Which of the following is MOST important to the successful promotion of good security management practices?
A. Security metrics
B. Security baselines
C. Management support
D. Periodic training
Which of the following security mechanisms is MOST effective in protecting classified data that have been encrypted to prevent disclosure and transmission outside the organization's network?
A. Configuration of firewalls
B. Strength of encryption algorithms
C. Authentication within application
D. Safeguards over keys
The PRIMARY objective of a vulnerability assessment is to:
A. reduce risk to the business.
B. ensure compliance with security policies.
C. provide assurance to management.
D. measure efficiency of services provided.
Which of the following is the GREATEST concern for an organization in which there is a widespread use of mobile devices?
A. There is an undue reliance on public networks.
B. Batteries require constant recharges.
C. There is a lack of operating system standardization.
D. Mobile devices can be easily lost or stolen.
The director of auditing has recommended a specific information security monitoring solution to the information security manager. What should the information security manager do FIRST?
A. Obtain comparative pricing bids and complete the transaction with the vendor offering the best deal.
B. Add the purchase to the budget during the next budget preparation cycle to account for costs.
C. Perform an assessment to determine correlation with business goals and objectives.
D. Form a project team to plan the implementation.
Which of the following is the PRIMARY reason to change policies during program development?
A. The policies must comply with new regulatory and legal mandates.
B. Appropriate security baselines are no longer set in the policies.
C. The policies no longer reflect management intent and direction.
D. Employees consistently ignore the policies.
Which of the following is the MOST effective way to ensure that noncompliance to information security standards is resolved?
A. Periodic audits of noncompliant areas
B. An ongoing vulnerability scanning program
C. Annual security awareness training
D. Regular reports to executive management
What is the PRIMARY purpose of installing an intrusion detection system (IDS)?
A. To identify weaknesses in network security
B. To identify patterns of suspicious access
C. To identify how an attack was launched on the network
D. To identify potential attacks on the internal network
Senior management commitment and support for information security can BEST be obtained through presentations that:
A. use illustrative examples of successful attacks.
B. explain the technical risks to the organization.
C. evaluate the organization against best security practices.
D. tie security risks to key business objectives.
The recovery time objective (RTO) is reached at which of the following milestones?
A. Disaster declaration
B. Recovery of the backups
C. Restoration of the system
D. Return to business as usual processing
Which of the following approaches would be BEST to address significant system vulnerabilities that were discovered during a network scan?
A. All significant vulnerabilities must be mitigated in a timely fashion.
B. Treatment should be based on threat, impact and cost considerations.
C. Compensatory controls must be implemented for major vulnerabilities.
D. Mitigation options should be proposed for management approval.
How does knowledge of risk appetite help to increase security control effectiveness?
A. It shows senior management that you understand their needs.
B. It provides a basis for redistributing resources to mitigate risk outside the risk tolerance.
C. It requires continuous monitoring because the entire risk environment is constantly changing.
D. It facilitates communication with management about the importance of security.
Which of the following is the MOST important prerequisite to undertaking asset classification?
A. Threat analysis
B. Impact assessment
C. Controls evaluation
D. Penetration testing
What is the PRIMARY objective of a risk management program?
A. Minimize inherent risk.
B. Eliminate business risk.
C. Implement effective controls.
D. Reduce residual risk to acceptable levels.
Where should resource requirements for information security initially be identified?
A. In policies
B. In the architecture
C. In the strategy
D. In procedures
Which of the following actions should take place immediately after a security breach is reported to an information security manager?
A. Confirm the incident
B. Determine impact
C. Notify affected stakeholders
D. Isolate the incident
Which of the following benefits that the enterprise receives from employing a systematic incident management program with a formal methodology is MOST important?
A. A formal methodology makes incident management more flexible.
B. A formal methodology is more reliant on business continuity activities.
C. Each incident responder is able to get broad-based experience.
D. Evidence of due diligence supports legal and liability claims.
Which of the following is the MOST important aspect of forensic investigations that will potentially involve legal action?
A. The independence of the investigator
B. Timely intervention
C. Identifying the perpetrator
D. Chain of custody
Value at risk (VAR) can be used:
A. as a qualitative approach to evaluating risk.
B. to determine maximum probable loss over a period of time.
C. for risk analysis applicable only to financial organizations.
D. as a useful tool to expedite the assessment process.
Which of the following is the MOST cost-effective approach to test the security of a legacy application?
