D2-Information Security Governance

Question 1

What does the acronym GRC denote?

Answer 1

Governance, Risk Mgmt and compliance

Question 2

What does R in a RACI chart demote?

Activity
Responsible
Accountable
Consulted
Informed

Answer 2

Responsible

Question 3

A goal of the security program is to continue to contribute toward fulfillment of the security strategy, which itself will continue to align to the business and business objectives

True
False

Answer 3

True

Question 4

The purpose of security governance is to

1. Align the organization’s security program with the needs of the business
2. Create policies for IT

Answer 4

1. Align the organization’s security program with the needs of the business

Question 5

These are desired capabilities or end states, ideally expressed in achievable, measurable terms.

Objectives
Strategy
Policy
Priorities
Standards
Processes
Controls
Program and project management
Metrics/reporting

Answer 5

Objectives

Question 6

This is a plan to achieve one or more objectives.

Objectives
Strategy
Policy
Priorities
Standards
Processes
Controls
Program and project management
Metrics/reporting

Answer 6

Strategy

Question 7

At its minimum, security policy should directly reflect the mission, objectives, and goals of the overall organization.

Objectives
Strategy
Policy
Priorities
Standards
Processes
Controls
Program and project management
Metrics/reporting

Answer 7

Policy

Question 8

These in the security program should flow directly from the organization’s mission, objectives, and goals. Whatever is most important to the organization as a whole should be important to information security as well.

Objectives
Strategy
Policy
Priorities
Standards
Processes
Controls
Program and project management
Metrics/reporting

Answer 8

Priorities

Question 9

The technologies, protocols, and practices used
by IT should be a reflection of the organization’s needs. On
their own, these help to drive a consistent approach to
solving business challenges; the choice of these should
facilitate solutions that meet the organization’s needs in a
cost effective and secure manner.

Objectives
Strategy
Policy
Priorities
Standards
Processes
Controls
Program and project management
Metrics/reporting

Answer 9

Standards

Question 10

These are formalized descriptions of repeated
business activities that include instructions to applicable
personnel. Processes include one or more procedures, as well
as definitions of business records and other facts that help
workers understand how things are supposed to be done.

Objectives
Strategy
Policy
Priorities
Standards
Processes
Controls
Program and project management
Metrics/reporting

Answer 10

Processes

Question 11

These are formal descriptions of critical activities
to ensure desired outcomes.

Objectives
Strategy
Policy
Priorities
Standards
Processes
Controls
Program and project management
Metrics/reporting

Answer 11

Controls

Question 12

The organization’s IT and security programs and projects should be organized and performed in a consistent manner that reflects business priorities and supports the business.

Objectives
Strategy
Policy
Priorities
Standards
Processes
Controls
Program and project management
Metrics/reporting

Answer 12

Program and project management

Question 13

This includes the formal measurement of processes and controls so that management understands and can measure them.

Objectives
Strategy
Policy
Priorities
Standards
Processes
Controls
Program and project management
Improved compliance
Metrics Reporting

Answer 13

Metrics/reporting

Question 14

Management will ensure that risk assessments will be performed to identify risks in information systems and supported processes. Follow-up actions will be carried out that will reduce the risk of system failure and
compromise.

Risk management
Process improvement
Event identification
Incident response
Business continuity
Metrics Management
Resource management
Improved IT governance

Answer 14

Risk management

Question 15

Management will ensure that key changes will be made to business processes that will result in security improvements.

Risk management
Process improvement
Event identification
Incident response
Business continuity
Metrics Management
Resource management
Improved IT governance

Answer 15

Process improvement

Question 16

Management will be sure to put technologies and processes in place to ensure that security events and incidents will be identified as quickly as possible.

Risk management
Process improvement
Event identification
Incident response
Business continuity
Metrics Management
Resource management
Improved IT governance

Answer 16

Event identification

Question 17

Management will put __________ procedures into place that will help to avoid incidents, reduce the impact and probability of incidents, and improve response to incidents so that their impact on the organization is minimized.

Risk management
Process improvement
Event identification
Incident response
Business continuity
Metrics Management
Resource management
Improved IT governance

Answer 17

Incident response

Question 18

Management will be sure to identify all applicable laws, regulations, and standards and carry out activities to confirm that the organization is able to attain and maintain compliance.

Risk management
Process improvement
Event identification
Incident response
Business continuity
Improved compliance
Metrics Management
Resource management
Improved IT governance

Answer 18

Improved compliance

Question 19

Management will define objectives and allocate resources for
the development of business continuity and disaster recovery
plans.

Risk management
Process improvement
Event identification
Incident response
Business continuity and disaster recovery planning
Metrics Management
Resource management
Improved IT governance

Answer 19

Business continuity and disaster recovery planning

Question 20

Management will establish processes to measure key security events such as incidents, policy changes and violations, audits, and training.

Risk management
Process improvement
Event identification
Incident response
Business continuity
Metrics Management
Resource management
Improved IT governance

Answer 20

Metrics Management

Question 21

The allocation of manpower, budget, and other resources to meet security objectives is monitored by management.

Risk management
Process improvement
Event identification
Incident response
Business continuity
Metrics Management
Resource management
Improved IT governance

Answer 21

Resource management

Question 22

An effective security governance program will result in better strategic decisions in the IT organization that keep risks at an acceptably low level.

Risk management
Process improvement
Event identification
Incident response
Business continuity
Metrics Management
Resource management
Improved IT governance

Answer 22

Improved IT governance

Question 23

These are two key results of an effective security governance
program:

• Increased trust Customers, suppliers, and partners trust
  the organization to a greater degree when they see that
  security is managed effectively.
• Improved reputation The business community, including
  customers, investors, and regulators, will hold the
  organization in higher regard.

True
False

Answer 23

True

Question 24

An organization’s information security program needs to fit into the
rest of the organization. This means that the program needs to
understand and align with the organization’s highest-level guiding
principles including the following:

• Mission Why does the organization exist? Who does it
  serve, and through what products and services?
• Goals and objectives What achievements does the
  organization want to accomplish, and when does it want to
  accomplish them?
• Strategy What are the activities that need to take place so
  that the organization’s goals and objectives can be fulfilled?

Question 25

To be business aligned, people in the security program should be
aware of several characteristics about the organization, including the
following:

• Culture Culture includes how personnel in the organization
  work, think, and relate to each other.
• Asset value This includes information the organization uses
  to operate. This often consists of intellectual property such as
  designs, source code, production costs, and pricing, as well as
  sensitive information related to not only its personnel but its
  customers, its information-processing infrastructure, and its
  service functions.
• Risk tolerance Risk tolerance for the organization’s
  information security program needs to align with the
  organization’s overall tolerance for risk.
• Legal obligations What external laws and regulations
  govern what the organization does and how it operates?
  These laws and regulations include the Gramm-Leach-Bliley
  Act (GLBA), Payment Card Industry Data Security Standard
  (PCI-DSS), European General Data Protection Regulation
  (GDPR), Health Insurance Portability and Accountability Act
  (HIPAA), and the North American Electric Reliability
  Corporation (NERC) standard. Also, contractual obligations
  with other parties often shape the organization’s behaviors
  and practices.
• Market conditions How competitive is the marketplace in
  which the organization operates? What strengths and
  weaknesses does the organization have in comparison with its
  competitors? How does the organization want its security
  differentiated from its competitors?

Question 26

ISACA defines risk appetite as the

1. level of risk that an organization is willing to accept while in pursuit
   of its mission, strategy, and objectives, and before action is needed
   to treat the risk.
2. level of risk that an organization is NOT willing to accept while in pursuit
   of its mission, strategy, and objectives, and before action is needed
   to treat the risk.

Answer 26

1. level of risk that an organization is willing to accept while in pursuit
   of its mission, strategy, and objectives, and before action is needed
   to treat the risk.

Question 27

ISACA defines risk capacity

1. As the objective amount of loss that an organization can tolerate without its continued existence being called into question.
2. As the SUBJECTIVE amount of loss that an organization can tolerate without its continued existence being called into question.

Answer 27

1. As the objective amount of loss that an organization can toleratewithout its continued existence being called into question.

Question 28

A ______ is a statement of activities that a person is expected to perform. Like roles, responsibilities are typically documented in position descriptions and job descriptions. Typical responsibilities include the following:

• Perform monthly corporate expense reconciliation
• Troubleshoot network faults and develop solutions
• Audit user account terminations and develop exception
  reports

Answer 28

Responsibility

Question 29

A RACI chart assigns

1.Levels of responsibility to individuals and groups.
2.Levels of responsibility to individuals ONLY.

Answer 29

1.Levels of responsibility to individuals and groups.

Question 30

Development of a RACI chart does not helps personnel determine roles for various business activities. A typical RACI chart follows.

True
False

Answer 30

False

Question 31

What does A in a RACI chart demote?

Activity
Responsible
Accountable
Consulted
Informed

Answer 31

Accountable

Question 32

What does I in a RACI chart demote?

Activity
Responsible
Accountable
Consulted
Informed

Answer 32

Informed

Question 33

What does C in a RACI chart demote?
Activity
Responsible
Accountable
Consulted
Informed

Answer 33

Consulted

Question 34

What are two key results of an effective security governance
program:

1. Increased trust Customers, suppliers, and partners trust
   the organization to a greater degree when they see that
   security is managed effectively.
2. Improved reputation The business community, including
   customers, investors, and regulators, will hold the
   organization in higher regard.
3. Meetings will include a discussion of the impact of
   regulatory changes, alignment with business objectives,
   effectiveness of measurements, recent incidents, recent audits, and
   risk assessments.
4. 1 and 3
5. 1 and 2
6. 2 and 3

Answer 34

2. 1 and 2

Question 35

In a RACI chart the role carry out by several parties in the user account access request process. This role is The person or group that performs the actual work or task.

1. Responsible
2. Accountable
3. Consulted
4. Informed

Answer 35

1. Responsible

Question 36

In a RACI chart the role carry out by several parties in the user account access request process. This role is The person who is ultimately answerable for complete, accurate, and timely execution of the work. Often this is a person who manages those in the Responsible role.

1. Responsible
2. Accountable
3. Consulted
4. Informed

Answer 36

2. Accountable

Question 37

In a RACI chart the role carry out by several parties in the user account access request process. This role is One or more people or groups who are consulted for their opinions, experience, or insight. People in
the Consulted role may be a subject-matter expert for the work or task, or they may be an owner, steward, or custodian of an asset associated with the work or task. Communication with the Consulted role is two-way.

1. Responsible
2. Accountable
3. Consulted
4. Informed

Answer 37

3. Consulted

Question 38

In a RACI chart the role carry out by several parties in the user account access request process. This role is One or more people or groups who are informed by those in other roles. Depending on the process or task,
Informed may be told of an activity before, during, or after its
completion. Communication with Informed is one-way.

1. Responsible
2. Accountable
3. Consulted
4. Informed

Answer 38

4. Informed

Question 39

Several considerations (3) must be taken into account when assigning
roles to individuals and groups in a RACI chart. This consideration depicts Some or all individuals in a team assignment, as well as specific named individuals, need to have the skills, training, and competence to carry out tasks as required

1. Skills
2. Segregation of Duties
3. Conflict of Interest

Answer 39

1. Skills

Question 40

Several considerations (3) must be taken into account when assigning
roles to individuals and groups in a RACI chart. This consideration depicts Critical tasks must not be assigned to individuals or groups when such assignments will create conflicts of interest. For example, a user who is an approver cannot approve a request for their own access. In this case, a
different person must approve the request—while also avoid a
segregation of duties conflict.

1. Skills
2. Segregation of Duties
3. Conflict of Interest

Answer 40

3. Conflict of Interest

Question 41

Several considerations (3) must be taken into account when assigning
roles to individuals and groups in a RACI chart. This consideration depicts Critical tasks such as the user account provisioning RACI chart depicted earlier must be free of duty conflicts. This means that there must be two or more individuals or groups required to carry out a critical task. In this example, the requestor, approver, and provisioner cannot be the same person or group.

