The PRIMARY objective for information security program development should be:
Options
Discussion
No comments yet. Be the first to comment.
Be respectful. No spam.
Correct Answer:
A
Explanation
:
Q: 3
A method to transfer risk is to:
Options
Discussion
No comments yet. Be the first to comment.
Be respectful. No spam.
Correct Answer:
C
Explanation
:
Q: 4
When managing an Information Security Program, which of the following is of MOST importance in
order to influence the culture of an organization?
Options
Discussion
No comments yet. Be the first to comment.
Be respectful. No spam.
Correct Answer:
B
Explanation
:
Q: 5
Developing effective security controls is a balance between:
Options
Discussion
No comments yet. Be the first to comment.
Be respectful. No spam.
Correct Answer:
A
Explanation
:
Q: 6
A business unit within your organization intends to deploy a new technology in a manner that places
it in violation of existing information security standards. What immediate action should the
information security manager take?
Options
Discussion
No comments yet. Be the first to comment.
Be respectful. No spam.
Correct Answer:
C
Explanation
:
Q: 7
SCENARIO: Critical servers show signs of erratic behavior within your organization’s intranet. Initial
information indicates the systems are under attack from an outside entity. As the Chief Information
Security Officer (CISO), you decide to deploy the Incident Response Team (IRT) to determine the
details of this incident and take action according to the information available to the team.
What phase of the response provides measures to reduce the likelihood of an incident from
recurring?
Options
Discussion
No comments yet. Be the first to comment.
Be respectful. No spam.
Correct Answer:
D
Explanation
:
Q: 8
Scenario: An organization has made a decision to address Information Security formally and
consistently by adopting established best practices and industry standards. The organization is a
small retail merchant but it is expected to grow to a global customer base of many millions of
customers in just a few years.
Which of the following would be the FIRST step when addressing Information Security formally and
consistently in this organization?
Options
Discussion
No comments yet. Be the first to comment.
Be respectful. No spam.
Correct Answer:
C
Explanation
:
Q: 9
Scenario: Your company has many encrypted telecommunications links for their world-wide
operations. Physically distributing symmetric keys to all locations has proven to be administratively
burdensome, but symmetric keys are preferred to other alternatives.
Symmetric encryption in general is preferable to asymmetric encryption when:
Options
Discussion
No comments yet. Be the first to comment.
Be respectful. No spam.
Correct Answer:
C
Explanation
:
Q: 10
When dealing with Security Incident Response procedures, which of the following steps come FIRST
when reacting to an incident?
Options
Discussion
No comments yet. Be the first to comment.
Be respectful. No spam.
Correct Answer:
D
Explanation
:
Q: 11
SCENARIO: A Chief Information Security Officer (CISO) recently had a third party conduct an audit of
the security program. Internal policies and international standards were used as audit baselines. The
audit report was presented to the CISO and a variety of high, medium and low rated gaps were
identified.
The CISO has implemented remediation activities. Which of the following is the MOST logical next
step?
Options
Discussion
No comments yet. Be the first to comment.
Be respectful. No spam.
Correct Answer:
A
Explanation
Scenario5
Q: 12
SCENARIO: A CISO has several two-factor authentication systems under review and selects the one
that is most sufficient and least costly. The implementation project planning is completed and the
teams are ready to implement the solution. The CISO then discovers that the product it is not as
scalable as originally thought and will not fit the organization’s needs.
The CISO discovers the scalability issue will only impact a small number of network segments. What
is the next logical step to ensure the proper application of risk management methodology within the
two-facto implementation project?
Options
Discussion
No comments yet. Be the first to comment.
Be respectful. No spam.
Correct Answer:
B
Explanation
Scenario8
Q: 13
SCENARIO: A CISO has several two-factor authentication systems under review and selects the one
that is most sufficient and least costly. The implementation project planning is completed and the
teams are ready to implement the solution. The CISO then discovers that the product it is not as
scalable as originally thought and will not fit the organization’s needs.
What is the MOST logical course of action the CISO should take?
Options
Discussion
No comments yet. Be the first to comment.
Be respectful. No spam.
Correct Answer:
A
Explanation
:
Q: 14
Ensuring that the actions of a set of people, applications and systems follow the organization’s rules
is BEST described as:
Options
Discussion
No comments yet. Be the first to comment.
Be respectful. No spam.
Correct Answer:
D
Explanation
:
Q: 15
If the result of an NPV is positive, then the project should be selected. The net present value shows
the present
value of the project, based on the decisions taken for its selection. What is the net present value
equal to?
Options
Discussion
No comments yet. Be the first to comment.
Be respectful. No spam.
Correct Answer:
C
Explanation
:
Q: 16
Assigning the role and responsibility of Information Assurance to a dedicated and independent
security group is an example of:
Options
Discussion
No comments yet. Be the first to comment.
Be respectful. No spam.
Correct Answer:
D
Explanation
:
Q: 17
Which of the following activities must be completed BEFORE you can calculate risk?
Options
Discussion
No comments yet. Be the first to comment.
Be respectful. No spam.
Correct Answer:
C
Explanation
:
Q: 18
You are just hired as the new CISO and are being briefed on all the Information Security projects that
your section has on going. You discover that most projects are behind schedule and over budget.
Using the best business practices for project management you determine that the project correctly
aligns with the company goals and the scope of the project is correct. What is the NEXT step?
Options
Discussion
No comments yet. Be the first to comment.
Be respectful. No spam.
Correct Answer:
C
Explanation
:
Q: 19
Scenario: Your corporate systems have been under constant probing and attack from foreign IP addresses for more than a week. Your security team and security infrastructure have performed well under the stress. You are confident that your defenses have held up under the test, but rumors are spreading that sensitive customer data has been stolen and is now being sold on the Internet by criminal elements. During your investigation of the rumored compromise you discover that data has been breached and you have discovered the repository of stolen data on a server located in a foreign country. Your team now has full access to the data on the foreign server. Your defenses did not hold up to the test as originally thought. As you investigate how the data was compromised through log analysis you discover that a hardworking, but misguided business intelligence analyst posted the data to an obfuscated URL on a popular cloud storage service so they could work on it from home during their off-time. Which technology or solution could you deploy to prevent employees from removing corporate data from your network? Choose the best answer.
Options
Discussion
No comments yet. Be the first to comment.
Be respectful. No spam.
Correct Answer:
Explanation
:
Q: 20
You manage a newly created Security Operations Center (SOC), your team is being inundated with
security alerts and don’t know what to do. What is the BEST approach to handle this situation?