A. Identify a similar application and refer to its security weaknesses.
B. Recompile the application using the latest library and review the error codes.
C. Employ reverse engineering techniques to derive functionalities.
D. Conduct a vulnerability assessment to detect application weaknesses.
As part of system development, how should an organization determine which element of the confidentiality, integrity and availability (CIA) triad requires the MOST protection?
A. It should be based on the threat to each of the elements.
B. Availability is most important.
C. It should be based on the risk to each of the elements.
D. All elements are equally important.
Tightly integrated IT systems are MOST likely to be affected by:
A. aggregated risk.
B. systemic risk.
C. operational risk.
D. cascading risk.
During which phase of development is it MOST appropriate to begin assessing the risk of a new application system?
A. Feasibility
B. Design
C. Development
D. Testing
Which of the following BEST mitigates a situation where an application programmer requires access to production data?
A. Create a separate account for the programmer as a power user.
B. Log all of the programmer's activity for review by their supervisor.
C. Have the programmer sign a letter accepting full responsibility.
D. Perform regular audits of the application.
What is the MOST important objective of a postincident review?
A. Capture lessons learned to improve the process.
B. Develop a process for continuous improvement.
C. Develop a business case for the security program budget.
D. Identify new incident management tools.
Which of the following is the BEST metric for evaluating the effectiveness of an intrusion detection mechanism?
A. Number of attacks detected
B. Number of successful attacks
C. Ratio of false positives to false negatives
D. Ratio of successful to unsuccessful attacks
In a business impact analysis, the value of an information system should be based on the overall:
A. cost of recovery.
B. cost to recreate.
C. opportunity cost.
D. cost of emergency operations.
An organization has consolidated global operations. The chief information officer (CIO) has asked the chief information security officer (CISO) to develop a new organization information security strategy. Which of the following actions should be taken FIRST?
A. Identify the assets.
B. Conduct a risk assessment.
C. Define the scope.
D. Perform a business impact analysis (BIA).
Under what circumstances is it MOST appropriate to reduce control strength?
A. Assessed risk is below acceptable levels.
B. Risk cannot be determined.
C. The control cost is high.
D. The control is not effective.
What is the BEST protocol to ensure confidentiality of transmissions in a business-to-customer (B2C) financial web application?
A. Secure Sockets Layer (SSL)
B. Secure Shell (SSH)
C. IP Security (IPSec)
D. Secure/Multipurpose Internet Mail Extensions (S/MIME)
What is the PRIMARY basis for the selection and implementation of products to protect the IT infrastructure?
A. Regulatory requirements
B. Technical expert advisories
C. State-of-the-art technology
D. A risk assessment
What is the PRIMARY basis for the selection of controls and countermeasures?
A. Eliminating IT risk
B. Cost-benefit balance
C. Resource management
D. The number of assets protected
Of the following, which is the MOST effective way to measure strategic alignment of an information security program?
A. Track audits over time.
B. Evaluate incident losses.
C. Analyze business cases.
D. Interview business owners.
Which of the following factors BEST helps determine the appropriate protection level for an information asset?
A. The cost of acquisition and implementation of the asset
B. Knowledge of vulnerabilities present in the asset
C. The degree of exposure to known threats
D. The criticality of the business function supported by the asset
How does a security information and event management (SIEM) solution MOST likely detect the existence of an advanced persistent threat (APT) in its infrastructure?
A. Through analysis of the network traffic history
B. Through stateful inspection of firewall packets
C. Through identification of zero-day attacks
D. Through vulnerability assessments
The organization has decided to outsource the majority of the IT department with a vendor that is hosting servers in a foreign country. Of the following, which is the MOST critical security consideration?
A. Laws and regulations of the country of origin may not be enforceable in the foreign country.
B. A security breach notification might get delayed due to the time difference.
C. Additional network intrusion detection sensors should be installed, resulting in an additional cost.
D. The company could lose physical control over the server and be unable to monitor the physical security posture of the servers.