1. Skills
2. Segregation of Duties
3. Conflict of Interest

Answer 41

2. Segregation of Duties

Question 42

In an organization is a body of people who oversee activities in an organization

1. Security board
2. Board of directors

Answer 42

2. Board of directors

Activities performed by the board of directors, as well as directors’
authority, are usually defined by a constitution, bylaws, or external
regulation. The board of directors is typically accountable to the
owners of the organization or, in the case of a government body, to
the electorate.
In many cases, board members have fiduciary duty. This means
they are accountable to shareholders or constituents to act in the
best interests of the organization with no appearance of impropriety,
conflict of interest, or ill-gotten profit as a result of their actions.

Question 43

Cyber-Risk Oversight, the National Association of Corporate Directors has developed five principles about the importance of information security:
This principle states Directors need to understand and approach
cybersecurity as an enterprise-wide risk management issue,
not just an IT issue.

1. Principle 1
2. Principle 2
3. Principle 3
4. Principle 4
5. Principle 5

Answer 43

Principle 1

Question 44

Cyber-Risk Oversight, the National Association of Corporate Directors has developed five principles about the importance of information security:
This principle states Directors should understand the legal
implications of cyber risks as they relate to their company’s
specific circumstances.

1. Principle 1
2. Principle 2
3. Principle 3
4. Principle 4
5. Principle 5

Answer 44

Principle 2

Question 45

Cyber-Risk Oversight, the National Association of Corporate Directors has developed five principles about the importance of information security:
This principle states Boards should have adequate access to
cybersecurity expertise, and discussions about cyber-risk
management should be given regular and adequate time on
board meeting agendas.

1. Principle 1
2. Principle 2
3. Principle 3
4. Principle 4
5. Principle 5

Answer 45

Principle 3

Question 46

Cyber-Risk Oversight, the National Association of Corporate Directors has developed five principles about the importance of information security:
This principle states Boards should set the expectation that
management will establish an enterprise-wide cyber-risk
management framework with adequate staffing and budget.

1. Principle 1
2. Principle 2
3. Principle 3
4. Principle 4
5. Principle 5

Answer 46

Principle 4

Question 47

Cyber-Risk Oversight, the National Association of Corporate Directors has developed five principles about the importance of information security:
This principle states Board management discussions about cyber risk
should include identification of which risks to avoid, which to
accept, and which to mitigate or transfer through insurance,
as well as specific plans associated with each approach.

1. Principle 1
2. Principle 2
3. Principle 3
4. Principle 4
5. Principle 5

Answer 47

Principle 5

Question 48

This team is responsible for carrying out directives issued by the board of directors.

1. Board of directors
2. Security committee
3. Executive management

Answer 48

3. Executive management

In the context of information security management, this includes ensuring that there are sufficient resources for the organization to implement a security program and to develop and maintain security controls to protect critical assets.

Executive management must ensure that priorities are balanced.
In the case of IT and information security, these functions are
usually tightly coupled but sometimes in conflict. IT’s primary
mission is the development and operation of business-enabling
capabilities through the use of information systems, while
information security’s mission includes security and compliance.

Executive management must ensure that these two sometimes conflicting
missions are successful.

Question 49

To ensure the success of the organization’s information security
program, executive management should be involved in three key
areas: This area is where Security policies that are
developed by the information security function should be
visibly ratified or endorsed by executive management. This
may take different forms, such as formal minuted ratification
in a governance meeting, a statement for the need for
compliance along with a signature within the body of the
security policy document, a separate memorandum to all
personnel, or other visible communication to the
organization’s rank and file that stresses the importance of,
and need for compliance to, the organization’s information
security policy.

1. Ratify corporate security policy
2. Leadership by example
3. Ultimate responsibility

Answer 49

1. Ratify corporate security policy

Question 50

To ensure the success of the organization’s information security
program, executive management should be involved in three key
areas: This area is where With regard to information security policy, executive management should lead by example and not exhibit behavior suggesting they are “above” security policy—or other policies. Executives should not be seen to enjoy special privileges of the nature that suggest
that one or more security policies do not apply to them. Instead, their behavior should visibly support security policies that all personnel are expected to comply with.

1. Ratify corporate security policy
2. Leadership by example
3. Ultimate responsibility

Answer 50

2. Leadership by example

Question 51

To ensure the success of the organization’s information security
program, executive management should be involved in three key
areas: This area is where Executives are ultimately responsible for all actions carried out by the personnel who report to them. Executives are also ultimately responsible for all outcomes related to organizations to which operations have been outsourced.

1. Ratify corporate security policy
2. Leadership by example
3. Ultimate responsibility

Answer 51

3. Ultimate responsibility

Question 52

Who is responsible for overseeing all activities in an organization. This team selects and manage a chief executive officer who is responsible for developing a governance function to manage assets, budgets, personnel,
processes, and risk.

1. The board of director
2. Executive Team
3. The security steering committee
4. The chief information security officer
   5.The chief privacy officer

Answer 52

1. The board of director

Question 53

This team is responsible for security strategic planning. This team will develop and approve security policies and appoint managers to develop and maintain processes, procedures, and standards, all of which should align with each other and with the organization’s overall mission, strategy, goals, and objectives.

1. The board of director
2. Executive Team
3. The security steering committee
4. The chief information security officer
   5.The chief privacy officer

Answer 53

3.The security steering committee

Question 54

This employee in the organization develops business-aligned security strategies that support the organization’s overall mission and goals and is responsible for the organization’s overall security program, including policy development, risk management, and perhaps some operational activities such as vulnerability
management, incident management, access management, and security awareness training.

1. The board of director
2. Executive Team
3. The security steering committee
4. The chief information security officer
5. The chief privacy officer

Answer 54

4. The chief information security officer

Question 55

This officer is responsible for the protection andproper use of sensitive personal information (often referred to as
personally identifiable information). This officers information protection
responsibilities are sometimes shared with the CISO who has overall information protection responsibilities. Virtually all other roles in IT have security responsibilities, including software development and integration, data management,network management, systems management, operations, service
desk, internal audit, and all staff members.

1. The board of director
2. Executive Team
3. The chief information security officer
   4.The chief privacy officer

Answer 55

4.The chief privacy officer

Question 56

The business model for information security, is a guide for business-aligned, risk-based security governance. BMIS was developed by

1. NIST
   2.ISO
2. ISACA
3. IC2

Answer 56

3. ISACA

Question 57

BMIS consists of four elements: organization, people, process, and
technology. It consists of six dynamic interconnections: This interconnection connecting organization and people elements is

1. culture
2. governing
3. architecture
4. emergence
5. enabling and support
6. human factors

Answer 57

1. culture

Question 58

BMIS consists of four elements: organization, people, process, and
technology. It consists of six dynamic interconnections: This interconnection connecting organization and process elements is

1. culture
2. governing
3. architecture
4. emergence
5. enabling and support
6. human factors

Answer 58

2. governing

Question 59

BMIS consists of four elements: organization, people, process, and
technology. It consists of six dynamic interconnections: This interconnection connecting organization and technology elements

1. culture
2. governing
3. architecture
4. emergence
5. enabling and support
6. human factors

Answer 59

3. architecture

Question 60

BMIS consists of four elements: organization, people, process, and
technology. It consists of six dynamic interconnections: This interconnection connecting people and process elements

1. culture
2. governing
3. architecture
4. emergence
5. enabling and support
6. human factors

Answer 60

4. emergence

Question 61

BMIS consists of four elements: organization, people, process, and
technology. It consists of six dynamic interconnections: This interconnection connecting process and technology elements

1. culture
2. governing
3. architecture
4. emergence
5. enabling and support
6. human factors

Answer 61

5. enabling and support

Question 62

BMIS consists of four elements: organization, people, process, and
technology. It consists of six dynamic interconnections: This interconnection connecting people and technology elements

1. culture
2. governing
3. architecture
4. emergence
5. enabling and support
6. human factors

Question 63

1. Security governance is most concerned with:
   A. Security policy
   B. IT policy
   C. Security strategy
   D. Security executive compensation

Answer 63

1. C. Security governance is the mechanism through which
   security strategy is established, controlled, and monitored.
   Long-term and other strategic decisions are made in the
   context of security governance.

Question 64

2. A gaming software startup company does not employ
   penetration testing of its software. This is an example of:
   A. High tolerance of risk
   B. Noncompliance
   C. Irresponsibility
   D. Outsourcing

Answer 64

2. A. A software startup in an industry like gaming is going to
   be highly tolerant of risk: time to market and signing up new
   customers will be its primary objectives. As the organization
   achieves viability, other priorities such as security will be
   introduced.

Question 65

3. An organization’s board of directors wants to see quarterly
   metrics on risk reduction. What would be the best metric for
   this purpose?
   A. Number of firewall rules triggered
   B. Viruses blocked by antivirus programs
   C. Packets dropped by the firewall
   D. Time to patch vulnerabilities on critical servers

Answer 65

3. D. The metric on time to patch critical servers will be the
   most meaningful metric for the board of directors. The other
   metrics, while potentially interesting at the operational level,
   do not convey business meaning to board members.

Question 66

4. Which of the following metrics is the best example of a
   leading indicator?
   A. Average time to mitigate security incidents
   B. Increase in the number of attacks blocked by the
   intrusion prevention system (IPS)
   C. Increase in the number of attacks blocked by the firewall
   D. Percentage of critical servers being patched within service
   level agreements (SLAs)

Answer 66

4. D. The metric of percentage of critical servers being
   patched within SLAs is the best leading indicator because it is
   a rough predictor of the probability of a future security
   incident. The other metrics are trailing indicators because
   they report on past incidents.

Question 67

5. What are the elements of the business model for information
   security (BMIS)?
   A. Culture, governing, architecture, emergence, enabling and
   support, human factors
   B. People, process, technology
   C. Organization, people, process, technology
   D. Financial, customer, internal processes, innovation, and
   learning

Answer 67

5. C. The elements of BMIS are organization, people,
   process, and technology. The dynamic interconnections (DIs)
   are culture, governing, architecture, emergence, enabling and
   support, and human factors.

Question 68

6. The best definition of a strategy is:
   A. The objective to achieve a plan
   B. The plan to achieve an objective
   C. The plan to achieve business alignment
   D. The plan to reduce risk

Answer 68

6. B. A strategy is the plan to achieve an objective. An
   objective is the “what” that an organization wants to achieve,
   and a strategy is the “how” the objective will be achieved.

Question 69

7. The primary factor related to the selection of a control
   framework is:
   A. Industry vertical
   B. Current process maturity level
   C. Size of the organization
   D. Compliance level

Answer 69

7. A. The most important factor influencing a decision of selecting a control framework are the industry vertical. For example, a healthcare organization would likely select HIPAA as its primary control framework, whereas a retail organization might select PCI-DSS.

Question 70

8. As part of understanding the organization’s current state, a
   security strategist is examining the organization’s securitypolicy. What does the policy tell the strategist?
   A. The level of management commitment to security
   B. The compliance level of the organization
   C. The maturity level of the organization
   D. None of these

Answer 70

8. D. By itself, security policy tells someone little about an organization’s security practices. An organization’s policy is
   only a collection of statements; without examining business processes, business records, and interviewing personnel, a
   security professional cannot develop any conclusions about an organization’s security practices.

Question 71

9. While gathering and examining various security-related business records, the security manager has determined that
   the organization has no security incident log. What conclusion can the security manager make from this?
   A. The organization does not have security incident detection capabilities.
   B. The organization has not yet experienced a security incident.
   C. The organization is recording security incidents in its risk register.
   D. The organization has effective preventive and detective controls.

Answer 71

9. A. An organization that does not have a security incident
   log probably lacks the capability to detect and respond to an
   incident. It is not reasonable to assume that the organization
   has had no security incidents since minor incidents occur with
   regularity. Claiming that the organization has effective
   controls is unreasonable, as it is understood that incidents
   occur even when effective controls are in place (because not
   all types of incidents can reasonably be prevented).

Question 72

10. The purpose of a balanced scorecard is to:
    A. Measure the efficiency of a security organization
    B. Evaluate the performance of individual employees
    C. Benchmark a process in the organization against peer
    organizations
    D. Measure organizational performance and effectiveness
    against strategic goals

Answer 72

10. D. The balanced scorecard is a tool that is used to quantify
    the performance of an organization against strategic
    objectives. The focus of a balanced scorecard is financial,
    customer, internal processes, and innovation/learning.

