Rob van der Heijden
Quiz by , created more than 1 year ago

Digital Technologies Quiz on CISM 2014 Questions - 3, created by Rob van der Heijden on 23/03/2017.

19
0
0
Eduardo Castella7911
Created by Eduardo Castella7911 almost 9 years ago
Rob van der Heijden
Copied by Rob van der Heijden over 7 years ago
Close

CISM 2014 Questions - 3

Question 1 of 151

1

Which of the following is MOST important to the successful promotion of good security management practices?

Select one of the following:

  • A. Security metrics

  • B. Security baselines

  • C. Management support

  • D. Periodic training

Explanation

Question 2 of 151

1

Which of the following security mechanisms is MOST effective in protecting classified data that have been encrypted to prevent disclosure and transmission outside the organization's network?

Select one of the following:

  • A. Configuration of firewalls

  • B. Strength of encryption algorithms

  • C. Authentication within application

  • D. Safeguards over keys

Explanation

Question 3 of 151

1

The PRIMARY objective of a vulnerability assessment is to:

Select one of the following:

  • A. reduce risk to the business.

  • B. ensure compliance with security policies.

  • C. provide assurance to management.

  • D. measure efficiency of services provided.

Explanation

Question 4 of 151

1

Which of the following is the GREATEST concern for an organization in which there is a widespread use of mobile devices?

Select one of the following:

  • A. There is an undue reliance on public networks.

  • B. Batteries require constant recharges.

  • C. There is a lack of operating system standardization.

  • D. Mobile devices can be easily lost or stolen.

Explanation

Question 5 of 151

1

The director of auditing has recommended a specific information security monitoring solution to the information security manager. What should the information security manager do FIRST?

Select one of the following:

  • A. Obtain comparative pricing bids and complete the transaction with the vendor offering the best deal.

  • B. Add the purchase to the budget during the next budget preparation cycle to account for costs.

  • C. Perform an assessment to determine correlation with business goals and objectives.

  • D. Form a project team to plan the implementation.

Explanation

Question 6 of 151

1

Which of the following is the PRIMARY reason to change policies during program development?

Select one of the following:

  • A. The policies must comply with new regulatory and legal mandates.

  • B. Appropriate security baselines are no longer set in the policies.

  • C. The policies no longer reflect management intent and direction.

  • D. Employees consistently ignore the policies.

Explanation

Question 7 of 151

1

Which of the following is the MOST effective way to ensure that noncompliance to information security standards is resolved?

Select one of the following:

  • A. Periodic audits of noncompliant areas

  • B. An ongoing vulnerability scanning program

  • C. Annual security awareness training

  • D. Regular reports to executive management

Explanation

Question 8 of 151

1

What is the PRIMARY purpose of installing an intrusion detection system (IDS)?

Select one of the following:

  • A. To identify weaknesses in network security

  • B. To identify patterns of suspicious access

  • C. To identify how an attack was launched on the network

  • D. To identify potential attacks on the internal network

Explanation

Question 9 of 151

1

Senior management commitment and support for information security can BEST be obtained through presentations that:

Select one of the following:

  • A. use illustrative examples of successful attacks.

  • B. explain the technical risks to the organization.

  • C. evaluate the organization against best security practices.

  • D. tie security risks to key business objectives.

Explanation

Question 10 of 151

1

The recovery time objective (RTO) is reached at which of the following milestones?

Select one of the following:

  • A. Disaster declaration

  • B. Recovery of the backups

  • C. Restoration of the system

  • D. Return to business as usual processing

Explanation

Question 11 of 151

1

Which of the following approaches would be BEST to address significant system vulnerabilities that were discovered during a network scan?

Select one of the following:

  • A. All significant vulnerabilities must be mitigated in a timely fashion.

  • B. Treatment should be based on threat, impact and cost considerations.

  • C. Compensatory controls must be implemented for major vulnerabilities.

  • D. Mitigation options should be proposed for management approval.

Explanation

Question 12 of 151

1

How does knowledge of risk appetite help to increase security control effectiveness?

Select one of the following:

  • A. It shows senior management that you understand their needs.

  • B. It provides a basis for redistributing resources to mitigate risk outside the risk tolerance.

  • C. It requires continuous monitoring because the entire risk environment is constantly changing.

  • D. It facilitates communication with management about the importance of security.

Explanation

Question 13 of 151

1

Which of the following is the MOST important prerequisite to undertaking asset classification?

Select one of the following:

  • A. Threat analysis

  • B. Impact assessment

  • C. Controls evaluation

  • D. Penetration testing

Explanation

Question 14 of 151

1

What is the PRIMARY objective of a risk management program?

Select one of the following:

  • A. Minimize inherent risk.

  • B. Eliminate business risk.

  • C. Implement effective controls.

  • D. Reduce residual risk to acceptable levels.

Explanation

Question 15 of 151

1

Where should resource requirements for information security initially be identified?

Select one of the following:

  • A. In policies

  • B. In the architecture

  • C. In the strategy

  • D. In procedures

Explanation

Question 16 of 151

1

Which of the following actions should take place immediately after a security breach is reported to an information security manager?

Select one of the following:

  • A. Confirm the incident

  • B. Determine impact

  • C. Notify affected stakeholders

  • D. Isolate the incident

Explanation

Question 17 of 151

1

Which of the following benefits that the enterprise receives from employing a systematic incident management program with a formal methodology is MOST important?

Select one of the following:

  • A. A formal methodology makes incident management more flexible.

  • B. A formal methodology is more reliant on business continuity activities.

  • C. Each incident responder is able to get broad-based experience.

  • D. Evidence of due diligence supports legal and liability claims.

Explanation

Question 18 of 151

1

Which of the following is the MOST important aspect of forensic investigations that will potentially involve legal action?