Which of the following ensures that newly identified security weaknesses in an operating system are mitigated in a timely fashion?
A. Patch management
B. Change management
C. Security baselines
D. Acquisition management
The effectiveness of segregation of duties may be MOST seriously compromised when:
A. user IDs of terminated staff remain active in application systems.
B. access privileges are accumulated based on previous job functions.
C. application role-based access deviates from the organizational hierarchies.
D. role mining tools are used in the access privilege review.
Why should the analysis of risk include consideration of potential impact?
A. Potential impact is a central element of risk.
B. Potential impact is related to asset value.
C. Potential impact affects the extent of mitigation.
D. Potential impact helps determine the exposure.
A password hacking tool was used to capture detailed bank account information and personal identification numbers (PINs). Upon confirming the incident, the NEXT step is to:
A. notify law enforcement.
B. start containment.
C. make an image copy of the media.
D. isolate affected servers.
Which of the following BEST assists the information security manager in identifying new threats to information security?
A. Performing more frequent reviews of the organization's risk factors
B. Developing more realistic information security risk scenarios
C. Understanding the flow and classification of information used by the organization
D. A process to monitor postincident review reports prepared by IT staff
An employee has found a suspicious file on a server. The employee thinks the file is a virus and contacts the information security manager. What is the FIRST step to take?
A. Contain the file.
B. Delete the file.
C. Verify whether the file is malicious.
D. Report the suspicious file to management.
What is the MOST important action prior to having a third party perform an attack and penetration test against an organization?
A. Ensure that the third party provides a demonstration on a test system.
B. Ensure that goals and objectives are clearly defined.
C. Ensure that technical staff has been briefed on what to expect.
D. Ensure that special backups of production servers are taken.
Which of the following metrics would be the MOST useful in measuring how well information security is monitoring violation logs?
A. Penetration attempts investigated
B. Violation log reports produced
C. Violation log entries
D. Frequency of corrective actions taken
Which of the following is the MOST important prerequisite for establishing information security management within an organization?
A. Senior management commitment
B. Information security framework
C. Information security organizational structure
D. Information security policy
A newly-hired information security manager examines the 10-year old business continuity plan and notes that the maximum tolerable outage (MTO) is much shorter than the allowable interruption window (AIW). What action should be taken as a result of this information?
A. Reassess the maximum tolerable outage (MTO).
B. Conduct a business impact assessment (BIA) and update the plan.
C. Increase the service delivery objective (SDO).
D. Take no action; maximum tolerable outage (MTO) is not related to AIW.
Which of the following change management activities would be a clear indicator that normal operational procedures require examination?
A. A high percentage of similar change requests
B. A high percentage of change request postponements
C. A high percentage of canceled change requests
D. A high percentage of emergency change requests
Which of the following purposes is for developing a security architecture as a way of meeting business objectives?
A. To reduce the cost of system development
B. To aid in strategy and policy development
C. To effectively manage complexity
D. To determine areas that will be a problem
An organization's information security strategy should be based on:
A. managing risk relative to business objectives.
B. managing risk to a zero level and minimizing insurance premiums.
C. avoiding occurrence of risks so that insurance is not required.
D. transferring most risks to insurers and saving on control costs.
Information security managers should use risk assessment techniques to:
A. justify selection of risk mitigation strategies.
B. maximize the return on investment (ROI).
C. provide documentation for auditors and regulators.
D. quantify risks that would otherwise be subjective.
A business impact analysis (BIA) is the BEST tool for determining:
A. total cost of ownership.
B. priority of restoration.
C. annualized loss expectancy (ALE).
D. residual risk.
Who is in the BEST position to determine the level of information security needed for a specific business application?
A. The system developer
B. The information security manager
C. The system custodian
D. The data owner
Proximity factors must be considered when:
A. conducting a business impact assessment.
B. conducting a table-top business continuity test.
C. developing disaster recovery metrics.
D. selecting an alternate recovery site.
The PRIMARY objective of a security steering group is to:
A. ensure information security covers all business functions.
B. ensure information security aligns with business goals.
C. raise information security awareness across the organization.
D. implement all decisions on security management across the organization.
Which of the following is the MOST important factor when designing information security architecture?