Question 73

11. A security strategist has examined a business process and
    has determined that personnel who perform the process do
    so consistently, but there is no written process document. The
    maturity level of this process is:
    A. Initial
    B. Repeatable
    C. Defined
    D. Managed

Answer 73

11. B. A process that is performed consistently but is
    undocumented is generally considered to be Repeatable.

Question 74

12. A security strategist has examined several business
    processes and has found that their individual maturity levels
    range from Repeatable to Optimizing. What is the best future
    state for these business processes?
    A. All processes should be changed to Repeatable.
    B. All processes should be changed to Optimizing.
    C. There is insufficient information to determine the desired
    end states of these processes.
    D. Processes that are Repeatable should be changed to
    Defined.

Answer 74

12. C. There are no rules that specify that the maturity levels
    of different processes need to be the same or at different
    values relative to one another. In this example, each process
    may already be at an appropriate level, based on risk
    appetite, risk levels, and other considerations.

Question 75

13. In an organization using PCI-DSS as its control framework,
    the conclusion of a recent risk assessment stipulates that
    additional controls not present in PCI-DSS but present in ISO
    27001 should be enacted. What is the best course of action in
    this situation?
    A. Adopt ISO 27001 as the new control framework.
    B. Retain PCI-DSS as the control framework and update
    process documentation.
    C. Add the required controls to the existing control
    framework.
    D. Adopt NIST 800-53 as the new control framework.

Answer 75

13. C. An organization that needs to implement new controls
    should do so within its existing control framework. It is not
    necessary to adopt an entirely new control framework when a
    few controls need to be added.

Question 76

14. A security strategist is seeking to improve the security
    program in an organization with a strong but casual culture.
    What is the best approach here?
    A. Conduct focus groups to discuss possible avenues of
    approach.
    B. Enact new detective controls to identify personnel who are
    violating policy.
    C. Implement security awareness training that emphasizes
    new required behavior.
    D. Lock users out of their accounts until they agree to be
    compliant.

Answer 76

14. A. Organizational culture is powerful, as it reflects how
    people think and work. In this example, there is no mention
    that the strong culture is bad, only that it is casual. Punishing
    people for their behavior may cause resentment, a revolt, or
    people to leave the organization. The best approach here is to
    better understand the culture and to work with people in the
    organization to figure out how a culture of security can be
    introduced successfully.

Question 77

15. A security strategist recently joined a retail organization that operates with slim profit margins and has discovered that the
    organization lacks several important security capabilities.
    What is the best strategy here?
    A. Insist that management support an aggressive program to quickly improve the program.
    B. Develop a risk ledger that highlights all identified risks.
    C. Recommend that the biggest risks be avoided.
    D. Develop a risk-based strategy that implements changes
    slowly over an extended period of time.
    Answers

Answer 77

15. D. A security strategist needs to understand an
    organization’s capacity to spend its way to lower risk. In an
    organization with profit margins, it is unlikely that the
    organization is going to agree to an aggressive improvement
    plan. Developing a risk ledger that depicts these risks may be
    a helpful tool for communicating risk, but by itself there is no
    action to change anything. Similarly, recommending risk
    avoidance may mean discontinuing the very operations that
    bring in revenue.

Question 78

Which of the following should be the FIRST step in developing an information security plan?
A. Perform a technical vulnerabilities assessment
B. Analyze the current business strategy
C. Perform a business impact analysis
D. Assess the current levels of security awareness

Answer 78

Answer: B
Explanation:
Prior to assessing technical vulnerabilities or levels of security awareness, an information security manager needs to gain an understanding of the current business strategy and direction. A business impact analysis should be performed prior to developing a business continuity plan, but this would not be an appropriate first step in developing an information security strategy because it focuses on availability.

Question 79

Senior management commitment and support for information security can BEST be obtained
through presentations that:
A. use illustrative examples of successful attacks.
B. explain the technical risks to the organization.
C. evaluate the organization against best security practices.
D. tie security risks to key business objectives.

Answer 79

Answer: D
Explanation:
Senior management seeks to understand the business justification for investing in security. This can best be accomplished by tying security to key business objectives. Senior management will not be as interested in technical risks or examples of successful attacks if they are not tied to the
impact on business environment and objectives. Industry best practices are important to senior management but, again, senior management will give them the right level of importance when they are presented in terms of key business objectives.

Question 80

The MOST appropriate role for senior management in supporting information security is the:
A. evaluation of vendors offering security products.
B. assessment of risks to the organization.
C. approval of policy statements and funding.
D. monitoring adherence to regulatory requirements.

Answer 80

Answer: C
Explanation:
Since the members of senior management are ultimately responsible for information security, they are the ultimate decision makers in terms of governance and direction. They are responsible for approval of major policy statements and requests to fund the information security practice.
Evaluation of vendors, assessment of risks and monitoring compliance with regulatory requirements are day-to-day responsibilities of the information security manager; in some organizations, business management is involved in these other activities, though their primary role
is direction and governance.

Question 81

Which of the following would BEST ensure the success of information security governance within an organization?
A.Steering committees approve security projects
B.Security policy training provided to all managers
C.Security training available to all employees on the intranet
D.Steering committees enforce compliance with laws and regulations

Answer 81

Answer: A
Explanation:
The existence of a steering committee that approves all security projects would be an indication of the existence of a good governance program. Compliance with laws and regulations is part of the responsibility of the steering committee but it is not a full answer. Awareness training is important at all levels in any medium, and also an indicator of good governance. However, it must be guided and approved as a security project by the steering committee.

Question 82

Information security governance is PRIMARILY driven by:
A. technology constraints.
B. regulatory requirements.
C. litigation potential.
D. business strategy.

Answer 82

Answer: D
Explanation:
Governance is directly tied to the strategy and direction of the business. Technology constraints, regulatory requirements and litigation potential are all important factors, but they are necessarily in line with the business strategy.

Question 83

Which of the following represents the MAJOR focus of privacy regulations?
A. Unrestricted data mining
B. Identity theft
C. Human rights protection
D. Identifiable personal data

Answer 83

Answer: D
Explanation:
Protection of identifiable personal data is the major focus of recent privacy regulations such as the Health Insurance Portability and Accountability Act (HIPAA). Data mining is an accepted tool for ad hoc reporting; it could pose a threat to privacy only if it violates regulatory provisions. Identity
theft is a potential consequence of privacy violations but not the main focus of many regulations. Human rights addresses privacy issues but is not the main focus of regulations.

Question 84

Investments in information security technologies should be based on:
A. vulnerability assessments.
B. value analysis.
C. business climate.
D. audit recommendations.

Answer 84

Answer: B
Explanation:
Investments in security technologies should be based on a value analysis and a sound business case. Demonstrated value takes precedence over the current business climate because it is ever changing. Basing decisions on audit recommendations would be reactive in nature and might not
address the key business needs comprehensively. Vulnerability assessments are useful, but they do not determine whether the cost is justified.

Question 85

Retention of business records should PRIMARILY be based on:
A. business strategy and direction.
B. regulatory and legal requirements.
C. storage capacity and longevity.
D. business ease and value analysis.

Answer 85

Answer: B
Explanation:
Retention of business records is generally driven by legal and regulatory requirements. Business strategy and direction would not normally apply nor would they override legal and regulatory requirements. Storage capacity and longevity are important but secondary issues. Business case
and value analysis would be secondary to complying with legal and regulatory requirements.

Question 86

Which of the following is characteristic of centralized information security management?
A. More expensive to administer
B. Better adherence to policies
C. More aligned with business unit needs
D. Faster turnaround of requests

Answer 86

Answer: B
Explanation:
Centralization of information security management results in greater uniformity and better adherence to security policies. It is generally less expensive to administer due to the economics of scale. However, turnaround can be slower due to the lack of alignment with business units.

Question 87

Successful implementation of information security governance will FIRST require:
A. security awareness training.
B. updated security policies.
C. a computer incident management team.
D. a security architecture.

Answer 87

Answer: B
Explanation:
Updated security policies are required to align management objectives with security procedures; management objectives translate into policy; policy translates into procedures. Security procedures will necessitate specialized teams such as the computer incident response and
management group as well as specialized tools such as the security mechanisms that comprise the security architecture. Security awareness will promote the policies, procedures and appropriate use of the security mechanisms.

Question 88

Which of the following individuals would be in the BEST position to sponsor the creation of an information security steering group?
A. Information security manager
B. Chief operating officer (COO)
C. Internal auditor
D. Legal counsel

Answer 88

Answer: B
Explanation:
The chief operating officer (COO) is highly-placed within an organization and has the most knowledge of business operations and objectives. The chief internal auditor and chief legal counsel are appropriate members of such a steering group. However, sponsoring the creation of the steering committee should be initiated by someone versed in the strategy and direction of the business. Since a security manager is looking to this group for direction, they are not in the best position to oversee formation of this group.

Question 89

The MOST important component of a privacy policy is:
A. notifications.
B. warranties.
C. liabilities.
D. geographic coverage.

Answer 89

Answer: A
Explanation:
Privacy policies must contain notifications and opt-out provisions: they are a high-level management statement of direction. They do not necessarily address warranties, liabilities or geographic coverage, which are more specific.

Question 90

The cost of implementing a security control should not exceed the:
A. annualized loss expectancy.
B. cost of an incident.
C. asset value.
D. implementation opportunity costs.

Answer 90

Answer: C
Explanation:
The cost of implementing security controls should not exceed the worth of the asset. Annualized loss expectancy represents the losses drat are expected to happen during a single calendar year. A security mechanism may cost more than this amount (or the cost of a single incident) and still be considered cost effective. Opportunity costs relate to revenue lost by forgoing the acquisition of an item or the making of a business decision.

Question 91

When a security standard conflicts with a business objective, the situation should be resolved by:
A. changing the security standard.
B. changing the business objective.
C. performing a risk analysis.
D. authorizing a risk acceptance.

Answer 91

Answer: C
Explanation:
Conflicts of this type should be based on a risk analysis of the costs and benefits of allowing or disallowing an exception to the standard. It is highly improbable that a business objective could be changed to accommodate a security standard, while risk acceptance is a process that derives
from the risk analysis.

Question 92

Minimum standards for securing the technical infrastructure should be defined in a security:
A. strategy.
B. guidelines.
C. model.
D. architecture.

Answer 92

Answer: D
Explanation:
Minimum standards for securing the technical infrastructure should be defined in a security architecture document. This document defines how components are secured and the security services that should be in place. A strategy is a broad, high-level document. A guideline is advisory in nature, while a security model shows the relationships between components.

Question 93

Which of the following is MOST appropriate for inclusion in an information security strategy?
A. Business controls designated as key controls
B. Security processes, methods, tools and techniques
C. Firewall rule sets, network defaults and intrusion detection system (IDS) settings
D. Budget estimates to acquire specific security tools

Answer 93

Answer: B
Explanation:
A set of security objectives, processes, methods, tools and techniques together constitute a security strategy. Although IT and business governance are intertwined, business controls may not be included in a security strategy. Budgets will generally not be included in an information security strategy. Additionally, until information security strategy is formulated and implemented, specific tools will not be identified and specific cost estimates will not be available. Firewall rule sets,
network defaults and intrusion detection system (IDS) settings are technical details subject to periodic change, and are not appropriate content for a strategy document.

Question 94

Senior management commitment and support for information security will BEST be attained by an information security manager by emphasizing:
A. organizational risk.
B. organization wide metrics.
C. security needs.
D. the responsibilities of organizational units.

Answer 94

Answer: A
Explanation:
Information security exists to help the organization meet its objectives. The information security manager should identify information security needs based on organizational needs. Organizational or business risk should always take precedence. Involving each organizational unit in information security and establishing metrics to measure success will be viewed favorably by senior management after the overall organizational risk is identified.

