A stakeholder is a person or group:
Which of the following can the company implement in order to avoid this type of security issue in the future?
You are the CISO of a commercial social media organization. The leadership wants to rapidly create new methods of sharing customer data through creative linkages with mobile devices. You have voiced concern about privacy regulations but the velocity of the business is given priority. Which of the following BEST describes this organization?
An example of professional unethical behavior is:
Which of the following represents the BEST method of ensuring security program alignment to business needs?
A newly appointed security officer finds data leakage software licenses that had never been used. The officer decides to implement a project to ensure it gets installed, but the project gets a great deal of resistance across the organization. Which of the following represents the MOST likely reason for this situation?
Your company has a “no right to privacy” notice on all logon screens for your information systems and users sign an Acceptable Use Policy informing them of this condition. A peer group member and friend comes to you and requests access to one of her employee’s email account. What should you do? (choose the BEST answer):
To get an Information Security project back on schedule, which of the following will provide the MOST help?
A CISO has recently joined an organization with a poorly implemented security program. The desire is to base the security program on a risk management approach. Which of the following is a foundational requirement in order to initiate this type of program?
How often should the SSAE16 report of your vendors be reviewed?
A recommended method to document the respective roles of groups and individuals for a given process is to:
Your incident response plan should include which of the following?
Which of the following is critical in creating a security program aligned with an organization’s goals?
The security team has investigated the theft/loss of several unencrypted laptop computers containing sensitive corporate information. To prevent the loss of any additional corporate data it is unilaterally decided by the CISO that all existing and future laptop computers will be encrypted. Soon, the help desk is flooded with complaints about the slow performance of the laptops and users are upset. What did the CISO do wrong? (choose the BEST answer):
When entering into a third party vendor agreement for security services, at what point in the process is it BEST to understand and validate the security posture and compliance level of the vendor?
Which of the following functions implements and oversees the use of controls to reduce risk when creating an information security program?
Which of the following is considered one of the most frequent failures in project management?
Risk appetite is typically determined by which of the following organizational functions?
When managing the critical path of an IT security project, which of the following is MOST important?
Knowing the potential financial loss an organization is willing to suffer if a system fails is a determination of which of the following?
A system was hardened at the Operating System level and placed into the production environment. Months later an audit was performed and it identified insecure configuration different from the original hardened state. Which of the following security issues is the MOST likely reason leading to the audit findings?
Which of the following represents the best method of ensuring business unit alignment with security program requirements?
A CISO implements smart cards for credential management, and as a result has reduced costs associated with help desk operations supporting password resets. This demonstrates which of the following principles?
Which of the following are not stakeholders of IT security projects?
Which of the following is a major benefit of applying risk levels?
How often should the Statements of Standards for Attestation Engagements-16 (SSAE16)/International Standard on Assurance Engagements 3402 (ISAE3402) report of your vendors be reviewed?
In effort to save your company money which of the following methods of training results in the lowest cost for the organization?
Which of the following is considered a project versus a managed process?
SCENARIO: A Chief Information Security Officer (CISO) recently had a third party conduct an audit of the security program. Internal policies and international standards were used as audit baselines. The audit report was presented to the CISO and a variety of high, medium and low rated gaps were identified.
The CISO has implemented remediation activities. Which of the following is the MOST logical next step?
Scenario: Your program is developed around minimizing risk to information by focusing on people, technology, and operations.
You have decided to deal with risk to information from people first. How can you minimize risk to your most sensitive information before granting access?
Which of the following is used to lure attackers into false environments so they can be monitored, contained, or blocked from reaching critical systems?
A newly-hired CISO needs to understand the organization’s financial management standards for business units
and operations. Which of the following would be the best source of this information?
Which of the following is a primary method of applying consistent configurations to IT systems?
Which of the following provides an independent assessment of a vendor’s internal security controls and overall posture?
Which technology can provide a computing environment without requiring a dedicated hardware backend?