A. Technical platform interfaces
B. Scalability of the network
C. Development methodologies
D. Stakeholder requirements
Which of the following factors is MOST important for the successful implementation of an organization's information security program?
A. Senior management support
B. Budget for security activities
C. Regular vulnerability assessments
D. Knowledgeable security administrators
Where should an intranet server generally be placed?
A. On the internal network
B. On the firewall server
C. On the external router
D. On the primary domain controller
What action should be taken in regards to data classification requirements before engaging outsourced providers?
A. Ensure the data classification requirements are compatible with the provider's own classification.
B. Ensure the data classification requirements are communicated to the provider.
C. Ensure the data classification requirements exceed those of the outsourcer.
D. Ensure the data classification requirements are stated in the contract.
What does a network vulnerability assessment intend to identify?
A. 0-day vulnerabilities
B. Malicious software and spyware
C. Security design flaws
D. Misconfiguration and missing updates
What is the MOST important reason for formally documenting security procedures?
A. Ensure processes are repeatable and sustainable.
B. Ensure alignment with business objectives.
C. Ensure auditability by regulatory agencies.
D. Ensure objective criteria for the application of metrics.
Which of the following authentication methods prevents authentication replay?
A. Password hash implementation
B. Challenge/response mechanism
C. Wired Equivalent Privacy (WEP) encryption usage
D. HTTP Basic Authentication
What is the PRIMARY objective of a post-event review in incident response?
A. Adjust budget provisioning
B. Preserve forensic data
C. Improve the response process
D. Ensure the incident is fully documented
Which of the following choices BEST justifies an information security program?
A. The impact on critical IT assets
B. A detailed business case
C. Steering committee approval
D. User acceptance
The MOST important basis for developing a business case is the:
A. risk that will be addressed.
B. financial analysis of benefits.
C. alignment with organizational objectives.
D. feasibility and value proposition.
Which of the following is the MOST important item to consider when evaluating products to monitor security across the enterprise?
A. Ease of installation
B. Product documentation
C. Available support
D. System overhead
Which of the following is the MOST important element to ensure the success of a disaster recovery test at a vendor-provided hot site?
A. Tests are scheduled on weekends
B. Network IP addresses are predefined
C. Equipment at the hot site is identical
D. Business management actively participates
Which of the following is the MOST appropriate individual to ensure that new exposures have not been introduced into an existing application during the change management process?
A. System analyst
B. System user
C. Operations manager
D. Data security officer
The MOST timely and effective approach to detecting nontechnical security violations in an organization is:
A. the development of organizationwide communication channels.
B. periodic third-party auditing of incident reporting logs.
C. an automated policy compliance monitoring system.
D. deployment of suggestion boxes throughout the organization.
Laws and regulations should be addressed by the information security manager:
A. to the extent that they impact the enterprise.
B. by implementing international standards.
C. by developing policies that address the requirements.
D. to ensure that guidelines meet the requirements.
Which of the following is the MOST likely to change an organization's culture to one that is more security conscious?
A. Adequate security policies and procedures
B. Periodic compliance reviews
C. Security steering committees
D. Security awareness campaigns
When an organization is using an automated tool to manage and house its business continuity plans, which of the following is the PRIMARY concern?
A. Ensuring accessibility should a disaster occur
B. Versioning control as plans are modified
C. Broken hyperlinks to resources stored elsewhere
D. Tracking changes in personnel and plan assets
During an audit, an information security manager discovered that sales representatives are sending sensitive customer information through email messages. Which of the following is the BEST course of action to address the issue?
A. Review the finding with the sales manager to evaluate the risk and impact.
B. Report the issue to senior management immediately.
C. Request that the sales representatives stop emailing sensitive information.
D. Provide security awareness training to the sales representatives.
An organization has verified that its customer information was recently exposed. Which of the following is the FIRST step a security manager should take in this situation?
A. Inform senior management.
B. Determine the extent of the compromise.
C. Report the incident to the authorities.
D. Communicate with the affected customers.
After a risk assessment, it is determined that the cost to mitigate the risk is much greater than the benefit to be derived. The information security manager should recommend to business management that the risk be:
A. transferred.
B. treated.
C. accepted.
D. terminated.
Security risk assessments are MOST cost-effective to a software development organization when they are performed:
A. before system development begins.
B. at system deployment.
C. before developing a business case.
D. at each stage of the software development life cycle (SDLC).
What is the MOST effective way to ensure network users are aware of their responsibilities to comply with an organization's security requirements?