Select one of the following:

  • A. The independence of the investigator

  • B. Timely intervention

  • C. Identifying the perpetrator

  • D. Chain of custody

Explanation

Question 19 of 151

1

Value at risk (VAR) can be used:

Select one of the following:

  • A. as a qualitative approach to evaluating risk.

  • B. to determine maximum probable loss over a period of time.

  • C. for risk analysis applicable only to financial organizations.

  • D. as a useful tool to expedite the assessment process.

Explanation

Question 20 of 151

1

Which of the following is the MOST cost-effective approach to test the security of a legacy application?

Select one of the following:

  • A. Identify a similar application and refer to its security weaknesses.

  • B. Recompile the application using the latest library and review the error codes.

  • C. Employ reverse engineering techniques to derive functionalities.

  • D. Conduct a vulnerability assessment to detect application weaknesses.

Explanation

Question 21 of 151

1

As part of system development, how should an organization determine which element of the confidentiality, integrity and availability (CIA) triad requires the MOST protection?

Select one of the following:

  • A. It should be based on the threat to each of the elements.

  • B. Availability is most important.

  • C. It should be based on the risk to each of the elements.

  • D. All elements are equally important.

Explanation

Question 22 of 151

1

Tightly integrated IT systems are MOST likely to be affected by:

Select one of the following:

  • A. aggregated risk.

  • B. systemic risk.

  • C. operational risk.

  • D. cascading risk.

Explanation

Question 23 of 151

1

During which phase of development is it MOST appropriate to begin assessing the risk of a new application system?

Select one of the following:

  • A. Feasibility

  • B. Design

  • C. Development

  • D. Testing

Explanation

Question 24 of 151

1

Which of the following BEST mitigates a situation where an application programmer requires access to production data?

Select one of the following:

  • A. Create a separate account for the programmer as a power user.

  • B. Log all of the programmer's activity for review by their supervisor.

  • C. Have the programmer sign a letter accepting full responsibility.

  • D. Perform regular audits of the application.

Explanation

Question 25 of 151

1

What is the MOST important objective of a postincident review?

Select one of the following:

  • A. Capture lessons learned to improve the process.

  • B. Develop a process for continuous improvement.

  • C. Develop a business case for the security program budget.

  • D. Identify new incident management tools.

Explanation

Question 26 of 151

1

Which of the following is the BEST metric for evaluating the effectiveness of an intrusion detection mechanism?

Select one of the following:

  • A. Number of attacks detected

  • B. Number of successful attacks

  • C. Ratio of false positives to false negatives

  • D. Ratio of successful to unsuccessful attacks

Explanation

Question 27 of 151

1

In a business impact analysis, the value of an information system should be based on the overall:

Select one of the following:

  • A. cost of recovery.

  • B. cost to recreate.

  • C. opportunity cost.

  • D. cost of emergency operations.

Explanation

Question 28 of 151

1

An organization has consolidated global operations. The chief information officer (CIO) has asked the chief information security officer (CISO) to develop a new organization information security strategy. Which of the following actions should be taken FIRST?

Select one of the following:

  • A. Identify the assets.

  • B. Conduct a risk assessment.

  • C. Define the scope.

  • D. Perform a business impact analysis (BIA).

Explanation

Question 29 of 151

1

Under what circumstances is it MOST appropriate to reduce control strength?

Select one of the following:

  • A. Assessed risk is below acceptable levels.

  • B. Risk cannot be determined.

  • C. The control cost is high.

  • D. The control is not effective.

Explanation

Question 30 of 151

1

What is the BEST protocol to ensure confidentiality of transmissions in a business-to-customer (B2C) financial web application?

Select one of the following:

  • A. Secure Sockets Layer (SSL)

  • B. Secure Shell (SSH)

  • C. IP Security (IPSec)

  • D. Secure/Multipurpose Internet Mail Extensions (S/MIME)

Explanation

Question 31 of 151

1

What is the PRIMARY basis for the selection and implementation of products to protect the IT infrastructure?

Select one of the following:

  • A. Regulatory requirements

  • B. Technical expert advisories

  • C. State-of-the-art technology

  • D. A risk assessment

Explanation

Question 32 of 151

1

What is the PRIMARY basis for the selection of controls and countermeasures?

Select one of the following:

  • A. Eliminating IT risk

  • B. Cost-benefit balance

  • C. Resource management

  • D. The number of assets protected

Explanation

Question 33 of 151

1

Of the following, which is the MOST effective way to measure strategic alignment of an information security program?

Select one of the following:

  • A. Track audits over time.

  • B. Evaluate incident losses.

  • C. Analyze business cases.

  • D. Interview business owners.

Explanation

Question 34 of 151

1

Which of the following factors BEST helps determine the appropriate protection level for an information asset?

Select one of the following:

  • A. The cost of acquisition and implementation of the asset

  • B. Knowledge of vulnerabilities present in the asset

  • C. The degree of exposure to known threats

  • D. The criticality of the business function supported by the asset

Explanation

Question 35 of 151

1

How does a security information and event management (SIEM) solution MOST likely detect the existence of an advanced persistent threat (APT) in its infrastructure?

Select one of the following:

  • A. Through analysis of the network traffic history

  • B. Through stateful inspection of firewall packets

  • C. Through identification of zero-day attacks

  • D. Through vulnerability assessments

Explanation

Question 36 of 151

1

The organization has decided to outsource the majority of the IT department with a vendor that is hosting servers in a foreign country. Of the following, which is the MOST critical security consideration?

Select one of the following:

  • A. Laws and regulations of the country of origin may not be enforceable in the foreign country.

  • B. A security breach notification might get delayed due to the time difference.

  • C. Additional network intrusion detection sensors should be installed, resulting in an additional cost.