Question 95

Which of the following roles would represent a conflict of interest for an information security manager?
A. Evaluation of third parties requesting connectivity
B. Assessment of the adequacy of disaster recovery plans
C. Final approval of information security policies
D. Monitoring adherence to physical security controls

Answer 95

Answer: C
Explanation:
Since management is ultimately responsible for information security, it should approve information security policy statements; the information security manager should not have final approval. Evaluation of third parties requesting access, assessment of disaster recovery plans and
monitoring of compliance with physical security controls are acceptable practices and do not present any conflicts of interest.

Question 96

Which of the following situations must be corrected FIRST to ensure successful information security governance within an organization?
A. The information security department has difficulty filling vacancies.
B. The chief information officer (CIO) approves security policy changes.
C. The information security oversight committee only meets quarterly.
D. The data center manager has final signoff on all security projects.

Answer 96

Answer: D
Explanation:
A steering committee should be in place to approve all security projects. The fact that the data center manager has final signoff for all security projects indicates that a steering committee is not being used and that information security is relegated to a subordinate place in the organization. This would indicate a failure of information security governance. It is not inappropriate for an oversight or steering committee to meet quarterly. Similarly, it may be desirable to have the chief
information officer (CIO) approve the security policy due to the size of the organization and frequency of updates. Difficulty in filling vacancies is not uncommon due to the shortage of good, qualified information security professionals.

Question 97

Which of the following requirements would have the lowest level of priority in information security?
A. Technical
B. Regulatory
C. Privacy
D. Business

Answer 97

Answer: A
Explanation:
Information security priorities may, at times, override technical specifications, which then must be rewritten to conform to minimum security standards. Regulatory and privacy requirements are
government-mandated and, therefore, not subject to override. The needs of the business should always take precedence in deciding information security priorities.

Question 98

When an organization hires a new information security manager, which of the following goals should this individual pursue FIRST?
A. Develop a security architecture
B. Establish good communication with steering committee members
C. Assemble an experienced staff
D. Benchmark peer organizations

Answer 98

Answer: B
Explanation:
New information security managers should seek to build rapport and establish lines of communication with senior management to enlist their support. Benchmarking peer organizations is beneficial to better understand industry best practices, but it is secondary to obtaining senior
management support. Similarly, developing a security architecture and assembling an experienced staff are objectives that can be obtained later.

Question 99

It is MOST important that information security architecture be aligned with which of the following?
A. Industry best practices
B. Information technology plans
C. Information security best practices
D. Business objectives and goals

Answer 99

Answer: D
Explanation:
Information security architecture should always be properly aligned with business goals and objectives. Alignment with IT plans or industry and security best practices is secondary by comparison.

Question 100

Which of the following is MOST likely to be discretionary?
A. Policies
B. Procedures
C. Guidelines
D. Standards

Answer 100

Answer: C
Explanation:
Policies define security goals and expectations for an organization. These are defined in more specific terms within standards and procedures. Standards establish what is to be done while procedures describe how it is to be done. Guidelines provide recommendations that business management must consider in developing practices within their areas of control, as such, they are discretionary.

Question 101

Security technologies should be selected PRIMARILY on the basis of their:
A. ability to mitigate business risks.
B. evaluations in trade publications.
C. use of new and emerging technologies.
D. benefits in comparison to their costs.

Answer 101

Answer: A
Explanation:
The most fundamental evaluation criterion for the appropriate selection of any security technology is its ability to reduce or eliminate business risks. Investments in security technologies should be based on their overall value in relation to their cost; the value can be demonstrated in terms of risk mitigation. This should take precedence over whether they use new or exotic technologies or how they are evaluated in trade publications.

Question 102

Which of the following are seldom changed in response to technological changes?
A. Standards
B. Procedures
C. Policies
D. Guidelines

Answer 102

Answer: C
Explanation:
Policies are high-level statements of objectives. Because of their high-level nature and statement of broad operating principles, they are less subject to periodic change. Security standards and procedures as well as guidelines must be revised and updated based on the impact of technology changes.

Question 103

The MOST important factor in planning for the long-term retention of electronically stored business records is to take into account potential changes in:
A. storage capacity and shelf life.
B. regulatory and legal requirements.
C. business strategy and direction.
D. application systems and media.

Answer 103

Answer: D
Explanation:
Long-term retention of business records may be severely impacted by changes in application systems and media. For example, data stored in nonstandard formats that can only be read and interpreted by previously decommissioned applications may be difficult, if not impossible, to
recover. Business strategy and direction do not generally apply, nor do legal and regulatory requirements. Storage capacity and shelf life are important but secondary issues.

Question 104

Which of the following is characteristic of decentralized information security management across a geographically dispersed organization?
A. More uniformity in quality of service
B. Better adherence to policies
C. Better alignment to business unit needs
D. More savings in total operating costs

Answer 104

Answer: C
Explanation:
Decentralization of information security management generally results in better alignment to business unit needs. It is generally more expensive to administer due to the lack of economies of scale. Uniformity in quality of service tends to vary from unit to unit.

Question 105

Which of the following is the MOST appropriate position to sponsor the design and implementation of a new security infrastructure in a large global enterprise?
A. Chief security officer (CSO)
B. Chief operating officer (COO)
C. Chief privacy officer (CPO)
D. Chief legal counsel (CLC)

Answer 105

Answer: B
Explanation:
The chief operating officer (COO) is most knowledgeable of business operations and objectives. The chief privacy officer (CPO) and the chief legal counsel (CLC) may not have the knowledge of the day- to-day business operations to ensure proper guidance, although they have the same influence within the organization as the COO. Although the chief security officer (CSO) is knowledgeable of what is needed, the sponsor for this task should be someone with far-reaching influence across the organization.

Question 106

Which of the following would be the MOST important goal of an information security governance program?
A. Review of internal control mechanisms
B. Effective involvement in business decision making
C. Total elimination of risk factors
D. Ensuring trust in data

Answer 106

Answer: D
Explanation:
The development of trust in the integrity of information among stakeholders should be the primary goal of information security governance. Review of internal control mechanisms relates more to
auditing, while the total elimination of risk factors is not practical or possible. Proactive involvement in business decision making implies that security needs dictate business needs when, in fact, just
the opposite is true. Involvement in decision making is important only to ensure business data integrity so that data can be trusted.

Question 107

Relationships among security technologies are BEST defined through which of the following?
A. Security metrics
B. Network topology
C. Security architecture
D. Process improvement models
.

Answer 107

Answer: C
Explanation:
Security architecture explains the use and relationships of security mechanisms. Security metrics measure improvement within the security practice but do not explain the use and relationships of
security technologies. Process improvement models and network topology diagrams also do not describe the use and relationships of these technologies

Question 108

A business unit intends to deploy a new technology in a manner that places it in violation of existing information security standards. What immediate action should an information security manager take?
A. Enforce the existing security standard
B. Change the standard to permit the deployment
C. Perform a risk analysis to quantify the risk
D. Perform research to propose use of a better technology

Answer 108

Answer: C
Explanation:
Resolving conflicts of this type should be based on a sound risk analysis of the costs and benefits of allowing or disallowing an exception to the standard. A blanket decision should never be given without conducting such an analysis. Enforcing existing standards is a good practice; however,
standards need to be continuously examined in light of new technologies and the risks they present. Standards should not be changed without an appropriate risk assessment.

Question 109

Acceptable levels of information security risk should be determined by:
A. legal counsel.
B. security management.
C. external auditors.
D. steering committee.

Answer 109

Answer: D
Explanation:
Senior management, represented in the steering committee, has ultimate responsibility for determining what levels of risk the organization is willing to assume. Legal counsel, the external auditors and security management are not in a position to make such a decision.

Question 110

The PRIMARY goal in developing an information security strategy is to:
A. establish security metrics and performance monitoring.
B. educate business process owners regarding their duties.
C. ensure that legal and regulatory requirements are met
D. support the business objectives of the organization.

Answer 110

Answer: D
Explanation:
The business objectives of the organization supersede all other factors. Establishing metrics and measuring performance, meeting legal and regulatory requirements and educating business process owners are all subordinate to this overall goal.

Question 111

Senior management commitment and support for information security can BEST be enhanced through:
A. a formal security policy sponsored by the chief executive officer (CEO).
B. regular security awareness training for employees.
C. periodic review of alignment with business management goals.
D. senior management signoff on the information security strategy.

Answer 111

Answer: C
Explanation:
Ensuring that security activities continue to be aligned and support business goals is critical to obtaining their support. Although having the chief executive officer (CEO) signoff on the security policy and senior management signoff on the security strategy makes for good visibility and
demonstrates good tone at the top, it is a one-time discrete event that may be quickly forgotten by senior management. Security awareness training for employees will not have as much effect on senior management commitment.

Question 112

When identifying legal and regulatory issues affecting information security, which of the following would represent the BEST approach to developing information security policies?
A. Create separate policies to address each regulation
B. Develop policies that meet all mandated requirements
C. Incorporate policy statements provided by regulators
D. Develop a compliance risk assessment

Answer 112

Answer: B
Explanation:
It will be much more efficient to craft all relevant requirements into policies than to create separate versions. Using statements provided by regulators will not capture all of the requirements mandated by different regulators. A compliance risk assessment is an important tool to verify that procedures ensure compliance once the policies have been established.

Question 113

Which of the following MOST commonly falls within the scope of an information security governance steering committee?
A. Interviewing candidates for information security specialist positions
B. Developing content for security awareness programs
C. Prioritizing information security initiatives
D. Approving access to critical financial systems

Answer 113

Answer: C
Explanation:
Prioritizing information security initiatives is the only appropriate item. The interviewing of specialists should be performed by the information security manager, while the developing of program content should be performed by the information security staff. Approving access to critical
financial systems is the responsibility of individual system data owners.

Question 114

Which of the following is the MOST important factor when designing information security architecture?
A. Technical platform interfaces
B. Scalability of the network
C. Development methodologies
D. Stakeholder requirements

Answer 114

Answer: D
Explanation:
The most important factor for information security is that it advances the interests of the business, as defined by stakeholder requirements. Interoperability and scalability, as well as development methodologies, are all important but are without merit if a technologically-elegant solution is achieved that does not meet the needs of the business.

Question 115

Which of the following characteristics is MOST important when looking at prospective candidates for the role of chief information security officer (CISO)?
A. Knowledge of information technology platforms, networks and development methodologies
B. Ability to understand and map organizational needs to security technologies
C. Knowledge of the regulatory environment and project management techniques
D. Ability to manage a diverse group of individuals and resources across an organization

Answer 115

Answer: B
Explanation:
Information security will be properly aligned with the goals of the business only with the ability to understand and map organizational needs to enable security technologies. All of the other choices
are important but secondary to meeting business security needs.

Question 116

Which of the following are likely to be updated MOST frequently?
A. Procedures for hardening database servers
B. Standards for password length and complexity
C. Policies addressing information security governance
D. Standards for document retention and destruction

Answer 116

Answer: A
Explanation:
Policies and standards should generally be more static and less subject to frequent change. Procedures on the other hand, especially with regard to the hardening of operating systems, will be subject to constant change; as operating systems change and evolve, the procedures for hardening will have to keep pace.

Question 117

Who should be responsible for enforcing access rights to application data?
A. Data owners
B. Business process owners
C. The security steering committee
D. Security administrators

Answer 117

Answer: D
Explanation:
As custodians, security administrators are responsible for enforcing access rights to data. Data owners are responsible for approving these access rights. Business process owners are sometimes the data owners as well, and would not be responsible for enforcement. The security
steering committee would not be responsible for enforcement.

Question 118

The chief information security officer (CISO) should ideally have a direct reporting relationship to the:
A. head of internal audit.
B. chief operations officer (COO).
C. chief technology officer (CTO).
D. legal counsel.

Answer 118

Answer: B
Explanation:
The chief information security officer (CISO) should ideally report to as high a level within the organization as possible. Among the choices given, the chief operations officer (COO) would have not only the appropriate level but also the knowledge of day-to-day operations. The head of
internal audit and legal counsel would make good secondary choices, although they would not be as knowledgeable of the operations. Reporting to the chief technology officer (CTO) could become
problematic as the CTO’s goals for the infrastructure might, at times, run counter to the goals of information security.

