Which of the following should be determined while defining risk management strategies?
In order to improve situational awareness, there is a need to deploy technology that can give a real-time view of security events across the enterprise. Which of the following tools represents the BEST choice to achieve this awareness?
You assess the corporate culture and determine there is a pervasive opinion that the security program limits business performance. What is the MOST effective approach to reshape corporate culture to adopt security as a norm?
An employee successfully avoids becoming a victim of a sophisticated spear phishing attack due to knowledge gained through the corporate information security awareness program. What type of control has been effectively utilized?
What type of attack requires the least amount of technical equipment and has the highest success rate?
Which of the following intellectual Property components is focused on maintaining brand recognition?
Which of the following metrics would be MOST effective for measuring the effectiveness of a newly implemented change control process?
A global health insurance company is concerned about protecting confidential information. Which of the following is of MOST concern to this organization?
Scenario: An organization has made a decision to address Information Security formally and consistently by adopting established best practices and industry standards. The organization is a small retail merchant but it is expected to grow to a global customer base of many millions of customers in just a few years.
This global retail company is expected to accept credit card payments. Which of the following is of MOST concern when defining a security program for this organization?
Using the Transport Layer Security (TLS) protocol enables a client in a network to be:
Which level of data destruction applies logical techniques to sanitize data in all user-addressable storage locations?
Scenario: Your company has many encrypted telecommunications links for their world-wide operations. Physically distributing symmetric keys to all locations has proven to be administratively burdensome, but symmetric keys are preferred to other alternatives.
How can you reduce the administrative burden of distributing symmetric keys for your employer?
Which of the following are primary concerns for management with regard to assessing internal control objectives?
Which International Organization for Standardization (ISO) below BEST describes the performance of risk management, and includes a five-stage risk management methodology.
What is the PRIMARY weakness of a Cost Benefit Analysis (CBA)?
To have accurate and effective information security policies how often should the CISO review the organization policies?
What process is used to identify and collect information to support legal requests?
What are the three PRIMARY constraints of project management?
As the CISO, you have been tasked with the execution of the company’s key management program. You
MUST ensure the integrity of encryption keys at the point of generation. Which principal of encryption key
control will ensure no single individual can constitute or re-constitute a key?
Which of the following is MOST beneficial in determining an appropriate balance between uncontrolled innovation and excessive caution in an organization?
Why is it vitally important that senior management endorse a security policy?
The new CISO was informed of all the Information Security projects that the organization has in progress. Two projects are over a year behind schedule and over budget. Using best business practices for project management you determine that the project correctly aligns with the company goals.
Which of the following needs to be performed NEXT?
Which of the following is considered the foundation for the Enterprise Information Security Architecture (EISA)?
When operating under severe budget constraints a CISO will have to be creative to maintain a strong security organization. Which example below is the MOST creative way to maintain a strong security posture during these difficult times?
As the Chief Information Security Officer, you want to ensure data shared securely, especially when shared with
third parties outside the organization. What protocol provides the ability to extend the network perimeter with
the use of encapsulation and encryption?
What standard would you use to help define key performance indicators (KPIs)?
Acceptable levels of information security risk tolerance in an organization should be determined by?
Which one of the following BEST describes which member of the management team is accountable for the day-to-day operation of the information security program?
The remediation of a specific audit finding is deemed too expensive and will not be implemented. Which of the following is a TRUE statement?
What is the main purpose of the Incident Response Team?
Scenario: You are the CISO and are required to brief the C-level executive team on your information security audit for the year. During your review of the audit findings you discover that many of the controls that were put in place the previous year to correct some of the findings are not performing as needed. You have thirty days until the briefing.
To formulate a remediation plan for the non-performing controls what other document do you need to review before adjusting the controls?
When creating a vulnerability scan schedule, who is the MOST critical person to communicate with in order to ensure impact of the scan is minimized?
What standard provides a comprehensive framework for information security risk management within organizations?
Which of the following are the triple constraints of project management?
XYZ is a publicly-traded software development company.
Who is ultimately accountable to the shareholders in the event of a cybersecurity breach?
Your organization provides open guest wireless access with no captive portals. What can you do to assist with law enforcement investigations if one of your guests is suspected of committing an illegal act using your network?