A. Logon banners displayed at every logon
B. Periodic security-related email messages
C. An intranet web site for information security
D. Circulating the information security policy
An information security manager has implemented procedures for monitoring specific activities on the network. The system administrator has been trained to analyze the network events, take appropriate action and provide reports to the information security manager. What additional monitoring should be implemented to give a more accurate, risk-based view of network activity?
A. The system administrator should be monitored by a separate reviewer.
B. All activity on the network should be monitored.
C. No additional monitoring is needed in this situation.
D. Monitoring should be done only by the information security manager.
Which of the following will BEST protect an organization from internal security attacks?
A. Static IP addressing
B. Internal address translation
C. Prospective employee background checks
D. Employee awareness certification program
Which of the following is in the BEST position to provide information on regulatory and legal compliance requirements that have an effect on information security?
A. Corporate legal officer
B. Enterprise risk manager
C. Compliance officer
D. Affected departments
Which of the following terms and conditions represent a significant deficiency if included in a commercial hot site contract?
A. A hot site facility will be shared in multiple disaster declarations
B. All equipment is provided "at time of disaster, not on floor"
C. The facility is subject to a "first-come, first-served" policy
D. Equipment may be substituted with equivalent models
Which of the following situations would be the MOST concern to a security manager?
A. Audit logs are not enabled on a production server
B. The logon ID for a terminated systems analyst still exists on the system
C. The help desk has received numerous results of users receiving phishing emails
D. A Trojan was found to be installed on a system administrator's laptop
Which of the following criteria is the MOST essential for operational metrics?
A. Timeliness of the reporting
B. Relevance to the recipient
C. Accuracy of the measurement
D. The cost of obtaining the metrics
Which of the following should be included in a good privacy statement?
A. A notification of liability on accuracy of information
B. A notification that information will be encrypted
C. A statement of what the company will do with information it collects
D. A description of the information classification process
Which of the following is a preventive measure?
A. A warning banner
B. Audit trails
C. An access control
D. An alarm system
Which of the following is MOST essential for a risk management program to be effective?
A. Flexible security budget
B. Sound risk baseline
C. Detection of new risk
D. Accurate risk reporting
When designing information security standards for an enterprise, the information security manager should require that an extranet server be placed:
A. outside the firewall.
B. on the firewall server.
C. on a screened subnet.
D. on the external router.
Assuming that the value of information assets is known, which of the following gives the information security manager the MOST objective basis for determining that the information security program is delivering value?
A. Number of controls
B. Cost of achieving control objectives
C. Effectiveness of controls
D. Test results of controls
Which of the following is PRIMARILY related to the emergence of governance, risk and compliance (GRC)?
A. The increasing need for controls
B. The policy development process
C. The integration of assurance-related activities
D. A model for information security program development
What is the BEST way to determine if an anomaly-based intrusion detection system (IDS) is properly installed?
A. Simulate an attack and review IDS performance.
B. Use a honeypot to check for unusual activity.
C. Audit the configuration of the IDS.
D. Benchmark the IDS against a peer site.
What responsibility do data owners normally have?
A. Applying emergency changes to application data
B. Administering security over database records
C. Migrating application code changes to production
D. Determining the level of application security required
Which of the following would be the MOST relevant factor when defining the information classification policy?
A. Quantity of information
B. Available IT infrastructure
C. Benchmarking
D. Requirements of data owners
When creating a forensic image of a hard drive, which of the following should be the FIRST step?
A. Identify a recognized forensics software tool to create the image.
B. Establish a chain of custody log.
C. Connect the hard drive to a write blocker.
D. Generate a cryptographic hash of the hard drive contents.
Which of the following actions is MOST important when a server is infected with a virus?
A. Isolate the infected server(s) from the network.
B. Identify all potential damage caused by the infection.
C. Ensure that the virus database files are current.
D. Establish security weaknesses in the firewall.
An organization's information security manager is planning the structure of the Information Security Steering Committee. Which of the following groups should the manager invite?