  • D. The company could lose physical control over the server and be unable to monitor the physical security posture of the servers.

Explanation

Question 37 of 151

1

Which of the following ensures that newly identified security weaknesses in an operating system are mitigated in a timely fashion?

Select one of the following:

  • A. Patch management

  • B. Change management

  • C. Security baselines

  • D. Acquisition management

Explanation

Question 38 of 151

1

The effectiveness of segregation of duties may be MOST seriously compromised when:

Select one of the following:

  • A. user IDs of terminated staff remain active in application systems.

  • B. access privileges are accumulated based on previous job functions.

  • C. application role-based access deviates from the organizational hierarchies.

  • D. role mining tools are used in the access privilege review.

Explanation

Question 39 of 151

1

Why should the analysis of risk include consideration of potential impact?

Select one of the following:

  • A. Potential impact is a central element of risk.

  • B. Potential impact is related to asset value.

  • C. Potential impact affects the extent of mitigation.

  • D. Potential impact helps determine the exposure.

Explanation

Question 40 of 151

1

A password hacking tool was used to capture detailed bank account information and personal identification numbers (PINs). Upon confirming the incident, the NEXT step is to:

Select one of the following:

  • A. notify law enforcement.

  • B. start containment.

  • C. make an image copy of the media.

  • D. isolate affected servers.

Explanation

Question 41 of 151

1

Which of the following BEST assists the information security manager in identifying new threats to information security?

Select one of the following:

  • A. Performing more frequent reviews of the organization's risk factors

  • B. Developing more realistic information security risk scenarios

  • C. Understanding the flow and classification of information used by the organization

  • D. A process to monitor postincident review reports prepared by IT staff

Explanation

Question 42 of 151

1

An employee has found a suspicious file on a server. The employee thinks the file is a virus and contacts the information security manager. What is the FIRST step to take?

Select one of the following:

  • A. Contain the file.

  • B. Delete the file.

  • C. Verify whether the file is malicious.

  • D. Report the suspicious file to management.

Explanation

Question 43 of 151

1

What is the MOST important action prior to having a third party perform an attack and penetration test against an organization?

Select one of the following:

  • A. Ensure that the third party provides a demonstration on a test system.

  • B. Ensure that goals and objectives are clearly defined.

  • C. Ensure that technical staff has been briefed on what to expect.

  • D. Ensure that special backups of production servers are taken.

Explanation

Question 44 of 151

1

Which of the following metrics would be the MOST useful in measuring how well information security is monitoring violation logs?

Select one of the following:

  • A. Penetration attempts investigated

  • B. Violation log reports produced

  • C. Violation log entries

  • D. Frequency of corrective actions taken

Explanation

Question 45 of 151

1

Which of the following is the MOST important prerequisite for establishing information security management within an organization?

Select one of the following:

  • A. Senior management commitment

  • B. Information security framework

  • C. Information security organizational structure

  • D. Information security policy

Explanation

Question 46 of 151

1

A newly-hired information security manager examines the 10-year old business continuity plan and notes that the maximum tolerable outage (MTO) is much shorter than the allowable interruption window (AIW). What action should be taken as a result of this information?

Select one of the following:

  • A. Reassess the maximum tolerable outage (MTO).

  • B. Conduct a business impact assessment (BIA) and update the plan.

  • C. Increase the service delivery objective (SDO).

  • D. Take no action; maximum tolerable outage (MTO) is not related to AIW.

Explanation

Question 47 of 151

1

Which of the following change management activities would be a clear indicator that normal operational procedures require examination?

Select one of the following:

  • A. A high percentage of similar change requests

  • B. A high percentage of change request postponements

  • C. A high percentage of canceled change requests

  • D. A high percentage of emergency change requests

Explanation

Question 48 of 151

1

Which of the following purposes is for developing a security architecture as a way of meeting business objectives?

Select one of the following:

  • A. To reduce the cost of system development

  • B. To aid in strategy and policy development

  • C. To effectively manage complexity

  • D. To determine areas that will be a problem

Explanation

Question 49 of 151

1

An organization's information security strategy should be based on:

Select one of the following:

  • A. managing risk relative to business objectives.

  • B. managing risk to a zero level and minimizing insurance premiums.

  • C. avoiding occurrence of risks so that insurance is not required.

  • D. transferring most risks to insurers and saving on control costs.

Explanation

Question 50 of 151

1

Information security managers should use risk assessment techniques to:

Select one of the following:

  • A. justify selection of risk mitigation strategies.

  • B. maximize the return on investment (ROI).

  • C. provide documentation for auditors and regulators.

  • D. quantify risks that would otherwise be subjective.

Explanation

Question 51 of 151

1

A business impact analysis (BIA) is the BEST tool for determining:

Select one of the following:

  • A. total cost of ownership.

  • B. priority of restoration.

  • C. annualized loss expectancy (ALE).

  • D. residual risk.

Explanation

Question 52 of 151

1

Who is in the BEST position to determine the level of information security needed for a specific business application?

Select one of the following:

  • A. The system developer

  • B. The information security manager

  • C. The system custodian

  • D. The data owner

Explanation

Question 53 of 151

1

Proximity factors must be considered when:

Select one of the following:

  • A. conducting a business impact assessment.

  • B. conducting a table-top business continuity test.

  • C. developing disaster recovery metrics.

  • D. selecting an alternate recovery site.

Explanation

Question 54 of 151

1

The PRIMARY objective of a security steering group is to:

Select one of the following:

  • A. ensure information security covers all business functions.

  • B. ensure information security aligns with business goals.

  • C. raise information security awareness across the organization.

  • D. implement all decisions on security management across the organization.

Explanation

Question 55 of 151

1

Which of the following is the MOST important factor when designing information security architecture?

