Deck 4 Flashcards
Which of the following would be an information security manager ‘s primary challenge when deploying a bring your own device (BYOD) mobile program in an enterprise?
A. Configuration management
B. mobile application control
C. inconsistent device security
D. end user acceptance
C
Which of the following is most important to ensure when an organization is moving portions of its sensitive database to the cloud?
A. The conversion has been approved by the information security team
B. a right to audit clause is included in the contract
C. input from data owners is included in the requirements definition
D. data encryption is used in the cloud hosting solution
C
An information security manager has been made aware of a new data protection regulation that will soon go into effect. Which of the following is the best way to manage the risk of noncompliance?
A. Perform a gap analysis
B. consult with senior management on the best course of action
C. implement a program of work to comply with the new legislation
D. understand the cost of noncompliance
C
Which of the following is the most important function of an information security steering committee?
A. Evaluating the effectiveness of information security controls on a periodic basis
B. defining the objectives of the information security framework
C. conducting regular independent reviews of the state of security in the business
D. approving security awareness content prior to publication
B
A small organization with limited budget hires a new information security manager who finds the same IT staff member is assigned the responsibility of System Administrator, security administrator, database administrator, and application administrator. What is the manager’s best course of action?
A. Formally document IT administrator activities
B. automate user provisioning activities
C. maintain strict control over user provisioning activities
D. implement monitoring of IT administrator activities
D
A risk assessment exercise has identified the threat of a denial of service (DoS) attack. Executive management has decided to take no further action related to this risk. The most likely reason for this decision is:
A. the cost of implementing controls exceeds the potential financial losses
B. the risk assessment has not defined the likelihood of occurrence
C. executive management is not aware of the impact potential
D. the reported vulnerability has not been validated
A
Which of the following is the primary responsibility of an information security steering committee composed of management representation from business units?
A. Oversee the execution of the information security strategy
B. perform business impact analyses (BIAs)
C. manage the implementation of the information security plan
D. monitor the treatment of information security risk
A
When implementing a security policy for an organization handling personally identifiable information (PII), the most important objective should be:
A. strong encryption
B. regulatory compliance
C. security awareness training
D. data availability
B
When drafting the corporate privacy statement for a public website, which of the following must be included?
A. Limited liability clause
B. access control requirements
C. explanation of information usage
D. information encryption requirements
C
After a server has been attacked, which of the following is the best course of action?
A. Isolate the system
B. initiate incident response
C. conduct a security audit
D. review vulnerability assessment
B
Which of the following will provide the most guidance when deciding the level of protection for an information asset?
A. Impact on information security program
B. cost of controls
C. impact to business function
D. cost to replace
A
When management changes the enterprise business strategy, which of the following processes should be used to evaluate the existing information security controls as well as to select new information security controls?
A. Access control management
B. change management
C. configuration management
D. risk management
D
Which of the following is most likely to be impacted when emerging technologies are introduced to an organization?
A. Risk profile
B. security policies
C. control effectiveness
D. risk assessment approach
A
A company has a remote office located in a different country. The company’s chief information security officer (CISO) has just learned of a new regulatory requirement mandated by the country of the remote office. Which of the following should be the next step?
A. Integrate new requirements into the corporate policies
B. evaluate whether the new regulation impacts information security
C. create separate security policies and procedures for the new regulation
D. implement the requirement at the remote office location
B
Which of the following metrics is the best measure of the effectiveness of an information security program?
A. Reduction in the amount of risk exposure in an organization
B. reduction in the number of threats to an organization
C. reduction in the cost of risk remediation for an organization
D. reduction in the number of vulnerabilities in an organization
A
Which of the following provides the most useful information for identifying security control gaps on an application server?
A. Risk assessments
B. penetration testing
C. threat models
D. internal audit report
B
The most important attribute of a security control is that it is:
A. auditable
B. measurable
C. scalable
D. reliable
D
An event occurred that resulted in the activation of the business continuity plan (BCP). All employees were notified during the event, and they followed the plan. However, two major suppliers missed deadlines because they were not aware of the disruption. What is the best way to prevent a similar situation in the future?
A. Ensure service level agreement (SLAs) with suppliers are enforced
B. conduct A vulnerability assessment
C. perform testing of the BCP communication plan
D. Provide suppliers with access to the BCP document
A
Which of the following is most appropriate to add to a dashboard for the purpose of illustrating an organization’s risk level to senior management?
A. Results of risk and control testing
B. number of reported incidents
C. budget variance for information security
D. risk heat map
D
To confirm that a third party provider complies with an organization’s information security requirements, it is most important to ensure:
A. contract clauses comply with the organization’s information security policy
B. security metrics are included in the service level agreement (SLA)
C. the information security policy of the third-party service provider is reviewed
D. right to audit is included in the service level agreement (SLA)
C
The primary reason to create and externally store the disc hash value when performing forensic data acquisition from a hard disk is to:
A. validate the integrity during analysis
B. provide backup in case of media failure
C. reinstate original data when accidental changes occur
D. validate the confidentiality during analysis
A
Which of the following should be determined first when preparing a risk communication plan?