Which of the following is an accurate statement regarding capital expenses?
Which of the following are MOST often included in the security strategy?
Which of the following are not stakeholders of IT security projects?
A security professional has been promoted to be the CISO of an organization. The first task is to create a security policy for this organization. The CISO creates and publishes the security policy. This policy however, is ignored and not enforced consistently. Which of the following is the MOST likely reason for the policy shortcomings?
The process for identifying, collecting, and producing digital information in support of legal proceedings is called
Which of the following most commonly falls within the scope of an information security governance steering committee?
The FIRST step in establishing a security governance program is to?
A security officer wants to implement a vulnerability scanning program. The officer is uncertain of the state of vulnerability resiliency within the organization’s large IT infrastructure. What would be the BEST approach to minimize scan data output while retaining a realistic view of system vulnerability?
The company decides to release the application without remediating the high-risk vulnerabilities. Which of the following is the MOST likely reason for the company to release the application?
A security manager regualrly checks work areas after buisness hours for security violations; such as unsecured files or unattended computers with active sessions. This activity BEST demonstrates what part of a security program?
You have recently drafted a revised information security policy. From whom should you seek endorsement in order to have the GREATEST chance for adoption and implementation throughout the entire organization?
If a CISO wants to understand the liabilities of the company, she will refer to the:
Which of the following represents the HIGHEST negative impact resulting from an ineffective security governance program?
Which of the following would negatively impact a log analysis of a multinational organization?
Which of the following best describes the purpose of the International Organization for Standardization (ISO) 27002 standard?
Which of the following is the BEST reason for CISO collaboration with legal, IT, and core business functions?
The ultimate goal of an IT security projects is:
Which of the following information would MOST likely be reported at the board-level within an organization?
Which of the following is a PRIMARY task of a risk management function within the security program?
What term BEST describes assuring the actions of employees, applications, and systems follow the organization's rules and regulations?
When performing a forensic investigation, what are the two MOST common data sources for obtaining evidence from a computer and mobile devices?
Which of the following is a benefit of information security governance?
The rate of change in technology increases the importance of:
Who is PRIMARILY responsible for declaring a disaster and initiating processes to facilitate the recovery of critical assets in an organization?
The BEST organization to provide a comprehensive, independent and certifiable perspective on established security controls in an environment is
Which of the following is a major benefit of applying risk levels?
Your IT auditor is reviewing significant events from the previous year and has identified some procedural oversights. Which of the following would be the MOST concerning?
The process of creating a system which divides documents based on their security level to manage access to private data is known as
Which of the following is a critical operational component of an Incident Response Program (IRP)?
What is a key policy that should be part of the information security plan?
Which organizational structure blends elements of functional and project organizational models to create a hybrid reporting structure?
In which of the following examples would an organization be more willing to accept a risk instead of mitigating it?
How often should the Statements of Standards for Attestation Engagements-16 (SSAE16)/International Standard on Assurance Engagements 3402 (ISAE3402) report of your vendors be reviewed?
During the last decade, what trend has caused the MOST serious issues in relation to physical security?
Which business stakeholder is accountable for the integrity of a new information system?
Which of the following is considered one of the most frequent failures in project management?
What is the MAIN reason for conflicts between Information Technology and Information Security programs?
What is a key goal of information security?
When a critical vulnerability has been discovered on production systems and needs to be fixed immediately, what is the BEST approach for a CISO to mitigate the vulnerability under tight budget constraints?
The success of the Chief Information Security Officer is MOST dependent upon:
Many successful cyber-attacks currently include:
Which of the following is the MOST important for a CISO to understand when identifying threats?
What does an anonymous network consist of as the PRIMARY supporting components?
You have been promoted to the CISO of a big-box retail store chain reporting to the Chief Information Officer (CIO). The CIO’s first mandate to you is to develop a cybersecurity compliance framework that will meet all the store’s compliance requirements.
Which of the following compliance standard is the MOST important to the organization?
If a competitor wants to cause damage to your organization, steal critical secrets, or put you out of business,
they just have to find a job opening, prepare someone to pass the interview, have that person hired, and they
will be in the organization. How would you prevent such type of attacks?