Select one of the following:

  • A. Technical platform interfaces

  • B. Scalability of the network

  • C. Development methodologies

  • D. Stakeholder requirements

Explanation

Question 56 of 151

1

Which of the following factors is MOST important for the successful implementation of an organization's information security program?

Select one of the following:

  • A. Senior management support

  • B. Budget for security activities

  • C. Regular vulnerability assessments

  • D. Knowledgeable security administrators

Explanation

Question 57 of 151

1

Where should an intranet server generally be placed?

Select one of the following:

  • A. On the internal network

  • B. On the firewall server

  • C. On the external router

  • D. On the primary domain controller

Explanation

Question 58 of 151

1

What action should be taken in regards to data classification requirements before engaging outsourced providers?

Select one of the following:

  • A. Ensure the data classification requirements are compatible with the provider's own classification.

  • B. Ensure the data classification requirements are communicated to the provider.

  • C. Ensure the data classification requirements exceed those of the outsourcer.

  • D. Ensure the data classification requirements are stated in the contract.

Explanation

Question 59 of 151

1

What does a network vulnerability assessment intend to identify?

Select one of the following:

  • A. 0-day vulnerabilities

  • B. Malicious software and spyware

  • C. Security design flaws

  • D. Misconfiguration and missing updates

Explanation

Question 60 of 151

1

What is the MOST important reason for formally documenting security procedures?

Select one of the following:

  • A. Ensure processes are repeatable and sustainable.

  • B. Ensure alignment with business objectives.

  • C. Ensure auditability by regulatory agencies.

  • D. Ensure objective criteria for the application of metrics.

Explanation

Question 61 of 151

1

Which of the following authentication methods prevents authentication replay?

Select one of the following:

  • A. Password hash implementation

  • B. Challenge/response mechanism

  • C. Wired Equivalent Privacy (WEP) encryption usage

  • D. HTTP Basic Authentication

Explanation

Question 62 of 151

1

What is the PRIMARY objective of a post-event review in incident response?

Select one of the following:

  • A. Adjust budget provisioning

  • B. Preserve forensic data

  • C. Improve the response process

  • D. Ensure the incident is fully documented

Explanation

Question 63 of 151

1

Which of the following choices BEST justifies an information security program?

Select one of the following:

  • A. The impact on critical IT assets

  • B. A detailed business case

  • C. Steering committee approval

  • D. User acceptance

Explanation

Question 64 of 151

1

The MOST important basis for developing a business case is the:

Select one of the following:

  • A. risk that will be addressed.

  • B. financial analysis of benefits.

  • C. alignment with organizational objectives.

  • D. feasibility and value proposition.

Explanation

Question 65 of 151

1

Which of the following is the MOST important item to consider when evaluating products to monitor security across the enterprise?

Select one of the following:

  • A. Ease of installation

  • B. Product documentation

  • C. Available support

  • D. System overhead

Explanation

Question 66 of 151

1

Which of the following is the MOST important element to ensure the success of a disaster recovery test at a vendor-provided hot site?

Select one of the following:

  • A. Tests are scheduled on weekends

  • B. Network IP addresses are predefined

  • C. Equipment at the hot site is identical

  • D. Business management actively participates

Explanation

Question 67 of 151

1

Which of the following is the MOST appropriate individual to ensure that new exposures have not been introduced into an existing application during the change management process?

Select one of the following:

  • A. System analyst

  • B. System user

  • C. Operations manager

  • D. Data security officer

Explanation

Question 68 of 151

1

The MOST timely and effective approach to detecting nontechnical security violations in an organization is:

Select one of the following:

  • A. the development of organizationwide communication channels.

  • B. periodic third-party auditing of incident reporting logs.

  • C. an automated policy compliance monitoring system.

  • D. deployment of suggestion boxes throughout the organization.

Explanation

Question 69 of 151

1

Laws and regulations should be addressed by the information security manager:

Select one of the following:

  • A. to the extent that they impact the enterprise.

  • B. by implementing international standards.

  • C. by developing policies that address the requirements.

  • D. to ensure that guidelines meet the requirements.

Explanation

Question 70 of 151

1

Which of the following is the MOST likely to change an organization's culture to one that is more security conscious?

Select one of the following:

  • A. Adequate security policies and procedures

  • B. Periodic compliance reviews

  • C. Security steering committees

  • D. Security awareness campaigns

Explanation

Question 71 of 151

1

When an organization is using an automated tool to manage and house its business continuity plans, which of the following is the PRIMARY concern?

Select one of the following:

  • A. Ensuring accessibility should a disaster occur

  • B. Versioning control as plans are modified

  • C. Broken hyperlinks to resources stored elsewhere

  • D. Tracking changes in personnel and plan assets

Explanation

Question 72 of 151

1

During an audit, an information security manager discovered that sales representatives are sending sensitive customer information through email messages. Which of the following is the BEST course of action to address the issue?

Select one of the following:

  • A. Review the finding with the sales manager to evaluate the risk and impact.

  • B. Report the issue to senior management immediately.

  • C. Request that the sales representatives stop emailing sensitive information.

  • D. Provide security awareness training to the sales representatives.

Explanation

Question 73 of 151

1

An organization has verified that its customer information was recently exposed. Which of the following is the FIRST step a security manager should take in this situation?

Select one of the following:

  • A. Inform senior management.

  • B. Determine the extent of the compromise.

  • C. Report the incident to the authorities.

  • D. Communicate with the affected customers.

Explanation

Question 74 of 151

1

After a risk assessment, it is determined that the cost to mitigate the risk is much greater than the benefit to be derived. The information security manager should recommend to business management that the risk be:

Select one of the following:

  • A. transferred.

  • B. treated.

  • C. accepted.

  • D. terminated.