A. External audit and network penetration testers
B. Board of directors and the organization's regulators
C. External trade union representatives and key security vendors
D. Leadership from IT, human resources and the sales department
Which of the following will the data backup policy contain?
A. Criteria for data backup
B. Personnel responsible for backup
C. A data backup schedule
D. A list of systems to be backed up
In following up on a security incident, the system administrator is to copy data from one hard disk to another. From a forensic perspective, which of the following tasks must be ensured?
A. Copy to the same disk model as the original.
B. Make a dual backup of the original disk.
C. Keep the digital hash from both hard disks.
D. Perform a restoration test after replication.
What is the BEST way to ensure users comply with organizational security requirements for password complexity?
A. Include password construction requirements in the security standards
B. Require each user to acknowledge the password requirements
C. Implement strict penalties for user noncompliance
D. Enable system-enforced password configuration
Which of the following is the MOST important step when an employee is transferred to a different function?
A. Reviewing and modifying access rights
B. Assigning new security responsibilities
C. Conducting specific training for the new role
D. Knowledge of security weaknesses in last department
What is the BEST approach to implement adequate segregation of duties in business critical applications, where shared access to elevated privileges by a small group is necessary?
A. Ensure access to individual functions can be granted to individual users only.
B. Implement role-based access control in the application.
C. Enforce manual procedures ensuring separation of conflicting duties.
D. Create service accounts that can only be used by authorized team members.
Which of the following would BEST prepare an information security manager for regulatory reviews?
A. Assign an information security administrator as regulatory liaison.
B. Perform self-assessments using regulatory guidelines and reports.
C. Assess previous regulatory reports with process owners input.
D. Ensure all regulatory inquiries are sanctioned by the legal department.
When electronically stored information is requested during a fraud investigation, which of the following should be the FIRST priority?
A. Assigning responsibility for acquiring the data
B. Locating the data and preserving the integrity of the data
C. Creating a forensically sound image
D. Issuing a litigation hold to all affected parties
Which of the following should a successful information security management program use to determine the amount of resources devoted to mitigating exposures?
A. Risk analysis results
B. Audit report findings
C. Penetration test results
D. Amount of IT budget available
Which of the following is the MOST usable deliverable of an information security risk analysis?
A. Business impact analysis (BIA) report
B. List of action items to mitigate risk
C. Assignment of risks to process owners
D. Quantification of organizational risk
Which of the following is the GREATEST success factor for effectively managing information security?
A. An adequate budget
B. Senior level authority
C. A robust technology
D. Effective business relationships
Simple Network Management Protocol v2 (SNMP v2) is used frequently to monitor networks. Which of the following vulnerabilities does it always introduce?
A. Remote buffer overflow
B. Cross site scripting
C. Clear text authentication
D. Man-in-the-middle attack
Which of the following BEST accomplishes secure customer use of an e-commerce application?
A. Data encryption
B. Digital signatures
C. Strong passwords
D. Two-factor authentication
The MOST effective approach to address issues that arise between IT management, business units and security management when implementing a new security strategy is for the information security manager to:
A. escalate issues to an external third party for resolution.
B. ensure that senior management provide authority for security to address the issues.
C. insist that managers or units not in agreement with the security solution accept the risk.
D. refer the issues to senior management along with any security recommendations.
Which of the following provides the BEST confirmation that the business continuity/disaster recovery plan objectives have been achieved?
A. The recovery time objective (RTO) was not exceeded during testing
B. Objective testing of the business continuity/disaster recovery plan has been carried out consistently
C. The recovery point objective (RPO) was proved inadequate by disaster recovery plan testing
D. Information assets have been valued and assigned to owners per the business continuity plan/disaster recovery plan
Why should an incident management team conduct a postincident review?
A. To identify relevant electronic evidence
B. To identify lessons learned
C. To identify the hacker's identity
D. To identify affected areas
The BEST approach to secure approval for information security expenditures is to:
A. conduct a cost-benefit analysis.
B. develop a business case.
C. calculate return on investment (ROI).
D. evaluate loss history.
Which of the following attacks is BEST mitigated by utilizing strong passwords?