Which of the following best describes revenue?
Which of the following information would MOST likely be reported at the board-level within an organization?
Annual Loss Expectancy is derived from the function of which two factors?
When creating contractual agreements and procurement processes why should security requirements be included?
At what level of governance are individual projects monitored and managed?
Which of the following would negatively impact a log analysis of a multinational organization?
As the CISO you need to write the IT security strategic plan. Which of the following is the MOST important to review before you start writing the plan?
Which of the following best describes a portfolio?
Which of the following conditions would be the MOST probable reason for a security project to be rejected by the executive board of an organization?
A CISO has implemented a risk management capability within the security portfolio. Which of the following
terms best describes this functionality?
When project costs continually increase throughout implementation due to large or rapid changes in customer
or user requirements, this is commonly known as:
SCENARIO: A CISO has several two-factor authentication systems under review and selects the one that is most sufficient and least costly. The implementation project planning is completed and the teams are ready to implement the solution. The CISO then discovers that the product it is not as scalable as originally thought and will not fit the organization’s needs.
What is the MOST logical course of action the CISO should take?
The total cost of security controls should:
Scenario: Your corporate systems have been under constant probing and attack from foreign IP addresses for more than a week. Your security team and security infrastructure have performed well under the stress. You are confident that your defenses have held up under the test, but rumors are spreading that sensitive customer data has been stolen and is now being sold on the Internet by criminal elements. During your investigation of the rumored compromise you discover that data has been breached and you have discovered the repository of stolen data on a server located in a foreign country. Your team now has full access to the data on the foreign server.
What action should you take FIRST?
What are the primary reasons for the development of a business case for a security project?
Scenario: As you begin to develop the program for your organization, you assess the corporate culture and determine that there is a pervasive opinion that the security program only slows things down and limits the performance of the “real workers.”
Which group of people should be consulted when developing your security program?
Which of the following is an accurate description of a balance sheet?
Scenario: Your company has many encrypted telecommunications links for their world-wide operations. Physically distributing symmetric keys to all locations has proven to be administratively burdensome, but symmetric keys are preferred to other alternatives.
Symmetric encryption in general is preferable to asymmetric encryption when:
SCENARIO: A CISO has several two-factor authentication systems under review and selects the one that is most sufficient and least costly. The implementation project planning is completed and the teams are ready to implement the solution. The CISO then discovers that the product it is not as scalable as originally thought and will not fit the organization’s needs.
The CISO is unsure of the information provided and orders a vendor proof of concept to validate the system’s scalability. This demonstrates which of the following?
As the Business Continuity Coordinator of a financial services organization, you are responsible for ensuring assets are recovered timely in the event of a disaster. Which is the BEST Disaster Recovery performance indicator to validate that you are prepared for a disaster?
SCENARIO: A Chief Information Security Officer (CISO) recently had a third party conduct an audit of the security program. Internal policies and international standards were used as audit baselines. The audit report was presented to the CISO and a variety of high, medium and low rated gaps were identified.
Which of the following is the FIRST action the CISO will perform after receiving the audit report?
Risk is defined as:
The CIO of an organization has decided to assign the responsibility of internal IT audit to the IT team. This is consider a bad practice MAINLY because
In accordance with best practices and international standards, how often is security awareness training provided to employees of an organization?
As a new CISO at a large healthcare company you are told that everyone has to badge in to get in the building. Below your office window you notice a door that is normally propped open during the day for groups of people to take breaks outside. Upon looking closer you see there is no badge reader. What should you do?
Which of the following are primary concerns for management with regard to assessing internal control objectives?
The PRIMARY objective for information security program development should be:
The FIRST step in establishing a security governance program is to?
The patching and monitoring of systems on a consistent schedule is required by?
When managing an Information Security Program, which of the following is of MOST importance in order to influence the culture of an organization?
When a CISO considers delaying or not remediating system vulnerabilities which of the following are MOST important to take into account?