Question 119

Which of the following is the MOST essential task for a chief information security officer (CISO) to perform?
A. Update platform-level security settings
B. Conduct disaster recovery test exercises
C. Approve access to critical financial systems
D. Develop an information security strategy paper

Answer 119

Answer: D
Explanation:
Developing a strategy paper on information security would be the most appropriate. Approving
access would be the job of the data owner. Updating platform-level security and conducting
recovery test exercises would be less essential since these are administrative tasks.

Question 120

Developing a successful business case for the acquisition of information security software products can BEST be assisted by:
A. assessing the frequency of incidents.
B. quantifying the cost of control failures.
C. calculating return on investment (ROI) projections.
D. comparing spending against similar organizations.

Answer 120

Answer: C
Explanation:
Calculating the return on investment (ROI) will most closely align security with the impact on the
bottom line. Frequency and cost of incidents are factors that go into determining the impact on the
business but, by themselves, are insufficient. Comparing spending against similar organizations
can be problematic since similar organizations may have different business goals and appetites for
risk.

Question 121

When an information security manager is developing a strategic plan for information security, the timeline for the plan should be:
A. aligned with the IT strategic plan.
B. based on the current rate of technological change.
C. three-to-five years for both hardware and software.
D. aligned with the business strategy.

Answer 121

Answer: D
Explanation:
Any planning for information security should be properly aligned with the needs of the business.
Technology should not come before the needs of the business, nor should planning be done on an
artificial timetable that ignores business needs.

Question 122

Which of the following is the MOST important information to include in a strategic plan for information security?
A. Information security staffing requirements
B. Current state and desired future state
C. IT capital investment requirements
D. information security mission statement

Answer 122

Answer: B
Explanation:
It is most important to paint a vision for the future and then draw a road map from the stalling point to the desired future state. Staffing, capital investment and the mission all stem from this foundation.

Question 123

Information security projects should be prioritized on the basis of:
A. time required for implementation.
B. impact on the organization.
C. total cost for implementation.
D. mix of resources required.

Answer 123

Answer: B
Explanation:
Information security projects should be assessed on the basis of the positive impact that they will have on the organization. Time, cost and resource issues should be subordinate to this objective.

Question 124

Which of the following is the MOST important information to include in an information security standard?
A. Creation date
B. Author name
C. Initial draft approval date
D. Last review date

Answer 124

Answer: D
Explanation:
The last review date confirms the currency of the standard, affirming that management has reviewed the standard to assure that nothing in the environment has changed that would necessitate an update to the standard. The name of the author as well as the creation and draft
dates are not that important.

Question 125

Which of the following would BEST prepare an information security manager for regulatory reviews?
A. Assign an information security administrator as regulatory liaison
B. Perform self-assessments using regulatory guidelines and reports
C. Assess previous regulatory reports with process owners input
D. Ensure all regulatory inquiries are sanctioned by the legal department

Answer 125

Answer: B
Explanation:
Self-assessments provide the best feedback on readiness and permit identification of items requiring remediation. Directing regulators to a specific person or department, or assessing previous reports, is not as effective. The legal department should review all formal inquiries but
this does not help prepare for a regulatory review.

Question 126

An information security manager at a global organization that is subject to regulation by multiple governmental jurisdictions with differing requirements should:
A. bring all locations into conformity with the aggregate requirements of all governmental jurisdictions.
B. establish baseline standards for all locations and add supplemental standards as required.
C. bring all locations into conformity with a generally accepted set of industry best practices.
D. establish a baseline standard incorporating those requirements that all jurisdictions have in common.

Answer 126

Answer: B
Explanation:
It is more efficient to establish a baseline standard and then develop additional standards for locations that must meet specific requirements. Seeking a lowest common denominator or just using industry best practices may cause certain locations to fail regulatory compliance. The
opposite approach—forcing all locations to be in compliance with the regulations places an undue
burden on those locations.

Question 127

Which of the following BEST describes an information security manager’s role in a multidisciplinary team that will address a new regulatory requirement regarding operational risk?
A. Ensure that all IT risks are identified
B. Evaluate the impact of information security risks
C. Demonstrate that IT mitigating controls are in place
D. Suggest new IT controls to mitigate operational risk

Answer 127

Answer: B
Explanation:
The job of the information security officer on such a team is to assess the risks to the business
operation. Choice A is incorrect because information security is not limited to IT issues. Choice C
is incorrect because at the time a team is formed to assess risk, it is premature to assume that any
demonstration of IT controls will mitigate business operations risk. Choice D is incorrect because it
is premature at the time of the formation of the team to assume that any suggestion of new IT
controls will mitigate business operational risk.

Question 128

From an information security manager perspective, what is the immediate benefit of clearly defined roles and responsibilities?
A. Enhanced policy compliance
B. Improved procedure flows
C. Segregation of duties
D. Better accountability

Answer 128

Answer: D
Explanation:
Without well-defined roles and responsibilities, there cannot be accountability.
Choice A is incorrect because policy compliance requires adequately defined accountability first and therefore is a byproduct.
Choice B is incorrect because people can be assigned to execute procedures that are not well designed.
Choice C is incorrect because segregation of duties is not automatic, and
roles may still include conflicting duties.

Question 129

An internal audit has identified major weaknesses over IT processing. Which of the following should an information security manager use to BEST convey a sense of urgency to management?
A. Security metrics reports
B. Risk assessment reports
C. Business impact analysis (BIA)
D. Return on security investment report

Answer 129

Answer: B
Explanation:
Performing a risk assessment will allow the information security manager to prioritize the remedial measures and provide a means to convey a sense of urgency to management. Metrics reports are normally contained within the methodology of the risk assessment to give it credibility and provide an ongoing tool. The business impact analysis (BIA) covers continuity risks only. Return on security investment cannot be determined until a plan is developed based on the BIA.

Question 129

Reviewing which of the following would BEST ensure that security controls are effective?
A. Risk assessment policies
B. Return on security investment
C. Security metrics
D. User access rights

Answer 129

Answer: C
Explanation:
Reviewing security metrics provides senior management a snapshot view and trends of an organization’s security posture.

Choice A is incorrect because reviewing risk assessment policies
would not ensure that the controls are actually working.
Choice B is incorrect because reviewing returns on security investments provides business justifications in implementing controls, but does
not measure effectiveness of the control itself.
Choice D is incorrect because reviewing user access rights is a joint responsibility of the data custodian and the data owner, and does not
measure control effectiveness.

Question 130

Which of the following is responsible for legal and regulatory liability?
A. Chief security officer (CSO)
B. Chief legal counsel (CLC)
C. Board and senior management
D. Information security steering group

Answer 130

Answer: C
Explanation:
The board of directors and senior management are ultimately responsible for all that happens in the organization. The others are not individually liable for failures of security in the organization.

Question 131

While implementing information security governance an organization should FIRST:
A. adopt security standards.
B. determine security baselines.
C. define the security strategy.
D. establish security policies.

Answer 131

Answer: C
Explanation:
The first step in implementing information security governance is to define the security strategy based on which security baselines are determined. Adopting suitable security- standards, performing risk assessment and implementing security policy are steps that follow the definition of
the security strategy.

Question 132

The MOST basic requirement for an information security governance program is to:
A. be aligned with the corporate business strategy.
B. be based on a sound risk management approach.
C. provide adequate regulatory compliance.
D provide best practices for security- initiatives.

Answer 132

Answer: A
Explanation:
To receive senior management support, an information security program should be aligned with the corporate business strategy. Risk management is a requirement of an information security program which should take into consideration the business strategy. Security governance is much
broader than just regulatory compliance. Best practice is an operational concern and does not have a direct impact on a governance program.

Question 133

Information security policy enforcement is the responsibility of the:
A. security steering committee.
B. chief information officer (CIO).
C. chief information security officer (CISO).
D. chief compliance officer (CCO).

Answer 133

Answer: C
Explanation:
Information security policy enforcement is the responsibility of the chief information security officer (CISO), first and foremost. The board of directors and executive management should ensure that a security policy is in line with corporate objectives. The chief information officer (CIO) and the chief compliance officer (CCO) are involved in the enforcement of the policy but are not directly responsible for it.

Question 134

A good privacy statement should include:
A. notification of liability on accuracy of information.
B. notification that information will be encrypted.
C. what the company will do with information it collects.
D. a description of the information classification process.

Answer 134

Answer: C
Explanation:
Most privacy laws and regulations require disclosure on how information will be used.
Choice A is incorrect because that information should be located in the web site’s disclaimer.
Choice B is incorrect because, although encryption may be applied, this is not generally disclosed.
Choice D is incorrect because information classification would be contained in a separate policy.

Question 135

Which of the following would be MOST effective in successfully implementing restrictive password policies?
A. Regular password audits
B. Single sign-on system
C. Security awareness program
D. Penalties for noncompliance

Answer 135

Answer: C
Explanation:
To be successful in implementing restrictive password policies, it is necessary to obtain the buy-in of the end users. The best way to accomplish this is through a security awareness program.
Regular password audits and penalties for noncompliance would not be as effective on their own; people would go around them unless forced by the system. Single sign-on is a technology solution that would enforce password complexity but would not promote user compliance. For the effort to be more effective, user buy-in is important.

Question 136

When designing an information security quarterly report to management, the MOST important element to be considered should be the:
A. information security metrics.
B. knowledge required to analyze each issue.
C. linkage to business area objectives.
D. baseline against which metrics are evaluated.

Answer 136

Answer: C
Explanation:
The link to business objectives is the most important clement that would be considered by
management. Information security metrics should be put in the context of impact to management
objectives. Although important, the security knowledge required would not be the first element to
be considered. Baselining against the information security metrics will be considered later in the
process.

Question 137

An information security manager at a global organization has to ensure that the local information security program will initially ensure compliance with the:
A. corporate data privacy policy.
B. data privacy policy where data are collected.
C. data privacy policy of the headquarters’ country.
D. data privacy directive applicable globally.

Answer 137

Answer: B
Explanation:
As a subsidiary, the local entity will have to comply with the local law for data collected in the country. Senior management will be accountable for this legal compliance. The policy, being internal, cannot supersede the local law. Additionally, with local regulations differing from the
country in which the organization is headquartered, it is improbable that a group wide policy will address all the local legal requirements. In case of data collected locally (and potentially transferred to a country with a different data privacy regulation), the local law applies, not the law
applicable to the head office. The data privacy laws are country-specific.

Question 138

A new regulation for safeguarding information processed by a specific type of transaction has come to the attention of an information security officer. The officer should FIRST:
A. meet with stakeholders to decide how to comply.
B. analyze key risks in the compliance process.
C. assess whether existing controls meet the regulation.
D. update the existing security/privacy policy.

Answer 138

Answer: C
Explanation:
If the organization is in compliance through existing controls, the need to perform other work related to the regulation is not a priority. The other choices are appropriate and important; however, they are actions that are subsequent and will depend on whether there is an existing
control gap.

Question 139

The PRIMARY objective of a security steering group is to:
A. ensure information security covers all business functions.
B. ensure information security aligns with business goals.
C. raise information security awareness across the organization.
D. implement all decisions on security management across the organization.

Answer 139

Answer: B
Explanation:
The security steering group comprises senior management of key business functions and has the primary objective to align the security strategy with the business direction. Option A is incorrect
because all business areas may not be required to be covered by information security; but, if they do, the main purpose of the steering committee would be alignment more so than coverage. While
raising awareness is important, this goal would not be carried out by the committee itself. The steering committee may delegate part of the decision making to the information security manager; however, if it retains this authority, it is not the primary’ goal.

Question 140

Data owners must provide a safe and secure environment to ensure confidentiality, integrity and availability of the transaction. This is an example of an information security:
A. baseline.
B. strategy.
C. procedure.
D. policy.

Answer 140

Answer: D
Explanation:
A policy is a high-level statement of an organization’s beliefs, goals, roles and objectives. Baselines assume a minimum security level throughout an organization. The information security strategy aligns the information security program with business objectives rather than making
control statements. A procedure is a step-by-step process of how policy and standards will be implemented.