A. Reporting content
B. communication channel
C. target audience
D. reporting frequency
C
Which of the following is the major advantage of conducting a post-incident review? The review:
A. helps develop business cases for security monitoring tools
B. provides continuous process improvement
C. facilitates reporting on actions taken during the incident process
D. helps identify current and desired level of risk
B
A small organization has a contract with a multinational cloud computing vendor. Which of the following would present the greatest concern to an information security manager if omitted from the contract?
A. Escrow of software code with conditions for code release
B. right of the subscriber to conduct on-site audits of the vendor
C. authority of the subscriber to approve access to its data
D. commingling of subscribers’ data on the same physical server
C
Which of the following is the best method to protect consumer private information for an online public website?
A. Apply strong authentication to online accounts
B. encrypt consumer data in transit and at rest
C. use secure encrypted transport layer
D. apply a masking policy to the consumer data
B
Which of the following is the most important for an information security manager to verify when selecting a third party forensics provider?
A. Existence of a right to clause audit
B. technical capabilities of the provider
C. results of the provider’s business continuity test
D. existence of the provider’s incident response plan
B
An organization plans to utilize Software as a Service (SaaS) and is in the process of selecting a vendor. What should the information security manager do first to support this initiative?
A. Review independent security assessment reports for each vendor
B. benchmark each vendor’s services with industry best practices
C. define information security requirements and processes
D. analyze the risks and proposed mitigating controls
A
Which of the following would best help an organization’s ability to manage advanced persistent threats (APT)?
A. Having a skilled information security team
B. increasing the information security budget
C. using multiple security vendors
D. having network detection tools in place
D
Key risk indicators (KRIs) are most effective when they:
A. are mapped to core strategic initiatives
B. allow for comparison with industry peers
C. are redefined on a regular basis
D. assess the progress toward declared goals
C
Which of the following is the best strategy to implement an effective operational security posture?
A. Increased security awareness
B. defense in depth
C. threat management
D. vulnerability management
B
Organization A offers e-commerce services and uses secure transport protocol to protect Internet communication. To confirm communication with organization A, which of the following would be the best for a client to verify?
A. The URL of the e-commerce server
B. the certificate of the e-commerce server
C. the IP address of the e-commerce server
D. the browser’s indication of SSL use
B
Following a successful attack, an information security manager should be confident the malware has not continued to spread at the completion of which incident response phase?
A. Recovery
B. Eradication
C. Identification
D. Containment
D
Which of the following is the best way to rigorously test a disaster recovery plan (DRP) for a mission-critical system without disrupting business operations?
A. Parallel testing
B. simulation testing
C. checklist review
D. structured walk-through
A
Which of the following information security activities is most helpful to support compliance with information security policy?
A. Conducting information security awareness programs
B. creating monthly trend metrics
C. performing periodic IT reviews on new system acquisitions
D. obtaining management commitment
A
Which of the following should be the most important consideration when establishing information security policies for an organization?
A. Job descriptions include requirements to read security policies
B. senior management supports the policies
C. the policies are aligned to industry best practices
D. the policies are updated annually
B
Which of the following best enables an organization to provide ongoing assurance that legal and regulatory compliance requirements can be met?
A. Engaging external experts to provide guidance on changes in compliance requirements
B. assigning the operations manager accountability for meeting compliance requirements
C. embedding compliance requirements within operational processes
D. performing periodic audits for compliance with legal and regulatory requirements
D
Senior management has launched an enterprise-wide initiative to streamline internal processes to reduce costs, including security processes. What should the information security manager rely on most to allocate resources efficiently?
A. Capability maturity assessment
B. risk classification
C. return on investment (ROI)
D. internal audit reports
B
Which of the following is the best way to ensure that organizational security policies comply with data security regulatory requirements?
A. Obtain annual sign-off from executive management
B. align the policies to the most stringent global regulations
C. send the policies to stakeholders for review
D. outsource compliance activities
B
An organization has received complaints from users that some of their files have been encrypted. These users are receiving demands for money to decrypt the files. Which of the following would be the best course of action?
A. Isolate the affected systems
B. conduct an impact assessment
C. initiate incident response
D. rebuild the affected systems
C
A newly hired information security manager discovers that the cleanup of accounts for terminated employees happens only once a year. Which of the following should be the information security manager’s FIRST course of action?
A. Design and document a new process
B. perform a risk assessment
C. report the issue to senior management
D. update the security policy
B
Which of the following is most important to consider when aligning a security awareness program with the organization’s business strategy?
A. Processes and technology
B. people and culture
C. regulations and standards
D. executive and board directives
D
An online bank identifies a successful network attack in progress. The bank should first:
A. report the root cause to the board of directors
B. isolate the affected network segment
C. shut down the entire network
D. assess whether personally identifiable information (PII) is compromised
B
Human resources (HR) is evaluating potential Software as a Service (SaaS) cloud services. Which of the following should the information security manager do first to support this effort?
A. Perform a cost-benefit analysis of using cloud services
B. conduct a security audit on the cloud service providers
C. review the cloud service providers control reports
D. perform a risk assessment of adopting cloud services
D
Which of the following security initiatives should be the first step in helping an organization maintain compliance with privacy regulations?