You have recently drafted a revised information security policy. From whom should you seek endorsement in order to have the GREATEST chance for adoption and implementation throughout the entire organization?
Which of the following best describes the purpose of the International Organization for Standardization (ISO) 27002 standard?
Which of the following is the MOST effective way to measure the effectiveness of security controls on a perimeter network?
Which of the following functions MUST your Information Security Governance program include for formal organizational reporting?
What should an organization do to ensure that they have a sound Business Continuity (BC) Plan?
You work as a project manager for TYU project. You are planning for risk mitigation. You need to quickly identify high-level risks that will need a more in-depth analysis. Which of the following activities will help you in this?
The alerting, monitoring and life-cycle management of security related events is typically handled by the
Which of the following represents the BEST reason for an organization to use the Control Objectives for Information and Related Technology (COBIT) as an Information Technology (IT) framework?
Which of the following intellectual Property components is focused on maintaining brand recognition?
Which of the following is a benefit of a risk-based approach to audit planning?
One of the MAIN goals of a Business Continuity Plan is to
Quantitative Risk Assessments have the following advantages over qualitative risk assessments:
Which of the following is the MOST important reason to measure the effectiveness of an Information Security Management System (ISMS)?
When you develop your audit remediation plan what is the MOST important criteria?
Which of the following should be determined while defining risk management strategies?
An information security department is required to remediate system vulnerabilities when they are discovered. Please select the three primary remediation methods that can be used on an affected system.
A security officer wants to implement a vulnerability scanning program. The officer is uncertain of the state of vulnerability resiliency within the organization’s large IT infrastructure. What would be the BEST approach to minimize scan data output while retaining a realistic view of system vulnerability?
To have accurate and effective information security policies how often should the CISO review the organization policies?
As a CISO you need to understand the steps that are used to perform an attack against a network. Put each step into the correct order.
1.Covering tracks
2.Scanning and enumeration
3.Maintaining Access
4.Reconnaissance
5.Gaining Access
What is the FIRST step in developing the vulnerability management program?
Network Forensics is the prerequisite for any successful legal action after attacks on your Enterprise Network. Which is the single most important factor to introducing digital evidence into a court of law?
An access point (AP) is discovered using Wireless Equivalent Protocol (WEP). The ciphertext sent by the AP is encrypted with the same key and cipher used by its stations. What authentication method is being used?
A customer of a bank has placed a dispute on a payment for a credit card account. The banking system uses digital signatures to safeguard the integrity of their transactions. The bank claims that the system shows proof that the customer in fact made the payment. What is this system capability commonly known as?
One of your executives needs to send an important and confidential email. You want to ensure that the message cannot be read by anyone but the recipient. Which of the following keys should be used to encrypt the message?
Which of the following backup sites takes the longest recovery time?
Which of the following is MOST important when tuning an Intrusion Detection System (IDS)?
The process of creating a system which divides documents based on their security level to manage access to private data is known as
The process for identifying, collecting, and producing digital information in support of legal proceedings is called
The ability to hold intruders accountable in a court of law is important. Which of the following activities are needed to ensure the highest possibility for successful prosecution?
Physical security measures typically include which of the following components?
The general ledger setup function in an enterprise resource package allows for setting accounting periods. Access to this function has been permitted to users in finance, the shipping department, and production scheduling. What is the most likely reason for such broad access?
Your organization provides open guest wireless access with no captive portals. What can you do to assist with law enforcement investigations if one of your guests is suspected of committing an illegal act using your network?
What is the term describing the act of inspecting all real-time Internet traffic (i.e., packets) traversing a major Internet backbone without introducing any apparent latency?
SQL injection is a very popular and successful injection attack method. Identify the basic SQL injection text:
Your penetration testing team installs an in-line hardware key logger onto one of your network machines. Which of the following is of major concern to the security organization?
An anonymity network is a series of?
Your incident handling manager detects a virus attack in the network of your company. You develop a signature based on the characteristics of the detected virus. Which of the following phases in the incident handling process will utilize the signature to resolve this incident?