A. Man-in-the-middle attack
B. Brute force attack
C. Remote buffer overflow
D. Root kit
The requirement for due diligence is MOST closely associated with which of the following?
A. The right to audit
B. Service level agreements (SLAs)
C. Appropriate standard of care
D. Periodic security reviews
Which of the following is the MOST important element of an information security strategy?
A. Defined objectives
B. Time frames for delivery
C. Adoption of a control framework
D. Complete policies
Which of the following is the MOST important action to take when engaging third-party consultants to conduct an attack and penetration test?
A. Request a list of the software to be used
B. Provide clear directions to IT staff
C. Monitor intrusion detection system (IDS) and firewall logs closely
D. Establish clear rules of engagement
Who in an organization has the responsibility for classifying information?
A. Data custodian
B. Database administrator
C. Information security officer
D. Data owner
The information security manager should treat regulatory compliance requirements as:
A. an organizational mandate.
B. a risk management priority.
C. a purely operational issue.
D. just another risk.
After obtaining commitment from senior management, which of the following should be completed NEXT when establishing an information security program?
A. Define security metrics
B. Conduct a risk assessment
C. Perform a gap analysis
D. Procure security tools
When considering outsourcing services, at what point should information security become involved in the vendor management process?
A. During contract negotiation
B. Upon request for assistance from the business unit
C. When requirements are being established
D. When a security incident occurs
Which of the following is an example of a corrective control?
A. Diverting incoming traffic as a response to a denial of service (DoS) attack
B. Filtering network traffic
C. Examining inbound network traffic for viruses
D. Logging inbound network traffic
Which of the following actions should be taken when an information security manager discovers that a hacker is footprinting the network perimeter?
A. Reboot the border router connected to the firewall
B. Check IDS logs and monitor for any active attacks
C. Update IDS software to the latest available version
D. Enable server trace logging on the DMZ segment
Which of the following steps should be performed FIRST in the risk assessment process?
A. Staff interviews
B. Threat identification
C. Asset identification and valuation
D. Determination of the likelihood of identified risks
Which of the following is the BEST basis for determining the criticality and sensitivity of information assets?
A. A threat assessment
B. A vulnerability assessment
C. A resource dependency assessment
D. An impact assessment
In which of the following system development life cycle (SDLC) phases are access control and encryption algorithms chosen?
A. Procedural design
B. Architectural design
C. System design specifications
D. Software development
An IS manager has decided to implement a security system to monitor access to the Internet and prevent access to numerous sites. Immediately upon installation, employees flood the IT helpdesk with complaints of being unable to perform business functions on Internet sites. This is an example of:
A. conflicting security controls with organizational needs.
B. strong protection of information resources.
C. implementing appropriate controls to reduce risk.
D. proving information security's protective abilities.
Which of the following is the BEST indicator that security awareness training has been effective?
A. Employees sign to acknowledge the security policy
B. More incidents are being reported
C. A majority of employees have completed training
D. No incidents have been reported in three months
Which of the following BEST supports the principle of security proportionality?
A. Release management
B. Ownership schema
C. Resource dependency analysis
D. Asset classification
Which of the following types of information would the information security manager expect to have the LOWEST level of security protection in a publicly traded, multinational enterprise?
A. Strategic business plan
B. Upcoming financial results
C. Customer personal information
D. Previous financial results
Alignment of an information security program to business objectives is BEST achieved through:
A. senior management directing the information security program.
B. periodic risk analysis and treatment.
C. a security steering committee with representatives from all business functions.
D. regular security audits and ongoing monitoring.
What activity should the information security manager perform FIRST after finding that compliance with a set of standards is weak?
A. Initiate the exception process.
B. Modify policy to address the risk.
C. Increase compliance enforcement.
D. Perform a risk assessment.
What activity needs to be performed for previously accepted risk?
A. Risk should be reassessed periodically because risk changes over time.
B. Accepted risk should be flagged to avoid future reassessment efforts.
C. Risk should be avoided next time to optimize the risk profile.
D. Risk should be removed from the risk log after it is accepted.
Inherent control strength is PRIMARILY a function of which of the following?
A. Implementation
C. Testing
D. Policy
Which of the following is MOST effective in preventing weaknesses from being introduced into existing production systems?
