Security related breaches are assessed and contained through which of the following?
One of your executives needs to send an important and confidential email. You want to ensure that the message cannot be read by anyone but the recipient. Which of the following keys should be used to encrypt the message?
While designing a secondary data center for your company what document needs to be analyzed to determine to how much should be spent on building the data center?
Which of the following is MOST important when tuning an Intrusion Detection System (IDS)?
An anonymity network is a series of?
Which wireless encryption technology makes use of temporal keys?
Your incident handling manager detects a virus attack in the network of your company. You develop a signature based on the characteristics of the detected virus. Which of the following phases in the incident handling process will utilize the signature to resolve this incident?
Which of the following is a countermeasure to prevent unauthorized database access from web applications?
Which of the following is the MAIN security concern for public cloud computing?
What is the term describing the act of inspecting all real-time Internet traffic (i.e., packets) traversing a major Internet backbone without introducing any apparent latency?
You are having a penetration test done on your company network and the leader of the team says they discovered all the network devices because no one had changed the Simple Network Management Protocol (SNMP) community strings from the defaults. Which of the following is a default community string?
The general ledger setup function in an enterprise resource package allows for setting accounting periods. Access to this function has been permitted to users in finance, the shipping department, and production scheduling. What is the most likely reason for such broad access?
Which of the following backup sites takes the longest recovery time?
Which of the following is a symmetric encryption algorithm?
The process of creating a system which divides documents based on their security level to manage access to private data is known as
The process of identifying and classifying assets is typically included in the
In terms of supporting a forensic investigation, it is now imperative that managers, first-responders, etc., accomplish the following actions to the computer under investigation:
The ability to hold intruders accountable in a court of law is important. Which of the following activities are needed to ensure the highest possibility for successful prosecution?
SQL injection is a very popular and successful injection attack method. Identify the basic SQL injection text:
Network Forensics is the prerequisite for any successful legal action after attacks on your Enterprise Network. Which is the single most important factor to introducing digital evidence into a court of law?
As a CISO you need to understand the steps that are used to perform an attack against a network. Put each step into the correct order.
1.Covering tracks
2.Scanning and enumeration
3.Maintaining Access
4.Reconnaissance
5.Gaining Access
Which of the following statements about Encapsulating Security Payload (ESP) is true?
What is the FIRST step in developing the vulnerability management program?
The amount of risk an organization is willing to accept in pursuit of its mission is known as
Creating a secondary authentication process for network access would be an example of?
An organization has implemented a change management process for all changes to the IT production environment. This change management process follows best practices and is expected to help stabilize the availability and integrity of the organization’s IT environment. Which of the following can be used to measure the effectiveness of this newly implemented process:
Which represents PROPER separation of duties in the corporate environment?
Which of the following is the MOST important goal of risk management?
Which of the following organizations is typically in charge of validating the implementation and effectiveness of security controls?
Many times a CISO may have to speak to the Board of Directors (BOD) about their cyber security posture. What would be the BEST choice of security metrics to present to the BOD?
Creating a secondary authentication process for network access would be an example of?
Creating good security metrics is essential for a CISO. What would be the BEST sources for creating security metrics for baseline defenses coverage?
Which of the following are primary concerns for management with regard to assessing internal control objectives?
The risk found after a control has been fully implemented is called:
The regular review of a firewall ruleset is considered a
Which of the following illustrates an operational control process:
Which of the following tests is an IS auditor performing when a sample of programs is selected to determine if the source and object versions are the same?
The MOST common method to get an unbiased measurement of the effectiveness of an Information Security Management System (ISMS) is to
When you develop your audit remediation plan what is the MOST important criteria?
The effectiveness of social engineering penetration testing using phishing can be used as a Key Performance Indicator (KPI) for the effectiveness of an organization’s
When a critical vulnerability has been discovered on production systems and needs to be fixed immediately, what is the BEST approach for a CISO to mitigate the vulnerability under tight budget constraints?
Which International Organization for Standardization (ISO) below BEST describes the performance of risk management, and includes a five-stage risk management methodology.
