. Next, your IT auditor should:
A security professional has been promoted to be the CISO of an organization. The first task is to create a security policy for this organization. The CISO creates and publishes the security policy. This policy however, is ignored and not enforced consistently. Which of the following is the MOST likely reason for the policy shortcomings?
Assigning the role and responsibility of Information Assurance to a dedicated and independent security group is an example of:
Which of the following is a weakness of an asset or group of assets that can be exploited by one or more threats?
Information security policies should be reviewed:
Your IT auditor is reviewing significant events from the previous year and has identified some procedural oversights. Which of the following would be the MOST concerning?
After a risk assessment is performed, a particular risk is considered to have the potential of costing the organization 1.2 Million USD. This is an example of
Which of the following is a critical operational component of an Incident Response Program (IRP)?
As a new CISO at a large healthcare company you are told that everyone has to badge in to get in the building. Below your office window you notice a door that is normally propped open during the day for groups of people to take breaks outside. Upon looking closer you see there is no badge reader. What should you do?
An organization has implemented a change management process for all changes to the IT production environment. This change management process follows best practices and is expected to help stabilize the availability and integrity of the organization’s IT environment. Which of the following can be used to measure the effectiveness of this newly implemented process:
Which of the following is used to establish and maintain a framework to provide assurance that information security strategies are aligned with organizational objectives?
What is the relationship between information protection and regulatory compliance?
The CIO of an organization has decided to assign the responsibility of internal IT audit to the IT team. This is consider a bad practice MAINLY because
An IT auditor has recently discovered that because of a shortage of skilled operations personnel, the security administrator has agreed to work one late night shift a week as the senior computer operator. The most appropriate course of action for the IT auditor is to:
Which of the following intellectual Property components is focused on maintaining brand recognition?
A business unit within your organization intends to deploy a new technology in a manner that places it in violation of existing information security standards. What immediate action should the information security manager take?
Why is it vitally important that senior management endorse a security policy?
Which of the following is the MAIN reason to follow a formal risk management process in an organization that hosts and uses privately identifiable information (PII) as part of their business models and processes?
The amount of risk an organization is willing to accept in pursuit of its mission is known as
Which of the following is considered to be an IT governance framework and a supporting toolset that allows for managers to bridge the gap between control requirements, technical issues, and business risks?
Acme Inc. has engaged a third party vendor to provide 99.999% up-time for their online web presence and had them contractually agree to this service level agreement. What type of risk tolerance is Acme exhibiting? (choose the BEST answer):
Which of the following information may be found in table top exercises for incident response?
A stakeholder is a person or group:
What oversight should the information security team have in the change management process for application security?
A CISO decides to analyze the IT infrastructure to ensure security solutions adhere to the concepts of how hardware and software is implemented and managed within the organization. Which of the following principles does this best demonstrate?
How often should the Statements of Standards for Attestation Engagements-16 (SSAE16)/International Standard on Assurance Engagements 3402 (ISAE3402) report of your vendors be reviewed?
The company decides to release the application without remediating the high-risk vulnerabilities. Which of the following is the MOST likely reason for the company to release the application?
Which of the following represents the BEST method of ensuring security program alignment to business needs?
Which of the following methodologies references the recommended industry standard that Information security project managers should follow?
Your incident response plan should include which of the following?
As the CISO for your company you are accountable for the protection of information resources commensurate with:
Which of the following is MOST beneficial in determining an appropriate balance between uncontrolled innovation and excessive caution in an organization?
Which of the following best summarizes the primary goal of a security program?
Which of the following functions implements and oversees the use of controls to reduce risk when creating an information security program?
An international organization is planning a project to implement encryption technologies to protect company confidential information. This organization has data centers on three continents. Which of the following would be considered a MAJOR constraint for the project?
When considering using a vendor to help support your security devices remotely, what is the BEST choice for allowing access?
The Security Operations Center (SOC) just purchased a new intrusion prevention system (IPS) that needs to be deployed in-line for best defense. The IT group is concerned about putting the new IPS in-line because it might negatively impact network availability. What would be the BEST approach for the CISO to reassure the IT group?
When entering into a third party vendor agreement for security services, at what point in the process is it BEST to understand and validate the security posture and compliance level of the vendor?
When should IT security project management be outsourced?
Which of the following is the MOST important component of any change management process?
In effort to save your company money which of the following methods of training results in the lowest cost for the organization?
A recommended method to document the respective roles of groups and individuals for a given process is to:
In order for a CISO to have true situational awareness there is a need to deploy technology that can give a real-time view of security events across the enterprise. Which tool selection represents the BEST choice to achieve situational awareness?
A newly appointed security officer finds data leakage software licenses that had never been used. The officer decides to implement a project to ensure it gets installed, but the project gets a great deal of resistance across the organization. Which of the following represents the MOST likely reason for this situation?
An example of professional unethical behavior is:
An application vulnerability assessment has identified a security flaw in an application. This is a flaw that was previously identified and remediated on a prior release of the application. Which of the following is MOST likely the reason for this recurring issue?