Explanation

Question 75 of 151

1

Security risk assessments are MOST cost-effective to a software development organization when they are performed:

Select one of the following:

  • A. before system development begins.

  • B. at system deployment.

  • C. before developing a business case.

  • D. at each stage of the software development life cycle (SDLC).

Explanation

Question 76 of 151

1

What is the MOST effective way to ensure network users are aware of their responsibilities to comply with an organization's security requirements?

Select one of the following:

  • A. Logon banners displayed at every logon

  • B. Periodic security-related email messages

  • C. An intranet web site for information security

  • D. Circulating the information security policy

Explanation

Question 77 of 151

1

An information security manager has implemented procedures for monitoring specific activities on the network. The system administrator has been trained to analyze the network events, take appropriate action and provide reports to the information security manager. What additional monitoring should be implemented to give a more accurate, risk-based view of network activity?

Select one of the following:

  • A. The system administrator should be monitored by a separate reviewer.

  • B. All activity on the network should be monitored.

  • C. No additional monitoring is needed in this situation.

  • D. Monitoring should be done only by the information security manager.

Explanation

Question 78 of 151

1

Which of the following will BEST protect an organization from internal security attacks?

Select one of the following:

  • A. Static IP addressing

  • B. Internal address translation

  • C. Prospective employee background checks

  • D. Employee awareness certification program

Explanation

Question 79 of 151

1

Which of the following is in the BEST position to provide information on regulatory and legal compliance requirements that have an effect on information security?

Select one of the following:

  • A. Corporate legal officer

  • B. Enterprise risk manager

  • C. Compliance officer

  • D. Affected departments

Explanation

Question 80 of 151

1

Which of the following terms and conditions represent a significant deficiency if included in a commercial hot site contract?

Select one of the following:

  • A. A hot site facility will be shared in multiple disaster declarations

  • B. All equipment is provided "at time of disaster, not on floor"

  • C. The facility is subject to a "first-come, first-served" policy

  • D. Equipment may be substituted with equivalent models

Explanation

Question 81 of 151

1

Which of the following situations would be the MOST concern to a security manager?

Select one of the following:

  • A. Audit logs are not enabled on a production server

  • B. The logon ID for a terminated systems analyst still exists on the system

  • C. The help desk has received numerous results of users receiving phishing emails

  • D. A Trojan was found to be installed on a system administrator's laptop

Explanation

Question 82 of 151

1

Which of the following criteria is the MOST essential for operational metrics?

Select one of the following:

  • A. Timeliness of the reporting

  • B. Relevance to the recipient

  • C. Accuracy of the measurement

  • D. The cost of obtaining the metrics

Explanation

Question 83 of 151

1

Which of the following should be included in a good privacy statement?

Select one of the following:

  • A. A notification of liability on accuracy of information

  • B. A notification that information will be encrypted

  • C. A statement of what the company will do with information it collects

  • D. A description of the information classification process

Explanation

Question 84 of 151

1

Which of the following is a preventive measure?

Select one of the following:

  • A. A warning banner

  • B. Audit trails

  • C. An access control

  • D. An alarm system

Explanation

Question 85 of 151

1

Which of the following is MOST essential for a risk management program to be effective?

Select one of the following:

  • A. Flexible security budget

  • B. Sound risk baseline

  • C. Detection of new risk

  • D. Accurate risk reporting

Explanation

Question 86 of 151

1

When designing information security standards for an enterprise, the information security manager should require that an extranet server be placed:

Select one of the following:

  • A. outside the firewall.

  • B. on the firewall server.

  • C. on a screened subnet.

  • D. on the external router.

Explanation

Question 87 of 151

1

Assuming that the value of information assets is known, which of the following gives the information security manager the MOST objective basis for determining that the information security program is delivering value?

Select one of the following:

  • A. Number of controls

  • B. Cost of achieving control objectives

  • C. Effectiveness of controls

  • D. Test results of controls

Explanation

Question 88 of 151

1

Which of the following is PRIMARILY related to the emergence of governance, risk and compliance (GRC)?

Select one of the following:

  • A. The increasing need for controls

  • B. The policy development process

  • C. The integration of assurance-related activities

  • D. A model for information security program development

Explanation

Question 89 of 151

1

What is the BEST way to determine if an anomaly-based intrusion detection system (IDS) is properly installed?

Select one of the following:

  • A. Simulate an attack and review IDS performance.

  • B. Use a honeypot to check for unusual activity.

  • C. Audit the configuration of the IDS.

  • D. Benchmark the IDS against a peer site.

Explanation

Question 90 of 151

1

What responsibility do data owners normally have?

Select one of the following:

  • A. Applying emergency changes to application data

  • B. Administering security over database records

  • C. Migrating application code changes to production

  • D. Determining the level of application security required

Explanation

Question 91 of 151

1

Which of the following would be the MOST relevant factor when defining the information classification policy?

Select one of the following:

  • A. Quantity of information

  • B. Available IT infrastructure

  • C. Benchmarking

  • D. Requirements of data owners

Explanation

Question 92 of 151

1

When creating a forensic image of a hard drive, which of the following should be the FIRST step?

Select one of the following:

  • A. Identify a recognized forensics software tool to create the image.

  • B. Establish a chain of custody log.

  • C. Connect the hard drive to a write blocker.

  • D. Generate a cryptographic hash of the hard drive contents.

Explanation

Question 93 of 151

1

Which of the following actions is MOST important when a server is infected with a virus?

Select one of the following:

  • A. Isolate the infected server(s) from the network.

  • B. Identify all potential damage caused by the infection.

  • C. Ensure that the virus database files are current.

  • D. Establish security weaknesses in the firewall.

Explanation

Question 94 of 151

1

An organization's information security manager is planning the structure of the Information Security Steering Committee. Which of the following groups should the manager invite?