Question 141

At what stage of the applications development process should the security department initially become involved?
A. When requested
B. At testing
C. At programming
D. At detail requirements

Answer 141

Answer: D
Explanation:
Information security has to be integrated into the requirements of the application’s design. It should also be part of the information security governance of the organization. The application owner may not make a timely request for security involvement. It is too late during systems testing, since the requirements have already been agreed upon. Code reviews are part of the final quality assurance process.

Question 142

A security manager is preparing a report to obtain the commitment of executive management to a security program. Inclusion of which of the following would be of MOST value?
A. Examples of genuine incidents at similar organizations
B. Statement of generally accepted best practices
C. Associating realistic threats to corporate objectives
D. Analysis of current technological exposures

Answer 142

Answer: C
Explanation:
Linking realistic threats to key business objectives will direct executive attention to them. All other options are supportive but not of as great a value as choice C when trying to obtain the funds for a new program.

Question 143

The PRIMARY concern of an information security manager documenting a formal data retention policy would be:
A. generally accepted industry best practices.
B. business requirements.
C. legislative and regulatory requirements.
D. storage availability.

Answer 143

Answer: B
Explanation:
The primary concern will be to comply with legislation and regulation but only if this is a genuine business requirement. Best practices may be a useful guide but not a primary concern. Legislative and regulatory requirements are only relevant if compliance is a business need. Storage is irrelevant since whatever is needed must be provided

Question 144

When personal information is transmitted across networks, there MUST be adequate controls over:
A. change management.
B. privacy protection.
C. consent to data transfer.
D. encryption devices.

Answer 144

Answer: B
Explanation:
Privacy protection is necessary to ensure that the receiving party has the appropriate level of protection of personal data. Change management primarily protects only the information, not the privacy of the individuals. Consent is one of the protections that is frequently, but not always, required. Encryption is a method of achieving the actual control, but controls over the devices may not ensure adequate privacy protection and, therefore, is a partial answer.

Question 145

An organization’s information security processes are currently defined as ad hoc. In seeking to improve their performance level, the next step for the organization should be to:
A. ensure that security processes are consistent across the organization.
B. enforce baseline security levels across the organization.
C. ensure that security processes are fully documented.
D. implement monitoring of key performance indicators for security processes.

Answer 145

Answer: A
Explanation:
The organization first needs to move from ad hoc to repeatable processes. The organization then needs to document the processes and implement process monitoring and measurement.
Baselining security levels will not necessarily assist in process improvement since baselining focuses primarily on control improvement. The organization needs to standardize processes both
before documentation, and before monitoring and measurement.

Question 146

Who in an organization has the responsibility for classifying information?
A. Data custodian
B. Database administrator
C. Information security officer
D. Data owner

Answer 146

Answer: D
Explanation:
The data owner has full responsibility over data. The data custodian is responsible for securing the information. The database administrator carries out the technical administration. The information security officer oversees the overall classification management of the information.

Question 147

What is the PRIMARY role of the information security manager in the process of information classification within an organization?
A. Defining and ratifying the classification structure of information assets
B. Deciding the classification levels applied to the organization’s information assets
C. Securing information assets in accordance with their classification
D. Checking if information assets have been classified properly

Answer 147

Answer: A
Explanation:
Defining and ratifying the classification structure of information assets is the primary role of the information security manager in the process of information classification within the organization. Choice B is incorrect because the final responsibility for deciding the classification levels rests with the data owners. Choice C is incorrect because the job of securing information assets is the responsibility of the data custodians. Choice D may be a role of an information security manager
but is not the key role in this context.

Question 148

Logging is an example of which type of defense against systems compromise?
A. Containment
B. Detection
C. Reaction
D. Recovery

Answer 148

Answer: B
Explanation:
Detection defenses include logging as well as monitoring, measuring, auditing, detecting viruses and intrusion. Examples of containment defenses are awareness, training and physical security defenses. Examples of reaction defenses are incident response, policy and procedure change, and control enhancement. Examples of recovery defenses are backups and restorations, failover and remote sites, and business continuity plans and disaster recovery plans.

Question 149

Which of the following is MOST important in developing a security strategy?
A. Creating a positive business security environment
B. Understanding key business objectives
C. Having a reporting line to senior management
D. Allocating sufficient resources to information security

Answer 149

Answer: B
Explanation:
Alignment with business strategy is of utmost importance. Understanding business objectives is critical in determining the security needs of the organization.

Question 150

Who is ultimately responsible for the organization’s information?
A. Data custodian
B. Chief information security officer (CISO)
C. Board of directors
D. Chief information officer (CIO)

Answer 150

Answer: C
Explanation:
The board of directors is ultimately responsible for the organization’s information and is tasked with responding to issues that affect its protection. The data custodian is responsible for the maintenance and protection of data. This role is usually filled by the IT department. The chief information security officer (CISO) is responsible for security and carrying out senior management’s directives. The chief information officer (CIO) is responsible for information technology within the organization and is not ultimately responsible for the organization’s
information.

Question 151

Which of the following factors is a PRIMARY driver for information security governance that does not require any further justification?
A. Alignment with industry best practices
B. Business continuity investment
C. Business benefits
D. Regulatory compliance

Answer 151

Answer: D
Explanation:
Regulatory compliance can be a standalone driver for an information security governance measure. No further analysis nor justification is required since the entity has no choice in the regulatory requirements. Buy-in from business managers must be obtained by the information
security manager when an information security governance measure is sought based on its alignment with industry best practices. Business continuity investment needs to be justified by business impact analysis. When an information security governance measure is sought based on
qualitative business benefits, further analysis is required to determine whether the benefits outweigh the cost of the information security governance measure in question.

Question 152

An information security manager mapping a job description to types of data access is MOST likely to adhere to which of the following information security principles?
A. Ethics
B. Proportionality
C. Integration
D. Accountability

Answer 152

Answer: B
Explanation:
Information security controls should be proportionate to the risks of modification, denial of use or disclosure of the information. It is advisable to learn if the job description is apportioning more data
than are necessary for that position to execute the business rules (types of data access). Principles of ethics and integration have the least to do with mapping job description to types of data access. The principle of accountability would be the second most adhered to principle since
people with access to data may not always be accountable but may be required to perform an
operation.

Question 153

Which of the following is the MOST important prerequisite for establishing information security management within an organization?
A. Senior management commitment
B. Information security framework
C. Information security organizational structure
D. Information security policy

Answer 153

Answer: A
Explanation:
Senior management commitment is necessary in order for each of the other elements to succeed. Without senior management commitment, the other elements will likely be ignored within the organization.

Question 154

What will have the HIGHEST impact on standard information security governance models?
A. Number of employees
B. Distance between physical locations
C. Complexity of organizational structure
D. Organizational budget

Answer 154

Answer: C
Explanation:
Information security governance models are highly dependent on the overall organizational structure. Some of the elements that impact organizational structure are multiple missions and functions across the organization, leadership and lines of communication. Number of employees and distance between physical locations have less impact on information security governance models since well-defined process, technology and people components intermingle to provide the
proper governance. Organizational budget is not a major impact once good governance models are in place; hence governance will help in effective management of the organization’s budget.

Question 155

A security manager meeting the requirements for the international flow of personal data will need to ensure:
A. a data processing agreement.
B. a data protection registration.
C. the agreement of the data subjects.
D. subject access procedures.

Answer 155

Answer: C
Explanation:
Whenever personal data are transferred across national boundaries, the awareness and agreement of the data subjects are required. Choices A, B and D are supplementary data protection requirements that are not key for international data transfer.

Question 156

In order to highlight to management, the importance of integrating information security in the business processes, a newly hired Information security officer should FIRST:
A. prepare a security budget.
B. conduct a risk assessment.
C. develop an information security policy.
D. obtain benchmarking information.

Answer 156

Answer: B
Explanation:
Risk assessment, evaluation and impact analysis will be the starting point for driving management’s attention to information security. All other choices will follow the risk assessment.

Question 157

Temporarily deactivating some monitoring processes, even if supported by an acceptance of operational risk, may not be acceptable to the information security manager if:
A. it implies compliance risks.
B. short-term impact cannot be determined.
C. it violates industry security practices.
D. changes in the roles matrix cannot be detected.

Answer 157

Answer: A
Explanation:
Monitoring processes are also required to guarantee fulfillment of laws and regulations of the organization and, therefore, the information security manager will be obligated to comply with the law.

Choices B and C are evaluated as part of the operational risk.
Choice D is unlikely to be as critical a breach of regulatory legislation. The acceptance of operational risks overrides choices B,
C and D.

Question 158

An outcome of effective security governance is:
A. business dependency assessment
B. strategic alignment.
C. risk assessment.
D. planning.

Answer 158

Answer: B
Explanation:
Business dependency assessment is a process of determining the dependency of a business on certain information resources. It is not an outcome or a product of effective security management.
Strategic alignment is an outcome of effective security governance. Where there is good governance, there is likely to be strategic alignment. Risk assessment is not an outcome of effective security governance; it is a process. Planning comes at the beginning of effective security governance, and is not an outcome but a process.

Question 159

How would an information security manager balance the potentially conflicting requirements of an international organization’s security standards and local regulation?
A. Give organization standards preference over local regulations
B. Follow local regulations only
C. Make the organization aware of those standards where local regulations causes conflicts
D. Negotiate a local version of the organization standards

Answer 159

Answer: D
Explanation:
Adherence to local regulations must always be the priority. Not following local regulations can prove detrimental to the group organization. Following local regulations only is incorrect since
there needs to be some recognition of organization requirements. Making an organization aware of standards is a sensible step, but is not a total solution. Negotiating a local version of the organization standards is the most effective compromise in this situation.

Question 160

Who should drive the risk analysis for an organization?
A. Senior management
B. Security manager
C. Quality manager
D. Legal department

Answer 160

Answer: B
Explanation:
Although senior management should support and sponsor a risk analysis, the know-how and the management of the project will be with the security department. Quality management and the legal department will contribute to the project.

Question 161

The FIRST step in developing an information security management program is to:
A. identify business risks that affect the organization.
B. clarify organizational purpose for creating the program.
C. assign responsibility for the program.
D. assess adequacy of controls to mitigate business risks.

Answer 161

Answer: B
Explanation:
In developing an information security management program, the first step is to clarify the organization’s purpose for creating the program. This is a business decision based more on judgment than on any specific quantitative measures. After clarifying the purpose, the other choices are assigned and acted upon.

Question 162

Which of the following is the MOST important to keep in mind when assessing the value of information?
A. The potential financial loss
B. The cost of recreating the information
C. The cost of insurance coverage
D. Regulatory requirement

Answer 162

Answer: A
Explanation:
The potential for financial loss is always a key factor when assessing the value of information.
Choices B, C and D may be contributors, but not the key factor.

Question 163

What would a security manager PRIMARILY utilize when proposing the implementation of a security solution?
A. Risk assessment report
B. Technical evaluation report
C. Business case
D. Budgetary requirements

Answer 163

Answer: C
Explanation:
The information security manager needs to prioritize the controls based on risk management and
the requirements of the organization. The information security manager must look at the costs of
the various controls and compare them against the benefit the organization will receive from the
security solution. The information security manager needs to have knowledge of the development
of business cases to illustrate the costs and benefits of the various controls. All other choices are
supplemental.

Question 164

To justify its ongoing security budget, which of the following would be of MOST use to the information security’ department?
A. Security breach frequency
B. Annualized loss expectancy (ALE)
C. Cost-benefit analysis
D. Peer group comparison

Answer 164

Answer: C
Explanation:
Cost-benefit analysis is the legitimate way to justify budget. The frequency of security breaches may assist the argument for budget but is not the key tool; it does not address the impact.
Annualized loss expectancy (ALE) does not address the potential benefit of security investment. Peer group comparison would provide a good estimate for the necessary security budget but it would not take into account the specific needs of the organization.

Question 165

Which of the following situations would MOST inhibit the effective implementation of security governance?
A. The complexity of technology
B. Budgetary constraints
C. Conflicting business priorities
D. High-level sponsorship

Answer 165

Answer: D
Explanation:
The need for senior management involvement and support is a key success factor for the implementation of appropriate security governance. Complexity of technology, budgetary
constraints and conflicting business priorities are realities that should be factored into the governance model of the organization, and should not be regarded as inhibitors.