D. Virus detection
Which of the following actions should the information security manager take FIRST on finding that current controls are not sufficient to prevent a serious compromise?
A. Strengthen existing controls.
B. Reassess the risk.
C. Set new control objectives.
D. Modify security baselines.
To reduce the possibility of service interruptions, an entity enters into contracts with multiple Internet service providers (ISPs). Which of the following would be the MOST important item to include?
A. Service level agreements (SLAs)
B. Right-to-audit clause
C. Intrusion detection system (IDS) services
D. Spam filtering services
Which of the following would be the GREATEST challenge when developing a standard awareness training program for a global organization?
A. Technical input requirements for IT security staff
B. Evaluating training program effectiveness
C. A diverse culture and varied technical abilities of end users
D. Availability of users either on weekends or after office hours
Which of the following is the MOST appropriate method of ensuring password strength in a large organization?
A. Attempt to reset several passwords to weaker values
B. Install code to capture passwords for periodic audit
C. Sample a subset of users and request their passwords for review
D. Install strong password settings on each platform
Which of the following is the BEST approach to dealing with inadequate funding of the security program?
A. Eliminate low-priority security services.
B. Require management to accept the increased risk.
C. Prioritize risk mitigation and educate management.
D. Reduce monitoring and compliance enforcement activities.
Which of the following is the MOST critical success factor of an information security program?
A. Developing information security policies and procedures
B. Senior management commitment
C. Conducting security training and awareness for all users
D. Establishing an information security management system
Phishing is BEST mitigated by which of the following?
A. Security monitoring software
B. Encryption
C. Two-factor authentication
D. User awareness
Which of the following is the BEST way to ensure that a corporate network is adequately secured against external attack?
A. Utilize an intrusion detection system.
B. Establish minimum security baselines.
C. Implement vendor recommended settings.
D. Perform periodic penetration testing.
Which of the following should be included in an annual information security budget that is submitted for management approval?
A. A cost-benefit analysis of budgeted resources
B. All of the resources that are recommended by the business
C. Total cost of ownership (TCO)
D. Baseline comparisons
The MOST important outcome of aligning information security governance with corporate governance is to:
A. show that information security understands the rules.
B. provide regulatory compliance.
C. maximize the cost-effectiveness of controls.
D. minimize the number of rules and regulations required.
Which of the following defines minimum standards for securing the technical infrastructure?
A. Information security strategy
B. Information security guidelines
C. Information security model
D. Information security architecture
Which of the following would be MOST relevant to include in a cost-benefit analysis of a two-factor authentication system?
A. Annual loss expectancy (ALE) of incidents
B. Frequency of incidents
D. Approved budget for the project
In what circumstances should mandatory access controls (MAC) be used?
A. When the organization has a high risk tolerance
B. When delegation of rights is contrary to policy
C. When the control policy specifies continuous oversight
D. When access is permitted, unless explicitly denied
Which one of the following network protocols is secure?
A. Simple Mail Transfer Protocol (SMTP)
B. File Transfer Protocol (FTP)
C. Post Office Protocol (POP3)
D. Simple Network Management Protocol (SNMP v3)
Which of the following choices should be assessed after the likelihood of a loss event has been determined?
A. The magnitude of impact
B. Risk tolerance
C. The replacement cost of assets
D. The book value of assets
An outsource service provider must handle sensitive customer information. Which of the following is MOST important for an information security manager to know?
A. Security in storage and transmission of sensitive data
B. Provider's level of compliance with industry standards
C. Security technologies in place at the facility
D. Results of the latest independent security review
What is the result of segmenting a highly sensitive database?
A. It reduces threat.
B. It reduces criticality.
C. It reduces sensitivity.
D. It reduces exposure.
When establishing a new incident management team whose members will serve on a part-time basis, which of the following means of training is MOST effective?
A. Formal training
B. Mentoring
C. On-the-job training
D. Induction
Three employees reported the theft or loss of their laptops while on business trips. The FIRST course of action for the security manager is to:
A. assess the impact of the loss and determine mitigating steps.
B. communicate the best practices in protecting laptops to all laptop users.
C. instruct the erring employees to pay a penalty for the lost laptops.
D. recommend that management report the incident to the police and file for insurance.