The mean time to patch, number of virus outbreaks prevented, and number of vulnerabilities mitigated are examples of what type of performance metrics?
An IT auditor has recently discovered that because of a shortage of skilled operations personnel, the security administrator has agreed to work one late night shift a week as the senior computer operator. The most appropriate course of action for the IT auditor is to:
Which of the following BEST describes an international standard framework that is based on the security model Information Technology—Code of Practice for Information Security Management?
The executive board has requested that the CISO of an organization define and Key Performance Indicators (KPI) to measure the effectiveness of the security awareness program provided to call center employees. Which of the following can be used as a KPI?
The Board of Directors of a publicly-traded company is concerned about the security implications of a strategic project that will migrate 50% of the organization’s information technology assets to the cloud. They have requested a briefing on the project plan and a progress report of the security stream of the project. As the CISO, you have been tasked with preparing the report for the Chief Executive Officer to present.
Using the Earned Value Management (EVM), what does a Cost Variance (CV) of -1,200 mean?
A company wants to fill a Chief Information Security Officer position. Which of the following qualifications and experience would be MOST desirable in a candidate?
You have been promoted to the CISO of a retail store. Which of the following compliance standards is the MOST important to the organization?
Which of the following strategies provides the BEST response to a ransomware attack?
From the CISO’s perspective in looking at financial statements, the statement of retained earnings of an organization:
You are the CISO for an investment banking firm. The firm is using artificial intelligence (AI) to assist in approving clients for loans.
Which control is MOST important to protect AI products?
What is the THIRD state of the Tuckman Stages of Group Development?
When managing a project, the MOST important activity in managing the expectations of stakeholders is:
What is the MOST critical output of the incident response process?
A key cybersecurity feature of a Personal Identification Verification (PIV) Card is:
Which of the following are the triple constraints of project management?
A cloud computing environment that is bound together by technology that allows data and applications to be shared between public and private clouds is BEST referred to as a?
What key technology can mitigate ransomware threats?
A university recently hired a CISO. One of the first tasks is to develop a continuity of operations plan (COOP).
In developing the business impact assessment (BIA), which of the following MOST closely relate to the data backup and restoral?
ABC Limited has recently suffered a security breach with customers’ social security number available on the dark web for sale. The CISO, during the time of the incident, has been fired, and you have been hired as the replacement. The analysis of the breach found that the absence of an insider threat program, lack of least privilege policy, and weak access control was to blame. You would like to implement key performance indicators to mitigate the risk.
Which metric would meet the requirement?
The main purpose of the SOC is:
The alerting, monitoring, and lifecycle management of security-related events are typically managed by the:
A CISO decides to analyze the IT infrastructure to ensure security solutions adhere to organizational implementation and management requirements. Which of the following principles does this BEST demonstrate?
Who is responsible for verifying that audit directives are implemented?
When information security falls under the Chief Information Officer (CIO), what is their MOST essential role?
Which level of data destruction applies logical techniques to sanitize data in all user-addressable storage locations?
You have been hired as the Information System Security Officer (ISSO) for a US federal government agency. Your role is to ensure the security posture of the system is maintained. One of your tasks is to develop and maintain the system security plan (SSP) and supporting documentation.
Which of the following is NOT documented in the SSP?
A Security Operations Manager is finding it difficult to maintain adequate staff levels to monitor security operations during off-hours. To reduce the impact of staff shortages and increase coverage during off-hours, the SecOps manager is considering outsourcing off-hour coverage.
What Security Operations Center (SOC) model does this BEST describe?
The new CISO was informed of all the Information Security projects that the organization has in progress. Two projects are over a year behind schedule and over budget. Using best business practices for project management you determine that the project correctly aligns with the company goals.
Which of the following needs to be performed NEXT?
A newly-hired CISO needs to understand the organization’s financial management standards for business units
and operations. Which of the following would be the best source of this information?
When project costs continually increase throughout implementation due to large or rapid changes in customer
or user requirements, this is commonly known as:
Which of the following is an accurate description of a balance sheet?