Question 166

To achieve effective strategic alignment of security initiatives, it is important that:
A. Steering committee leadership be selected by rotation.
B. Inputs be obtained and consensus achieved between the major organizational units.
C. The business strategy be updated periodically.
D. Procedures and standards be approved by all departmental heads.

Answer 166

Answer: B
Explanation:
It is important to achieve consensus on risks and controls, and obtain inputs from various organizational entities since security needs to be aligned to the needs of the organization. Rotation
of steering committee leadership does not help in achieving strategic alignment. Updating business strategy does not lead to strategic alignment of security initiatives. Procedures and standards need not be approved by all departmental heads

Question 167

What would be the MOST significant security risks when using wireless local area network (LAN) technology?
A. Man-in-the-middle attack
B. Spoofing of data packets
C. Rogue access point
D. Session hijacking

Answer 167

Answer: C
Explanation:
A rogue access point masquerades as a legitimate access point. The risk is that legitimate users may connect through this access point and have their traffic monitored. All other choices are not dependent on the use of a wireless local area network (LAN) technology.

Question 168

When developing incident response procedures involving servers hosting critical applications, which of the following should be the FIRST to be notified?
A. Business management
B. Operations manager
C. Information security manager
D. System users

Answer 168

Answer: C
Explanation:
The escalation process in critical situations should involve the information security manager as the first contact so that appropriate escalation steps are invoked as necessary. Choices A, B and D
would be notified accordingly.

Question 169

In implementing information security governance, the information security manager is PRIMARILY responsible for:
A. developing the security strategy.
B. reviewing the security strategy.
C. communicating the security strategy.
D. approving the security strategy

Answer 169

Answer: A
Explanation:
The information security manager is responsible for developing a security strategy based on
business objectives with the help of business process owners. Reviewing the security strategy is
the responsibility of a steering committee. The information security manager is not necessarily
responsible for communicating or approving the security strategy.

Question 170

An information security strategy document that includes specific links to an organization’s business activities is PRIMARILY an indicator of:
A. performance measurement.
B. integration.
C. alignment.
D. value delivery.

Answer 170

Answer: C
Explanation:
Strategic alignment of security with business objectives is a key indicator of performance
measurement. In guiding a security program, a meaningful performance measurement will also
rely on an understanding of business objectives, which will be an outcome of alignment. Business
linkages do not by themselves indicate integration or value delivery. While alignment is an
important precondition, it is not as important an indicator.

Question 171

When an organization is setting up a relationship with a third-party IT service provider, which of the following is one of the MOST important topics to include in the contract from a security standpoint?
A. Compliance with international security standards.
B. Use of a two-factor authentication system.
C. Existence of an alternate hot site in case of business disruption.
D. Compliance with the organization’s information security requirements.

Answer 171

Answer: D
Explanation:
From a security standpoint, compliance with the organization’s information security requirements
is one of the most important topics that should be included in the contract with third-party service
provider. The scope of implemented controls in any ISO 27001-compliant organization depends on
the security requirements established by each organization. Requiring compliance only with this
security standard does not guarantee that a service provider complies with the organization’s
security requirements. The requirement to use a specific kind of control methodology is not usually
stated in the contract with third- party service providers.

Question 172

To justify the need to invest in a forensic analysis tool, an information security manager should FIRST:
A. review the functionalities and implementation requirements of the solution.
B. review comparison reports of tool implementation in peer companies.
C. provide examples of situations where such a tool would be useful.
D. substantiate the investment in meeting organizational needs.

Answer 172

Answer: D
Explanation:
Any investment must be reviewed to determine whether it is cost effective and supports the
organizational strategy. It is important to review the features and functionalities provided by such a
tool, and to provide examples of situations where the tool would be useful, but that comes after
substantiating the investment and return on investment to the organization.

Question 173

The MOST useful way to describe the objectives in the information security strategy is through:
A. attributes and characteristics of the ‘desired state.”
B. overall control objectives of the security program.
C. mapping the IT systems to key business processes.
D. calculation of annual loss expectations.

Answer 173

Answer: A
Explanation:
Security strategy will typically cover a wide variety of issues, processes, technologies and outcomes that can best be described by a set of characteristics and attributes that are desired. Control objectives are developed after strategy and policy development. Mapping IT systems to key business processes does not address strategy issues. Calculation of annual loss expectations would not describe the objectives in the information security strategy.

Question 174

In order to highlight to management, the importance of network security, the security manager should FIRST:
A. develop a security architecture.
B. install a network intrusion detection system (NIDS) and prepare a list of attacks.
C. develop a network security policy.
D. conduct a risk assessment.

Answer 174

Answer: D
Explanation:
A risk assessment would be most helpful to management in understanding at a very high level the
threats, probabilities and existing controls. Developing a security architecture, installing a network
intrusion detection system (NIDS) and preparing a list of attacks on the network and developing a
network security policy would not be as effective in highlighting the importance to management
and would follow only after performing a risk assessment.

Question 175

When developing an information security program, what is the MOST useful source of information for determining available resources?
A. Proficiency test
B. Job descriptions
C. Organization chart
D. Skills inventory

Answer 175

Answer: D
Explanation:
A skills inventory would help identify- the available resources, any gaps and the training
requirements for developing resources. Proficiency testing is useful but only with regard to specific
technical skills. Job descriptions would not be as useful since they may be out of date or not
sufficiently detailed. An organization chart would not provide the details necessary to determine
the resources required for this activity.

Question 176

The MOST important characteristic of good security policies is that they:
A. state expectations of IT management.
B. state only one general security mandate.
C. are aligned with organizational goals.
D. govern the creation of procedures and guidelines.

Answer 176

Answer: C
Explanation:
The most important characteristic of good security policies is that they be aligned with
organizational goals. Failure to align policies and goals significantly reduces the value provided by
the policies. Stating expectations of IT management omits addressing overall organizational goals
and objectives. Stating only one general security mandate is the next best option since policies
should be clear; otherwise, policies may be confusing and difficult to understand. Governing the
creation of procedures and guidelines is most relevant to information security standards.

Question 177

An information security manager must understand the relationship between information security and business operations in order to:
A. support organizational objectives.
B. determine likely areas of noncompliance.
C. assess the possible impacts of compromise.
D. understand the threats to the business.

Answer 177

Answer: A
Explanation:
Security exists to provide a level of predictability for operations, support for the activities of the organization and to ensure preservation of the organization. Business operations must be the driver for security activities in order to set meaningful objectives, determine and manage the risks to those activities, and provide a basis to measure the effectiveness of and provide guidance to the security program. Regulatory compliance may or may not be an organizational requirement. If compliance is a requirement, some level of compliance must be supported but compliance is only one aspect. It is necessary to understand the business goals in order to assess potential impacts
and evaluate threats. These are some of the ways in which security supports organizational objectives, but they are not the only ways.

Question 178

The MOST effective approach to address issues that arise between IT management, business units and security management when implementing a new security strategy is for the information
security manager to:
A. escalate issues to an external third party for resolution.
B. ensure that senior management provides authority for security to address the issues.
C. insist that managers or units not in agreement with the security solution accept the risk.
D. refer the issues to senior management along with any security recommendations.

Answer 178

Answer: D
Explanation:
Senior management is in the best position to arbitrate since they will look at the overall needs of the business in reaching a decision. The authority may be delegated to others by senior management after their review of the issues and security recommendations. Units should not be
asked to accept the risk without first receiving input from senior management.

Question 179

Obtaining senior management support for establishing a warm site can BEST be accomplished by:
A. establishing a periodic risk assessment.
B. promoting regulatory requirements.
C. developing a business case.
D. developing effective metrics.

Answer 179

Answer: C
Explanation:
Business case development, including a cost-benefit analysis, will be most persuasive to
management. A risk assessment may be included in the business ease, but by itself will not be as
effective in gaining management support. Informing management of regulatory requirements may
help gain support for initiatives, but given that more than half of all organizations are not in
compliance with regulations, it is unlikely to be sufficient in many cases. Good metrics which
provide assurance that initiatives are meeting organizational goals will also be useful, but are
insufficient in gaining management support.

Question 180

Which of the following would be the BEST option to improve accountability for a system administrator who has security functions?
A. Include security responsibilities in the job description
B. Require the administrator to obtain security certification
C. Train the system administrator on penetration testing and vulnerability assessment
D. Train the system administrator on risk assessment

Answer 180

Answer: A
Explanation:
The first step to improve accountability is to include security responsibilities in a job description.
This documents what is expected and approved by the organization. The other choices are
methods to ensure that the system administrator has the training to fulfill the responsibilities
included in the job description.

Question 181

Which of the following is the MOST important element of an information security strategy?
A. Defined objectives
B. Time frames for delivery
C. Adoption of a control framework
D. Complete policies

Answer 181

Answer: A
Explanation:
Without defined objectives, a strategy — the plan to achieve objectives — cannot be developed.
Time frames for delivery are important but not critical for inclusion in the strategy document.
Similarly, the adoption of a control framework is not critical to having a successful information
security strategy. Policies are developed subsequent to, and as a part of, implementing a strategy.

Question 182

A multinational organization operating in fifteen countries is considering implementing an information security program. Which factor will MOST influence the design of the Information
security program?
A. Representation by regional business leaders
B. Composition of the board
C. Cultures of the different countries
D. IT security skills

Answer 182

Answer: C
Explanation:
Culture has a significant impact on how information security will be implemented. Representation
by regional business leaders may not have a major influence unless it concerns cultural issues.
Composition of the board may not have a significant impact compared to cultural issues. IT
security skills are not as key or high impact in designing a multinational information security
program as would be cultural issues.

Question 183

Which of the following is the BEST justification to convince management to invest in an information security program?
A. Cost reduction
B. Compliance with company policies
C. Protection of business assets
D. Increased business value

Answer 183

Answer: D
Explanation:
Investing in an information security program should increase business value and confidence. Cost
reduction by itself is rarely the motivator for implementing an information security program.
Compliance is secondary to business value. Increasing business value may include protection of
business assets.

Question 184

On a company’s e-commerce web site, a good legal statement regarding data privacy should include:
A. a statement regarding what the company will do with the information it collects.
B. a disclaimer regarding the accuracy of information on its web site.
C. technical information regarding how information is protected.
D. a statement regarding where the information is being hosted.

Answer 184

Answer: A
Explanation:
Most privacy laws and regulations require disclosure on how information will be used. A disclaimer
is not necessary since it does not refer to data privacy. Technical details regarding how
information is protected are not mandatory to publish on the web site and in fact would not be
desirable. It is not mandatory to say where information is being hosted.

Question 185

Which of the following would be MOST helpful to achieve alignment between information security and organization objectives?
A. Key control monitoring
B. A robust security awareness program
C. A security program that enables business activities
D. An effective security architecture

Answer 185

Answer: C
Explanation:
A security program enabling business activities would be most helpful to achieve alignmentbetween information security and organization objectives. All of the other choices are part of thesecurity program and would not individually and directly help as much as the security program.

Question 186

Which of the following BEST contributes to the development of a security governance framework that supports the maturity model concept?
A. Continuous analysis, monitoring and feedback
B. Continuous monitoring of the return on security investment (ROSD
C. Continuous risk reduction
D. Key risk indicator (KRD setup to security management processes

Answer 186

Answer: A
Explanation:
To improve the governance framework and achieve a higher level of maturity, an organization
needs to conduct continuous analysis, monitoring and feedback compared to the current state of
maturity. Return on security investment (ROSD may show the performance result of the security related
activities; however, the result is interpreted in terms of money and extends to multiple
facets of security initiatives. Thus, it may not be an adequate option. Continuous risk reduction
would demonstrate the effectiveness of the security governance framework, but does not indicate
a higher level of maturity. Key risk indicator (KRD setup is a tool to be used in internal control
assessment. KRI setup presents a threshold to alert management when controls are being
compromised in business processes. This is a control tool rather than a maturity model support
tool.

Question 187

The MOST complete business case for security solutions is one that.
A. includes appropriate justification.
B. explains the current risk profile.
C. details regulatory requirements.
D. identifies incidents and losses.