From an information security perspective, information that no longer supports the main purpose of the business should be:
A security project is over a year behind schedule and over budget. Which of the following is MOST important to review and verify?
An organization licenses and uses personal information for business operations, and a server containing that information has been compromised. What kind of law would require notifying the owner or licensee of this incident?
The effectiveness of an audit is measured by?
Scenario: Most industries require compliance with multiple government regulations and/or industry standards to meet data protection and privacy mandates.
When multiple regulations or standards apply to your industry you should set controls to meet the:
Which of the following is an IT governance framework that allows managers to bridge the gap between control requirements, technical issues, and business risks?
Alerting, monitoring, and managing security-related events is typically performed by what security function?
What should an organization do to ensure that they have a sound Business Continuity (BC) Plan?
Which of the following are the MOST important factors for proactively determining system vulnerabilities?
The PRIMARY objective for information security program development should be:
Your incident response plan should include which of the following?
Which of the following is the BEST security control for reducing the threat of phishing attacks?
According to the National Institute of Standards and Technology (NIST) SP 800-40, which of the following considerations are MOST important when creating a vulnerability management program?
Providing oversight of an information security program for the organization is the primary responsibility of which group?
What is the PRIMARY difference between Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS)?
What will a CISO analyze if she wants to understand the MOST current financial status of the organization?
What is the estimate of all direct and indirect costs associated with an asset or acquisition over its entire life cycle?
Scenario: Your corporate systems have been under constant probing and attack from foreign IP addresses for more than a week. Your security team and security infrastructure have performed well under the stress. You are confident that your defenses have held up under the test, but rumors are spreading that sensitive customer data has been stolen and is now being sold on the Internet by criminal elements. During your investigation of the rumored compromise you discover that data has been breached and you have discovered the repository of stolen data on a server located in a foreign country. Your team now has full access to the data on the foreign server.
Your defenses did not hold up to the test as originally thought. As you investigate how the data was compromised through log analysis you discover that a hardworking, but misguided business intelligence analyst posted the data to an obfuscated URL on a popular cloud storage service so they could work on it from home during their off-time. Which technology or solution could you deploy to prevent employees from removing corporate data from your network? Choose the BEST answer.
An organization's Information Security Policy is of MOST importance because
Which of the following is the MOST important reason to measure the effectiveness of an Information Security Management System (ISMS)?
As the CISO you need to write the IT security strategic plan. Which of the following is the MOST important to review before you start writing the plan?
With a focus on the review and approval aspects of board responsibilities, the Data Governance Council recommends that the boards provide strategic oversight regarding information and information security, include these four things:
Most of your security projects are behind schedule and over budget, but they align with the security program goals and are correctly scoped. What should you do next?
Which of the following is a countermeasure to prevent unauthorized database access from Web applications?
Which of the following best describes an access control process that confirms the identity of the entity seeking
access to a logical or physical area?
A large number of accounts in a hardened system were suddenly compromised to an external party. Which of
the following is the MOST probable threat actor involved in this incident?
One of the MAIN goals of a Business Continuity Plan is to
Scenario: An organization has made a decision to address Information Security formally and consistently by adopting established best practices and industry standards. The organization is a small retail merchant but it is expected to grow to a global customer base of many millions of customers in just a few years.
The organization has already been subject to a significant amount of credit card fraud. Which of the following is the MOST likely reason for this fraud?
What is the difference between encryption and tokenization?
Providing oversight of a comprehensive information security program for the entire organization is the primary responsibility of which group under the InfoSec governance framework?
Creating a secondary authentication process for network access would be an example of?
Which of the following is the MOST critical to review before you create a security strategy?
What is the MOST likely detrimental consequence arising from an ineffective security governance program within a highly regulated organization?
You have implemented a new security control. Which of the following risk strategy options have you engaged in?
Which type of scan is used on the eye to measure the layer of blood vessels?
A CISO wants to change the defense strategy to ward off attackers. To accomplish this the CISO is looking to a strategy where attackers are lured into a zone of a safe network where attackers can be monitored, controlled, quarantined, or eradicated.