Security related breaches are assessed and contained through which of the following?
While designing a secondary data center for your company what document needs to be analyzed to determine to how much should be spent on building the data center?
The process of identifying and classifying assets is typically included in the
Which of the following is the MAIN security concern for public cloud computing?
Which of the following is a symmetric encryption algorithm?
What type of attack requires the least amount of technical equipment and has the highest success rate?
Which of the following is a countermeasure to prevent unauthorized database access from web applications?
Which of the following statements about Encapsulating Security Payload (ESP) is true?
Which wireless encryption technology makes use of temporal keys?
A CISO must conduct risk assessments using a method where the Chief Financial Officer (CFO) receives impact data in financial terms to use as input to select the proper level of coverage in a new cybersecurity insurance policy.
What is the MOST effective method of risk analysis to provide the CFO with the information required?
What is the MOST critical output of the incident response process?
The Board of Directors of a publicly-traded company is concerned about the security implications of a strategic project that will migrate 50% of the organization’s information technology assets to the cloud. They have requested a briefing on the project plan and a progress report of the security stream of the project. As the CISO, you have been tasked with preparing the report for the Chief Executive Officer to present.
Using the Earned Value Management (EVM), what does a Cost Variance (CV) of -1,200 mean?
You have been promoted to the CISO of a retail store. Which of the following compliance standards is the MOST important to the organization?
What is a Statement of Objectives (SOA)?
With a focus on the review and approval aspects of board responsibilities, the Data Governance Council recommends that the boards provide strategic oversight regarding information and information security, include these four things:
Who should be involved in the development of an internal campaign to address email phishing?
A Security Operations (SecOps) Manager is considering implementing threat hunting to be able to make better decisions on protecting information and assets.
What is the MAIN goal of threat hunting to the SecOps Manager?
A bastion host should be placed:
What does RACI stand for?
Optical biometric recognition such as retina scanning provides access to facilities through reading the unique characteristics of a person’s eye.
However, authorization failures can occur with individuals who have?
The alerting, monitoring, and lifecycle management of security-related events are typically managed by the:
As the CISO, you are the project sponsor for a highly visible log management project. The objective of the project is to centralize all the enterprise logs into a security information and event management (SIEM) system. You requested the results of the performance quality audits activity.
The performance quality audit activity is done in what project management process group?
When reviewing a Solution as a Service (SaaS) provider’s security health and posture, which key document should you review?
Which of the following provides the BEST approach to achieving positive outcomes while preserving savings?
You have been promoted to the CISO of a big-box retail store chain reporting to the Chief Information Officer (CIO). The CIO’s first mandate to you is to develop a cybersecurity compliance framework that will meet all the store’s compliance requirements.
Which of the following compliance standard is the MOST important to the organization?
From the CISO’s perspective in looking at financial statements, the statement of retained earnings of an organization:
The primary responsibility for assigning entitlements to a network share lies with which role?
When information security falls under the Chief Information Officer (CIO), what is their MOST essential role?
As the Risk Manager of an organization, you are task with managing vendor risk assessments. During the assessment, you identified that the vendor is engaged with high profiled clients, and bad publicity can jeopardize your own brand.
Which is the BEST type of risk that defines this event?
The ability to require implementation and management of security controls within third-party provided services is a critical part of:
You have been hired as the Information System Security Officer (ISSO) for a US federal government agency. Your role is to ensure the security posture of the system is maintained. One of your tasks is to develop and maintain the system security plan (SSP) and supporting documentation.
Which of the following is NOT documented in the SSP?
Which of the following strategies provides the BEST response to a ransomware attack?
When performing a forensic investigation, what are the two MOST common data sources for obtaining evidence from a computer and mobile devices?
The main purpose of the SOC is:
To make sure that the actions of all employees, applications, and systems follow the organization’s rules and regulations can BEST be described as which of the following?