A. Implementing a data classification framework
B. implementing security information and event management (SIEM)
C. installing a data loss prevention (DLP) solution
D. developing security awareness training
A
Which of the following would provide the best evidence to senior management that security control performance was improved?
A. Demonstrated return on security investment
B. review of security metrics trends
C. results of an emerging threat analysis
D. reduction in inherent risk
B
An organization is close to going live with the implementation of a cloud-based application. Independent penetration test results have been received that show a high-rated vulnerability. Which of the following would be the best way to proceed?
A. Postpone the implementation until the vulnerability has been fixed
B. Commission further penetration tests to validate initial test results
C. assess whether the vulnerability is within the organization’s risk tolerance levels
D. implement the application and request the cloud service provider to fix the vulnerability
C
A strict new regulation is being finalized to address global concerns regarding cybersecurity. Which of the following should the information security manager do first?
A. Monitor industry response to the regulation
B. seek legal counsel on the new regulation
C. validate the applicability of the regulation
D. escalate compliance risk to senior management
C
An organization recently outsourced the development of a mission-critical business application. Which of the following would be the best way to test for the existence of back doors?
A. Perform security code reviews on the entire application
B. scan the entire application using a vulnerability scanning tool
C. monitor Internet traffic for sensitive information leakage
D. run the application from a high-privileged account on a test system
A
Which of the following best enables the detection of advanced persistent threats (APTs)?
A. Vulnerability scanning
B. security information and event management system (SIEM)
C. Internet gateway filtering
D. periodic reviews of intrusion prevention systems (IPS)
A
A high-risk issue is discovered during an information security risk assessment of a legal application. The business is unwilling to allocate the resources to remediate the issue. Which of the following would be the information security manager’s best course of action?
A. Document risk acceptance from the business
B. recommend discontinuing the use of the legal application
C. design alternative compensating controls to reduce the risk
D. present the worst-case scenario related to the risk
C
Which of the following provides the most essential input for the development of an information security strategy?
A. Results of an information security gap analysis
B. measurement of security performance against IT goals
C. results of a technology risk assessment
D. availability of capable information security resources
A
An information security manager wants to document requirements detailing the minimum security controls required for user workstations. Which of the following resources would be most appropriate for this purpose?
A. Policies
B. Standards
C. Procedures
D. Guidelines
B
An information security team plans to increase password complexity requirements for a customer-facing site, but there are concerns it will negatively impact the user experience. Which of the following is the information security manager’s best course of action?
A. Evaluate business compensating controls
B. quantify the security risk to the business
C. assess business impact against security risk
D. conduct industry benchmarking
A
Which of the following is most important to ensuring that incident management plans are executed effectively?
A. Management support and approval has been obtained
B. an incident response maturity assessment has been conducted
C. a reputable managed security services provider has been engaged
D. the incident response team has the appropriate training
D
What should be the greatest concern for an information security manager of a large multinational organization when outsourcing data processing to a cloud service provider?
A. Local laws and regulations
B. backup and restoration of data
C. vendor service level agreements (SLAs)
D. independent review of the vendor
A
Which of the following is the best technical defense against unauthorized access to a corporate network through social engineering?
A. Requiring multi factor authentication
B. requiring challenge/response information
C. enforcing frequent password changes
D. enforcing complex password formats
A
An information security manager wants to improve the ability to identify changes in risk levels affecting the organization’s systems. Which of the following is the best method to achieve this objective?
A. Performing business impact analyses (BIA)
B. monitoring key goal indicators (KGIs)
C. monitoring key risk indicators (KRIs)
D. updating the risk register
C
Which of the following is the best way to determine if a recent investment in access control software was successful?
A. Senior management acceptance of the access control software
B. a comparison of security incidents before and after software installation
C. a business impact analysis (BIA) of the systems protected by the software
D. a review of the number of key risk indicators (KRIs) implemented for the software
C
Which of the following roles is best suited to validate user access requirements during an annual user access review?
A. Access manager
B. System Administrator
C. business owner
D. IT director
C
Which of the following is the greatest benefit of using a network-based intrusion prevention system (IPS)?
A. The ability to review and monitor streams by network segment
B. the ability to shut down or block suspicious connections
C. increased visibility into user web surfing
D. centralized controls for incident handling
B
During a post-incident review, the sequence and correlation of actions must be analyzed primarily based on:
A. a consolidated event timeline
B. logs from systems involved
C. interviews with personnel
D. documents created during the incident
A
Which of the following would be the most effective countermeasure against malicious programming that rounds down transaction amounts and transfers them to the perpetrator’s account?
A. Set up an agent to run a virus-scanning program across platforms
B. ensure that proper controls exist for code review and release management
C. implement controls for continuous monitoring of middleware transactions
D. apply the latest patch programs to the production operating systems
B
Which of the following is the best approach to identify new security issues associated with IT systems and applications in a timely manner?
A. Requiring periodic security audits of IT systems and applications
B. comparing current state to established industry benchmarks
C. performing a vulnerability assessment for each change to IT systems
D. integrating risk assessments into the change management process
D