Select one of the following:

  • A. External audit and network penetration testers

  • B. Board of directors and the organization's regulators

  • C. External trade union representatives and key security vendors

  • D. Leadership from IT, human resources and the sales department

Explanation

Question 95 of 151

1

Which of the following will the data backup policy contain?

Select one of the following:

  • A. Criteria for data backup

  • B. Personnel responsible for backup

  • C. A data backup schedule

  • D. A list of systems to be backed up

Explanation

Question 96 of 151

1

In following up on a security incident, the system administrator is to copy data from one hard disk to another. From a forensic perspective, which of the following tasks must be ensured?

Select one of the following:

  • A. Copy to the same disk model as the original.

  • B. Make a dual backup of the original disk.

  • C. Keep the digital hash from both hard disks.

  • D. Perform a restoration test after replication.

Explanation

Question 97 of 151

1

What is the BEST way to ensure users comply with organizational security requirements for password complexity?

Select one of the following:

  • A. Include password construction requirements in the security standards

  • B. Require each user to acknowledge the password requirements

  • C. Implement strict penalties for user noncompliance

  • D. Enable system-enforced password configuration

Explanation

Question 98 of 151

1

Which of the following is the MOST important step when an employee is transferred to a different function?

Select one of the following:

  • A. Reviewing and modifying access rights

  • B. Assigning new security responsibilities

  • C. Conducting specific training for the new role

  • D. Knowledge of security weaknesses in last department

Explanation

Question 99 of 151

1

What is the BEST approach to implement adequate segregation of duties in business critical applications, where shared access to elevated privileges by a small group is necessary?

Select one of the following:

  • A. Ensure access to individual functions can be granted to individual users only.

  • B. Implement role-based access control in the application.

  • C. Enforce manual procedures ensuring separation of conflicting duties.

  • D. Create service accounts that can only be used by authorized team members.

Explanation

Question 100 of 151

1

Which of the following would BEST prepare an information security manager for regulatory reviews?

Select one of the following:

  • A. Assign an information security administrator as regulatory liaison.

  • B. Perform self-assessments using regulatory guidelines and reports.

  • C. Assess previous regulatory reports with process owners input.

  • D. Ensure all regulatory inquiries are sanctioned by the legal department.

Explanation

Question 101 of 151

1

When electronically stored information is requested during a fraud investigation, which of the following should be the FIRST priority?

Select one of the following:

  • A. Assigning responsibility for acquiring the data

  • B. Locating the data and preserving the integrity of the data

  • C. Creating a forensically sound image

  • D. Issuing a litigation hold to all affected parties

Explanation

Question 102 of 151

1

Which of the following should a successful information security management program use to determine the amount of resources devoted to mitigating exposures?

Select one of the following:

  • A. Risk analysis results

  • B. Audit report findings

  • C. Penetration test results

  • D. Amount of IT budget available

Explanation

Question 103 of 151

1

Which of the following is the MOST usable deliverable of an information security risk analysis?

Select one of the following:

  • A. Business impact analysis (BIA) report

  • B. List of action items to mitigate risk

  • C. Assignment of risks to process owners

  • D. Quantification of organizational risk

Explanation

Question 104 of 151

1

Which of the following is the GREATEST success factor for effectively managing information security?

Select one of the following:

  • A. An adequate budget

  • B. Senior level authority

  • C. A robust technology

  • D. Effective business relationships

Explanation

Question 105 of 151

1

Simple Network Management Protocol v2 (SNMP v2) is used frequently to monitor networks. Which of the following vulnerabilities does it always introduce?

Select one of the following:

  • A. Remote buffer overflow

  • B. Cross site scripting

  • C. Clear text authentication

  • D. Man-in-the-middle attack

Explanation

Question 106 of 151

1

Which of the following BEST accomplishes secure customer use of an e-commerce application?

Select one of the following:

  • A. Data encryption

  • B. Digital signatures

  • C. Strong passwords

  • D. Two-factor authentication

Explanation

Question 107 of 151

1

The MOST effective approach to address issues that arise between IT management, business units and security management when implementing a new security strategy is for the information security manager to:

Select one of the following:

  • A. escalate issues to an external third party for resolution.

  • B. ensure that senior management provide authority for security to address the issues.

  • C. insist that managers or units not in agreement with the security solution accept the risk.

  • D. refer the issues to senior management along with any security recommendations.

Explanation

Question 108 of 151

1

Which of the following provides the BEST confirmation that the business continuity/disaster recovery plan objectives have been achieved?

Select one of the following:

  • A. The recovery time objective (RTO) was not exceeded during testing

  • B. Objective testing of the business continuity/disaster recovery plan has been carried out consistently

  • C. The recovery point objective (RPO) was proved inadequate by disaster recovery plan testing

  • D. Information assets have been valued and assigned to owners per the business continuity plan/disaster recovery plan

Explanation

Question 109 of 151

1

Why should an incident management team conduct a postincident review?

Select one of the following:

  • A. To identify relevant electronic evidence

  • B. To identify lessons learned

  • C. To identify the hacker's identity

  • D. To identify affected areas

Explanation

Question 110 of 151

1

The BEST approach to secure approval for information security expenditures is to:

Select one of the following:

  • A. conduct a cost-benefit analysis.

  • B. develop a business case.

  • C. calculate return on investment (ROI).

  • D. evaluate loss history.

Explanation

Question 111 of 151

1

Which of the following attacks is BEST mitigated by utilizing strong passwords?

Select one of the following:

  • A. Man-in-the-middle attack

  • B. Brute force attack

  • C. Remote buffer overflow

  • D. Root kit

Explanation

Question 112 of 151

1

The requirement for due diligence is MOST closely associated with which of the following?