Human resource planning for security professionals in your organization is a:
What is the primary reason for performing a return on investment analysis?
The establishment of a formal risk management framework and system authorization program is essential. The LAST step of the system authorization process is:
Which security technologies are critical for a zero trust model?
An organization has a number of Local Area Networks (LANs) linked to form a single Wide Area Network
(WAN). Which of the following would BEST ensure network continuity?
What oversight should the information security team have in the change management process for application security?
Which of the following items is discretionary?
Which of the following is a metric used for data backup and restoration metrics?
Which of the following provides the BEST ability to view potential financial results in relation to goal achievement?
You work as a project manager for TYU project. You are planning for risk mitigation. You need to quickly identify high-level risks that will need a more in-depth analysis. Which of the following activities will help you in this?
Dataflow diagrams are used by IT auditors to:
Which of the following is a MAJOR consideration when an organization retains sensitive customer data and uses this data to better target the organization’s products and services?
Which type of physical security control scan a person’s external features through a digital video camera before
granting access to a restricted area?
The governing body that defines best practices for the collection of digital evidence is the:
What two methods are used to assess risk impact?
Which of the following is the MAIN reason to follow a formal risk management process in an organization that hosts and uses privately identifiable information (PII) as part of their business models and processes?
Which of the following conditions would be the MOST probable reason for a security project to be rejected by the executive board of an organization?
What is the BEST practice for having vendors verify controls within their services or products to protect customer data and systems?
Ciphertext is encrypted with a result being a compressed representation of the original data. What is this result called?
You are the CISO of a commercial social media organization. The leadership wants to rapidly create new methods of sharing customer data through creative linkages with mobile devices. You have voiced concern about privacy regulations but the velocity of the business is given priority. Which of the following BEST describes this organization?
What does RACI stand for?
What framework of rules and practices is used by a Board of Directors to provide accountability, fairness, and transparency in the organization’s interactions with its shareholders?
During a cyber incident, which non-security personnel might be needed to assist the security team?
An organization has decided to develop an in-house BCM capability. The organization has determined it is best to follow a BCM standard published by the International Organization for Standardization (ISO).
The BEST ISO standard to follow that outlines the complete lifecycle of BCM is?
Your company has limited resources to spend on security initiatives. The Chief Financial Officer asks you to prioritize the protection of information resources based on their value to the company. It is essential that you be able to communicate in language that your fellow executives will understand. You should:
What standard provides a framework for information security risk management?
In order for a CISO to have true situational awareness there is a need to deploy technology that can give a real-time view of security events across the enterprise. Which tool selection represents the BEST choice to achieve situational awareness?
Which control is used to discourage the exploitation of a vulnerability or system?
In what phase of an incident management process will malware antivirus signatures be distributed to infrastructure?
Developing effective security controls is a balance between:
Which of the following is the MOST important to share with an Information Security Steering Committee:
When would it be more desirable to develop a set of decentralized security policies and procedures within an enterprise environment?
What are the common data hiding techniques used by criminals?
A cloud computing environment that is bound together by technology that allows data and applications to be shared between public and private clouds is BEST referred to as a?
The Information Security Governance program MUST:
SCENARIO: Critical servers show signs of erratic behavior within your organization’s intranet. Initial information indicates the systems are under attack from an outside entity. As the Chief Information Security Officer (CISO), you decide to deploy the Incident Response Team (IRT) to determine the details of this incident and take action according to the information available to the team.
In what phase of the response will the team extract information from the affected systems without altering original data?
A CISO decides to analyze the IT infrastructure to ensure security solutions adhere to organizational implementation and management requirements. Which of the following principles does this BEST demonstrate?
The alerting, monitoring, and lifecycle management of security-related events are typically managed by the:
What organizational structure combines the functional and project structures to create a hybrid of the two?
A business unit within your organization intends to deploy a new technology in a manner that places it in violation of existing information security standards. What immediate action should the information security manager take?
A recent audit has identified a few control exceptions and is recommending the implementation of technology and processes to address the finding. Which of the following is the MOST likely reason for the organization to reject the implementation of the recommended technology and processes?