An organization has a number of Local Area Networks (LANs) linked to form a single Wide Area Network
(WAN). Which of the following would BEST ensure network continuity?
Which of the following terms is used to describe countermeasures implemented to minimize risks to physical
property, information, and computing systems?
The ability to demand the implementation and management of security controls on third parties providing services to an organization is
Scenario: Your corporate systems have been under constant probing and attack from foreign IP addresses for more than a week. Your security team and security infrastructure have performed well under the stress. You are confident that your defenses have held up under the test, but rumors are spreading that sensitive customer data has been stolen and is now being sold on the Internet by criminal elements. During your investigation of the rumored compromise you discover that data has been breached and you have discovered the repository of stolen data on a server located in a foreign country. Your team now has full access to the data on the foreign server.
Your defenses did not hold up to the test as originally thought. As you investigate how the data was compromised through log analysis you discover that a hardworking, but misguided business intelligence analyst posted the data to an obfuscated URL on a popular cloud storage service so they could work on it from home during their off-time. Which technology or solution could you deploy to prevent employees from removing corporate data from your network? Choose the BEST answer.
Scenario: Your company has many encrypted telecommunications links for their world-wide operations. Physically distributing symmetric keys to all locations has proven to be administratively burdensome, but symmetric keys are preferred to other alternatives.
How can you reduce the administrative burden of distributing symmetric keys for your employer?
Scenario: You are the CISO and have just completed your first risk assessment for your organization. You find many risks with no security controls, and some risks with inadequate controls. You assign work to your staff to create or adjust existing security controls to ensure they are adequate for risk mitigation needs.
When formulating the remediation plan, what is a required input?
Human resource planning for security professionals in your organization is a:
As the CISO, you have been tasked with the execution of the company’s key management program. You
MUST ensure the integrity of encryption keys at the point of generation. Which principal of encryption key
control will ensure no single individual can constitute or re-constitute a key?
A consultant is hired to do physical penetration testing at a large financial company. In the first day of his
assessment, the consultant goes to the company’s building dressed like an electrician and waits in the lobby for
an employee to pass through the main access gate, then the consultant follows the employee behind to get into
the restricted area. Which type of attack did the consultant perform?
SCENARIO: A Chief Information Security Officer (CISO) recently had a third party conduct an audit of the security program. Internal policies and international standards were used as audit baselines. The audit report was presented to the CISO and a variety of high, medium and low rated gaps were identified.
The CISO has implemented remediation activities. Which of the following is the MOST logical next step?
SCENARIO: A Chief Information Security Officer (CISO) recently had a third party conduct an audit of the security program. Internal policies and international standards were used as audit baselines. The audit report was presented to the CISO and a variety of high, medium and low rated gaps were identified.
Which of the following is the FIRST action the CISO will perform after receiving the audit report?
The total cost of security controls should:
Scenario: Your corporate systems have been under constant probing and attack from foreign IP addresses for more than a week. Your security team and security infrastructure have performed well under the stress. You are confident that your defenses have held up under the test, but rumors are spreading that sensitive customer data has been stolen and is now being sold on the Internet by criminal elements. During your investigation of the rumored compromise you discover that data has been breached and you have discovered the repository of stolen data on a server located in a foreign country. Your team now has full access to the data on the foreign server.
What action should you take FIRST?
Which of the following is an accurate statement regarding capital expenses?
Which of the following conditions would be the MOST probable reason for a security project to be rejected by the executive board of an organization?
A digital signature addresses which of the following concerns?
When updating the security strategic planning document what two items must be included?
Which of the following best describes a portfolio?
Which technology can provide a computing environment without requiring a dedicated hardware backend?
Which of the following is a benefit of information security governance?
After a risk assessment is performed, a particular risk is considered to have the potential of costing the organization 1.2 Million USD. This is an example of
An organization has defined a set of standard security controls. This organization has also defined the circumstances and conditions in which they must be applied. What is the NEXT logical step in applying the controls in the organization?
An organization information security policy serves to
The PRIMARY objective for information security program development should be:
A global retail company is creating a new compliance management process. Which of the following regulations is of MOST importance to be tracked and managed by this process?