Select one of the following:

  • A. The right to audit

  • B. Service level agreements (SLAs)

  • C. Appropriate standard of care

  • D. Periodic security reviews

Explanation

Question 113 of 151

1

Which of the following is the MOST important element of an information security strategy?

Select one of the following:

  • A. Defined objectives

  • B. Time frames for delivery

  • C. Adoption of a control framework

  • D. Complete policies

Explanation

Question 114 of 151

1

Which of the following is the MOST important action to take when engaging third-party consultants to conduct an attack and penetration test?

Select one of the following:

  • A. Request a list of the software to be used

  • B. Provide clear directions to IT staff

  • C. Monitor intrusion detection system (IDS) and firewall logs closely

  • D. Establish clear rules of engagement

Explanation

Question 115 of 151

1

Who in an organization has the responsibility for classifying information?

Select one of the following:

  • A. Data custodian

  • B. Database administrator

  • C. Information security officer

  • D. Data owner

Explanation

Question 116 of 151

1

The information security manager should treat regulatory compliance requirements as:

Select one of the following:

  • A. an organizational mandate.

  • B. a risk management priority.

  • C. a purely operational issue.

  • D. just another risk.

Explanation

Question 117 of 151

1

After obtaining commitment from senior management, which of the following should be completed NEXT when establishing an information security program?

Select one of the following:

  • A. Define security metrics

  • B. Conduct a risk assessment

  • C. Perform a gap analysis

  • D. Procure security tools

Explanation

Question 118 of 151

1

When considering outsourcing services, at what point should information security become involved in the vendor management process?

Select one of the following:

  • A. During contract negotiation

  • B. Upon request for assistance from the business unit

  • C. When requirements are being established

  • D. When a security incident occurs

Explanation

Question 119 of 151

1

Which of the following is an example of a corrective control?

Select one of the following:

  • A. Diverting incoming traffic as a response to a denial of service (DoS) attack

  • B. Filtering network traffic

  • C. Examining inbound network traffic for viruses

  • D. Logging inbound network traffic

Explanation

Question 120 of 151

1

Which of the following actions should be taken when an information security manager discovers that a hacker is footprinting the network perimeter?

Select one of the following:

  • A. Reboot the border router connected to the firewall

  • B. Check IDS logs and monitor for any active attacks

  • C. Update IDS software to the latest available version

  • D. Enable server trace logging on the DMZ segment

Explanation

Question 121 of 151

1

Which of the following steps should be performed FIRST in the risk assessment process?

Select one of the following:

  • A. Staff interviews

  • B. Threat identification

  • C. Asset identification and valuation

  • D. Determination of the likelihood of identified risks

Explanation

Question 122 of 151

1

Which of the following is the BEST basis for determining the criticality and sensitivity of information assets?

Select one of the following:

  • A. A threat assessment

  • B. A vulnerability assessment

  • C. A resource dependency assessment

  • D. An impact assessment

Explanation

Question 123 of 151

1

In which of the following system development life cycle (SDLC) phases are access control and encryption algorithms chosen?

Select one of the following:

  • A. Procedural design

  • B. Architectural design

  • C. System design specifications

  • D. Software development

Explanation

Question 124 of 151

1

An IS manager has decided to implement a security system to monitor access to the Internet and prevent access to numerous sites. Immediately upon installation, employees flood the IT helpdesk with complaints of being unable to perform business functions on Internet sites. This is an example of:

Select one of the following:

  • A. conflicting security controls with organizational needs.

  • B. strong protection of information resources.

  • C. implementing appropriate controls to reduce risk.

  • D. proving information security's protective abilities.

Explanation

Question 125 of 151

1

Which of the following is the BEST indicator that security awareness training has been effective?

Select one of the following:

  • A. Employees sign to acknowledge the security policy

  • B. More incidents are being reported

  • C. A majority of employees have completed training

  • D. No incidents have been reported in three months

Explanation

Question 126 of 151

1

Which of the following BEST supports the principle of security proportionality?

Select one of the following:

  • A. Release management

  • B. Ownership schema

  • C. Resource dependency analysis

  • D. Asset classification

Explanation

Question 127 of 151

1

Which of the following types of information would the information security manager expect to have the LOWEST level of security protection in a publicly traded, multinational enterprise?

Select one of the following:

  • A. Strategic business plan

  • B. Upcoming financial results

  • C. Customer personal information

  • D. Previous financial results

Explanation

Question 128 of 151

1

Alignment of an information security program to business objectives is BEST achieved through:

Select one of the following:

  • A. senior management directing the information security program.

  • B. periodic risk analysis and treatment.

  • C. a security steering committee with representatives from all business functions.

  • D. regular security audits and ongoing monitoring.

Explanation

Question 129 of 151

1

What activity should the information security manager perform FIRST after finding that compliance with a set of standards is weak?

Select one of the following:

  • A. Initiate the exception process.

  • B. Modify policy to address the risk.

  • C. Increase compliance enforcement.

  • D. Perform a risk assessment.

Explanation

Question 130 of 151

1

What activity needs to be performed for previously accepted risk?

Select one of the following:

  • A. Risk should be reassessed periodically because risk changes over time.

  • B. Accepted risk should be flagged to avoid future reassessment efforts.

  • C. Risk should be avoided next time to optimize the risk profile.

  • D. Risk should be removed from the risk log after it is accepted.

Explanation

Question 131 of 151

1

Inherent control strength is PRIMARILY a function of which of the following?

Select one of the following:

  • A. Implementation

  • B. Design

  • C. Testing

  • D. Policy

Explanation

Question 132 of 151

1

Which of the following is MOST effective in preventing weaknesses from being introduced into existing production systems?