As the CISO, you are the project sponsor for a highly visible log management project. The objective of the project is to centralize all the enterprise logs into a security information and event management (SIEM) system. You requested the results of the performance quality audits activity.
The performance quality audit activity is done in what project management process group?
What is the MOST effective approach to gaining business unit approval of security controls within an organization?
Which of the following would be the MOST concerning security audit finding?
Which of the following functions implements and oversees the use of controls to reduce risk when creating an information security program?
When deploying an Intrusion Prevention System (IPS) the BEST way to get maximum protection from the system is to deploy it
What oversight should the information security team have in the change management process for application security?
Which of the following is a common technology for visual monitoring?
What is a Statement of Objectives (SOA)?
When considering using a vendor to help support your security devices remotely, what is the BEST choice for allowing access?
Quantitative Risk Assessments have the following advantages over qualitative risk assessments:
Scenario: An organization has recently appointed a CISO. This is a new role in the organization and it signals the increasing need to address security consistently at the enterprise level. This new CISO, while confident with skills and experience, is constantly on the defensive and is unable to advance the IT security centric agenda.
Which of the following is the reason the CISO has not been able to advance the security agenda in this organization?
Which of the following activities results in change requests?
You manage a newly created Security Operations Center (SOC), your team is being inundated with security alerts and don’t know what to do. What is the BEST approach to handle this situation?
Risk transference is BEST represented by which of the following actions?
Credit card information, medical data, and government records are all examples of:
The Board of Directors of a publicly-traded company is concerned about the security implications of a strategic project that will migrate 50% of the organization’s information technology assets to the cloud. They have requested a briefing on the project plan and a progress report of the security stream of the project. As the CISO, you have been tasked with preparing the report for the Chief Executive Officer to present.
Using the Earned Value Management (EVM), what does a Cost Variance (CV) of -1,200 mean?
Which wireless encryption technology makes use of temporal keys?
Which of the following uses encapsulation and encryption?
As the Chief Information Security Officer, you are performing an assessment of security posture to understand
what your Defense-in-Depth capabilities are. Which network security technology examines network traffic flows
to detect and actively stop vulnerability exploits and attacks?
An application vulnerability assessment has identified a security flaw in an application. This is a flaw that was previously identified and remediated on a prior release of the application. Which of the following is MOST likely the reason for this recurring issue?
Which of the following would provide a view into the current liabilities of a company?
Scenario: You are the newly hired Chief Information Security Officer for a company that has not previously had a senior level security practitioner. The company lacks a defined security policy and framework for their Information Security Program. Your new boss, the Chief Financial Officer, has asked you to draft an outline of a security policy and recommend an industry/sector neutral information security control framework for implementation.
Your Corporate Information Security Policy should include which of the following?
A CISO has recently joined an organization with a poorly implemented security program. The desire is to base the security program on a risk management approach. Which of the following is a foundational requirement in order to initiate this type of program?
An access point (AP) is discovered using Wireless Equivalent Protocol (WEP). The ciphertext sent by the AP is encrypted with the same key and cipher used by its stations. What authentication method is being used?
When gathering security requirements for an automated business process improvement program, which of the following is MOST important?
Which of the following is a countermeasure to prevent unauthorized database access from web applications?
The effectiveness of social engineering penetration testing using phishing can be used as a Key Performance Indicator (KPI) for the effectiveness of an organization’s
When gathering security requirements for an automated business process improvement program, which of the following is MOST important?
Scenario: You are the CISO and have just completed your first risk assessment for your organization. You find many risks with no security controls, and some risks with inadequate controls. You assign work to your staff to create or adjust existing security controls to ensure they are adequate for risk mitigation needs.
When formulating the remediation plan, what is a required input?
Creating good security metrics is essential for a CISO. What would be the BEST sources for creating security metrics for baseline defenses coverage?
An organization has a stated requirement to block certain traffic on networks. The implementation of controls will disrupt a manufacturing process and cause unacceptable delays, resulting in sever revenue disruptions. Which of the following is MOST likely to be responsible for accepting the risk until mitigating controls can be implemented?
Which of the following standards would be used for creating a Business Continuity Plan?
Which of the following statements below regarding Key Performance indicators (KPIs) are true?