The alerting, monitoring and life-cycle management of security related events is typically handled by the
Which of the following is considered the MOST effective tool against social engineering?
A company wants to fill a Chief Information Security Officer position in the organization. They need to define and implement a more holistic security program. Which of the following qualifications and experience would be MOST desirable to find in a candidate?
Which of the following is used to establish and maintain a framework to provide assurance that information security strategies are aligned with organizational objectives?
A security manager regualrly checks work areas after buisness hours for security violations; such as unsecured files or unattended computers with active sessions. This activity BEST demonstrates what part of a security program?
Who is responsible for securing networks during a security incident?
A global health insurance company is concerned about protecting confidential information. Which of the following is of MOST concern to this organization?
You have purchased a new insurance policy as part of your risk strategy. Which of the following risk strategy options have you engaged in?
When an organization claims it is secure because it is PCI-DSS certified, what is a good first question to ask towards assessing the effectiveness of their security program?
From an information security perspective, information that no longer supports the main purpose of the business should be:
When managing the security architecture for your company you must consider:
Who in the organization determines access to information?
What is the MAIN reason for conflicts between Information Technology and Information Security programs?
Why is it vitally important that senior management endorse a security policy?
Ensuring that the actions of a set of people, applications and systems follow the organization’s rules is BEST described as:
According to the National Institute of Standards and Technology (NIST) SP 800-40, which of the following considerations are MOST important when creating a vulnerability management program?
Credit card information, medical data, and government records are all examples of:
A system was hardened at the Operating System level and placed into the production environment. Months later an audit was performed and it identified insecure configuration different from the original hardened state. Which of the following security issues is the MOST likely reason leading to the audit findings?
A newly appointed security officer finds data leakage software licenses that had never been used. The officer decides to implement a project to ensure it gets installed, but the project gets a great deal of resistance across the organization. Which of the following represents the MOST likely reason for this situation?
Acme Inc. has engaged a third party vendor to provide 99.999% up-time for their online web presence and had them contractually agree to this service level agreement. What type of risk tolerance is Acme exhibiting? (choose the BEST answer):
Knowing the potential financial loss an organization is willing to suffer if a system fails is a determination of which of the following?
Which of the following methods are used to define contractual obligations that force a vendor to meet customer expectations?
Which of the following functions evaluates patches used to close software vulnerabilities of new systems to assure compliance with policy when implementing an information security program?
Your company has a “no right to privacy” notice on all logon screens for your information systems and users sign an Acceptable Use Policy informing them of this condition. A peer group member and friend comes to you and requests access to one of her employee’s email account. What should you do? (choose the BEST answer):
Which of the following information may be found in table top exercises for incident response?
Risk appetite is typically determined by which of the following organizational functions?
Which of the following best summarizes the primary goal of a security program?
A person in your security team calls you at night and informs you that one of your web applications is potentially under attack from a cross-site scripting vulnerability. What do you do?
Which of the following methodologies references the recommended industry standard that Information security project managers should follow?
To get an Information Security project back on schedule, which of the following will provide the MOST help?
An example of professional unethical behavior is:
When considering using a vendor to help support your security devices remotely, what is the BEST choice for allowing access?
A recommended method to document the respective roles of groups and individuals for a given process is to:
You manage a newly created Security Operations Center (SOC), your team is being inundated with security alerts and don’t know what to do. What is the BEST approach to handle this situation?
Which of the following is critical in creating a security program aligned with an organization’s goals?
A CISO sees abnormally high volumes of exceptions to security requirements and constant pressure from business units to change security processes. Which of the following represents the MOST LIKELY cause of this situation?
The Security Operations Center (SOC) just purchased a new intrusion prevention system (IPS) that needs to be deployed in-line for best defense. The IT group is concerned about putting the new IPS in-line because it might negatively impact network availability. What would be the BEST approach for the CISO to reassure the IT group?
Which of the following is the MOST important component of any change management process?
The ultimate goal of an IT security projects is:
Which one of the following BEST describes which member of the management team is accountable for the day-to-day operation of the information security program?