Select one of the following:

  • A. Patch management

  • B. Change management

  • C. Security baselines

  • D. Virus detection

Explanation

Question 133 of 151

1

Which of the following actions should the information security manager take FIRST on finding that current controls are not sufficient to prevent a serious compromise?

Select one of the following:

  • A. Strengthen existing controls.

  • B. Reassess the risk.

  • C. Set new control objectives.

  • D. Modify security baselines.

Explanation

Question 134 of 151

1

To reduce the possibility of service interruptions, an entity enters into contracts with multiple Internet service providers (ISPs). Which of the following would be the MOST important item to include?

Select one of the following:

  • A. Service level agreements (SLAs)

  • B. Right-to-audit clause

  • C. Intrusion detection system (IDS) services

  • D. Spam filtering services

Explanation

Question 135 of 151

1

Which of the following would be the GREATEST challenge when developing a standard awareness training program for a global organization?

Select one of the following:

  • A. Technical input requirements for IT security staff

  • B. Evaluating training program effectiveness

  • C. A diverse culture and varied technical abilities of end users

  • D. Availability of users either on weekends or after office hours

Explanation

Question 136 of 151

1

Which of the following is the MOST appropriate method of ensuring password strength in a large organization?

Select one of the following:

  • A. Attempt to reset several passwords to weaker values

  • B. Install code to capture passwords for periodic audit

  • C. Sample a subset of users and request their passwords for review

  • D. Install strong password settings on each platform

Explanation

Question 137 of 151

1

Which of the following is the BEST approach to dealing with inadequate funding of the security program?

Select one of the following:

  • A. Eliminate low-priority security services.

  • B. Require management to accept the increased risk.

  • C. Prioritize risk mitigation and educate management.

  • D. Reduce monitoring and compliance enforcement activities.

Explanation

Question 138 of 151

1

Which of the following is the MOST critical success factor of an information security program?

Select one of the following:

  • A. Developing information security policies and procedures

  • B. Senior management commitment

  • C. Conducting security training and awareness for all users

  • D. Establishing an information security management system

Explanation

Question 139 of 151

1

Phishing is BEST mitigated by which of the following?

Select one of the following:

  • A. Security monitoring software

  • B. Encryption

  • C. Two-factor authentication

  • D. User awareness

Explanation

Question 140 of 151

1

Which of the following is the BEST way to ensure that a corporate network is adequately secured against external attack?

Select one of the following:

  • A. Utilize an intrusion detection system.

  • B. Establish minimum security baselines.

  • C. Implement vendor recommended settings.

  • D. Perform periodic penetration testing.

Explanation

Question 141 of 151

1

Which of the following should be included in an annual information security budget that is submitted for management approval?

Select one of the following:

  • A. A cost-benefit analysis of budgeted resources

  • B. All of the resources that are recommended by the business

  • C. Total cost of ownership (TCO)

  • D. Baseline comparisons

Explanation

Question 142 of 151

1

The MOST important outcome of aligning information security governance with corporate governance is to:

Select one of the following:

  • A. show that information security understands the rules.

  • B. provide regulatory compliance.

  • C. maximize the cost-effectiveness of controls.

  • D. minimize the number of rules and regulations required.

Explanation

Question 143 of 151

1

Which of the following defines minimum standards for securing the technical infrastructure?

Select one of the following:

  • A. Information security strategy

  • B. Information security guidelines

  • C. Information security model

  • D. Information security architecture

Explanation

Question 144 of 151

1

Which of the following would be MOST relevant to include in a cost-benefit analysis of a two-factor authentication system?

Select one of the following:

  • A. Annual loss expectancy (ALE) of incidents

  • B. Frequency of incidents

  • C. Total cost of ownership (TCO)

  • D. Approved budget for the project

Explanation

Question 145 of 151

1

In what circumstances should mandatory access controls (MAC) be used?

Select one of the following:

  • A. When the organization has a high risk tolerance

  • B. When delegation of rights is contrary to policy

  • C. When the control policy specifies continuous oversight

  • D. When access is permitted, unless explicitly denied

Explanation

Question 146 of 151

1

Which one of the following network protocols is secure?

Select one of the following:

  • A. Simple Mail Transfer Protocol (SMTP)

  • B. File Transfer Protocol (FTP)

  • C. Post Office Protocol (POP3)

  • D. Simple Network Management Protocol (SNMP v3)

Explanation

Question 147 of 151

1

Which of the following choices should be assessed after the likelihood of a loss event has been determined?

Select one of the following:

  • A. The magnitude of impact

  • B. Risk tolerance

  • C. The replacement cost of assets

  • D. The book value of assets

Explanation

Question 148 of 151

1

An outsource service provider must handle sensitive customer information. Which of the following is MOST important for an information security manager to know?

Select one of the following:

  • A. Security in storage and transmission of sensitive data

  • B. Provider's level of compliance with industry standards

  • C. Security technologies in place at the facility

  • D. Results of the latest independent security review

Explanation

Question 149 of 151

1

What is the result of segmenting a highly sensitive database?

Select one of the following:

  • A. It reduces threat.

  • B. It reduces criticality.

  • C. It reduces sensitivity.

  • D. It reduces exposure.

Explanation

Question 150 of 151

1

When establishing a new incident management team whose members will serve on a part-time basis, which of the following means of training is MOST effective?

Select one of the following:

  • A. Formal training

  • B. Mentoring

  • C. On-the-job training

  • D. Induction

Explanation

Question 151 of 151

1

Three employees reported the theft or loss of their laptops while on business trips. The FIRST course of action for the security manager is to:

Select one of the following:

  • A. assess the impact of the loss and determine mitigating steps.

  • B. communicate the best practices in protecting laptops to all laptop users.

  • C. instruct the erring employees to pay a penalty for the lost laptops.

  • D. recommend that management report the incident to the police and file for insurance.

Explanation

Previous
Next