Answer 187

Answer: A
Explanation:
Management is primarily interested in security solutions that can address risks in the most cost effective
way. To address the needs of an organization, a business case should address
appropriate security solutions in line with the organizational strategy.

Question 188

Which of the following is MOST important to understand when developing a meaningful information security strategy?
A. Regulatory environment
B. International security standards
C. Organizational risks
D. Organizational goals

Answer 188

Answer: D
Explanation:
Alignment of security with business objectives requires an understanding of what an organization
is trying to accomplish. The other choices are all elements that must be considered, but their
importance is secondary and will vary depending on organizational goals.

Question 189

Which of the following is the BEST advantage of a centralized information security organizational structure?
A. It allows for a common level of assurance across the enterprise.
B. It is easier to manage and control business unit security teams.
C. It is more responsive to business unit needs.
D. It provides a faster turnaround for security waiver requests.

Answer 189

Answer: B
Explanation:
It is easier to manage and control a centralized structure. Promoting security awareness is an
advantage of decentralization. Decentralization allows you to use field security personnel as
security missionaries or ambassadors to spread the security awareness message. Decentralized
operations allow security administrators to be more responsive. Being close to the business allows
decentralized security administrators to achieve a faster turnaround than that achieved in a
centralized operation.

Question 190

Which of the following would help to change an organization’s security culture?
A. Develop procedures to enforce the information security policy
B. Obtain strong management support
C. Implement strict technical security controls
D. Periodically audit compliance with the information security policy

.

Answer 190

Answer: B
Explanation:
Management support and pressure will help to change an organization’s culture. Procedures will
support an information security policy, but cannot change the culture of the organization. Technical
controls will provide more security to an information system and staff; however, this does not
mean the culture will be changed. Auditing will help to ensure the effectiveness of the information
security policy; however, auditing is not effective in changing the culture of the company.

Question 191

The BEST way to justify the implementation of a single sign-on (SSO) product is to use:
A. return on investment (ROI).
B. a vulnerability assessment.
C. annual loss expectancy (ALE).
D. a business case.

Answer 191

Answer: D
Explanation:
A business case shows both direct and indirect benefits, along with the investment required and
the expected returns, thus making it useful to present to senior management. Return on
investment (ROD would only provide the costs needed to preclude specific risks, and would not
provide other indirect benefits such as process improvement and learning. A vulnerability
assessment is more technical in nature and would only identify and assess the vulnerabilities. This
would also not provide insights on indirect benefits. Annual loss expectancy (ALE) would not
weigh the advantages of implementing single sign-on (SSO) in comparison to the cost of
implementation

Question 192

The FIRST step in establishing a security governance program is to:
A. conduct a risk assessment.
B. conduct a workshop for all end users.
C. prepare a security budget.
D. obtain high-level sponsorship.

Answer 192

Answer: D
Explanation:
The establishment of a security governance program is possible only with the support and
sponsorship of top management since security governance projects are enterprise wide and
integrated into business processes. Conducting a risk assessment, conducting a workshop for all
end users and preparing a security budget all follow once high-level sponsorship is obtained.

Question 193

An IS manager has decided to implement a security system to monitor access to the Internet and prevent access to numerous sites. Immediately upon installation, employees flood the IT helpdesk
with complaints of being unable to perform business functions on Internet sites. This is an example of:
A. conflicting security controls with organizational needs.
B. strong protection of information resources.
C. implementing appropriate controls to reduce risk.
D. proving information security’s protective abilities.

Answer 193

Answer: A
Explanation:
The needs of the organization were not taken into account, so there is a conflict. This example is
not strong protection; it is poorly configured. Implementing appropriate controls to reduce risk is
not an appropriate control as it is being used. This does not prove the ability to protect, but proves
the ability to interfere with business.

Question 194

An organization’s information security strategy should be based on:
A. managing risk relative to business objectives.
B. managing risk to a zero level and minimizing insurance premiums.
C. avoiding occurrence of risks so that insurance is not required.
D. transferring most risks to insurers and saving on control costs.

Answer 194

Answer: A
Explanation:
Organizations must manage risks to a level that is acceptable for their business model, goals and
objectives. A zero-level approach may be costly and not provide the effective benefit of additional
revenue to the organization. Long-term maintenance of this approach may not be cost effective.
Risks vary as business models, geography, and regulatory- and operational processes change.
Insurance covers only a small portion of risks and requires that the organization have certain
operational controls in place.

Question 195

Which of the following should be included in an annual information security budget that is submitted for management approval?
A. A cost-benefit analysis of budgeted resources
B. All of the resources that are recommended by the business
C. Total cost of ownership (TCO)
D. Baseline comparisons

Answer 195

Answer: A
Explanation:
A brief explanation of the benefit of expenditures in the budget helps to convey the context of how
the purchases that are being requested meet goals and objectives, which in turn helps build
credibility for the information security function or program. Explanations of benefits also help
engage senior management in the support of the information security program. While the budget
should consider all inputs and recommendations that are received from the business, the budget
that is ultimately submitted to management for approval should include only those elements that
are intended for purchase. TCO may be requested by management and may be provided in an
addendum to a given purchase request, but is not usually included in an annual budget. Baseline
comparisons (cost comparisons with other companies or industries) may be useful in developing a
budget or providing justification in an internal review for an individual purchase, but would not be
included with a request for budget approval.

Question 196

Which of the following is a benefit of information security governance?
A. Reduction of the potential for civil or legal liability
B. Questioning trust in vendor relationships
C. Increasing the risk of decisions based on incomplete management information
D. Direct involvement of senior management in developing control processes

Answer 196

Answer: A

Explanation:
Information security governance decreases the risk of civil or legal liability. The remaining answers
are incorrect. Option D appears to be correct, but senior management would provide oversight and
approval as opposed to direct involvement in developing control processes.

Question 197

Investment in security technology and processes should be based on:
A. clear alignment with the goals and objectives of the organization.
B. success cases that have been experienced in previous projects.
C. best business practices.
D. safeguards that are inherent in existing technology.

Answer 197

Answer: A
Explanation:
Organization maturity level for the protection of information is a clear alignment with goals and
objectives of the organization. Experience in previous projects is dependent upon other business
models which may not be applicable to the current model. Best business practices may not be
applicable to the organization’s business needs. Safeguards inherent to existing technology are
low cost but may not address all business needs and/or goals of the organization.

Question 198

The data access requirements for an application should be determined by the:
A. legal department.
B. compliance officer.
C. information security manager.
D. business owner.

Answer 198

Answer: D
Explanation:
Business owners are ultimately responsible for their applications. The legal department,
compliance officer and information security manager all can advise, but do not have final
responsibility.

Question 199

From an information security perspective, information that no longer supports the main purpose of the business should be:
A. analyzed under the retention policy.
B. protected under the information classification policy.
C. analyzed under the backup policy.
D. protected under the business impact analysis (BIA).

Answer 199

Answer: A
Explanation:
Option A is the type of analysis that will determine whether the organization is required to maintain
the data for business, legal or regulatory reasons. Keeping data that are no longer required
unnecessarily consumes resources, and, in the case of sensitive personal information, can
increase the risk of data compromise. Options B. C and D are attributes that should be considered
in the destruction and retention policy. A BIA could help determine that this information does not
support the main objective of the business, but does not indicate the action to take.

Question 200

The organization has decided to outsource the majority of the IT department with a vendor that is hosting servers in a foreign country. Of the following, which is the MOST critical security consideration?
A. Laws and regulations of the country of origin may not be enforceable in the foreign country.
B. A security breach notification might get delayed due to the time difference.
C. Additional network intrusion detection sensors should be installed, resulting in an additional cost.
D. The company could lose physical control over the server and be unable to monitor the physical
security posture of the servers.

Answer 200

Answer: A
Explanation:
A company is held to the local laws and regulations of the country in which the company resides,
even if the company decides to place servers with a vendor that hosts the servers in a foreign
country. A potential violation of local laws applicable to the company might not be recognized or
rectified (i.e., prosecuted) due to the lack of knowledge of the local laws that are applicable and
the inability to enforce the laws. Option B is not a problem. Time difference does not play a role in
a 24/7 environment. Pagers, cellular phones, telephones, etc. are usually available to
communicate notifications. Option C is a manageable problem that requires additional funding, but
can be addressed. Option D is a problem that can be addressed. Most hosting providers have
standardized the level of physical security that is in place. Regular physical audits or a SAS 70
report can address such concerns.

Question 201

Effective IT governance is BEST ensured by:
A. utilizing a bottom-up approach.
B. management by the IT department.
C. referring the matter to the organization’s legal department.
D. utilizing a top-down approach.

Answer 201

Answer: D
Explanation:
Effective IT governance needs to be a top-down initiative, with the board and executive
management setting clear policies, goals and objectives and providing for ongoing monitoring of
the same. Focus on the regulatory issues and management priorities may not be reflected
effectively by a bottom-up approach. IT governance affects the entire organization and is not a
matter concerning only the management of IT. The legal department is part of the overall
governance process, but cannot take full responsibility.

Question 202

The FIRST step to create an internal culture that focuses on information security is to:
A. implement stronger controls.
B. conduct periodic awareness training.
C. actively monitor operations.
D. gain the endorsement of executive management.

Answer 202

Answer: D
Explanation:
Endorsement of executive management in the form of policies provides direction and awareness.
The implementation of stronger controls may lead to circumvention. Awareness training is
important, but must be based on policies. Actively monitoring operations will not affect culture at all
levels.

Question 203

Which of the following is the BEST method or technique to ensure the effective implementation of an information security program?
A. Obtain the support of the board of directors.
B. Improve the content of the information security awareness program.
C. Improve the employees’ knowledge of security policies.
D. Implement logical access controls to the information systems.

Answer 203

Answer: A
Explanation:
It is extremely difficult to implement an information security program without the aid and support of
the board of directors. If they do not understand the importance of security to the achievement of
the business objectives, other measures will not be sufficient. Options B and (‘ are measures
proposed to ensure the efficiency of the information security program implementation, but are of
less significance than obtaining the aid and support of the board of directors. Option D is a
measure to secure the enterprise information, but by itself is not a measure to ensure the broader
effectiveness of an information security program.

Question 204

When an organization is implementing an information security governance program, its board of directors should be responsible for:
A. drafting information security policies.
B. reviewing training and awareness programs.
C. setting the strategic direction of the program.
D. auditing for compliance.

Answer 204

Answer: C
Explanation:
A board of directors should establish the strategic direction of the program to ensure that it is in
sync with the company’s vision and business goals. The board must incorporate the governance
program into the overall corporate business strategy. Drafting information security policies is best
fulfilled by someone such as a security manager with the expertise to bring balance, scope and
focus to the policies. Reviewing training and awareness programs may best be handled by
security management and training staff to ensure that the training is on point and follows best
practices. Auditing for compliance is best left to the internal and external auditors to provide an
objective review of the program and how it meets regulatory and statutory compliance.

Question 205

A risk assessment and business impact analysis (BIA) have been completed for a major proposed purchase and new process for an organization. There is disagreement between the information
security manager and the business department manager who will own the process regarding the results and the assigned risk. Which of the following would be the BEST approach of the information security manager?
A. Acceptance of the business manager’s decision on the risk to the corporation
B. Acceptance of the information security manager’s decision on the risk to the corporation
C. Review of the assessment with executive management for final input
D. A new risk assessment and BIA are needed to resolve the disagreement

Answer 205

Answer: C
Explanation:
Executive management must be supportive of the process and fully understand and agree with the
results since risk management decisions can often have a large financial impact and require major
changes. Risk management means different things to different people, depending upon their role
in the organization, so the input of executive management is important to the process.

Question 206

Who is responsible for ensuring that information is categorized and that specific protective measures are taken?
A. The security officer
B. Senior management
C. The end user
D. The custodian

Answer 206

Answer: B
Explanation:
Routine administration of all aspects of security is delegated, but top management must retain
overall responsibility. The security officer supports and implements information security for senior
management. The end user does not perform categorization. The custodian supports and
implements information security measures as directed.

Question 207

An organization’s board of directors has learned of recent legislation requiring organizations within the industry to enact specific safeguards to protect confidential customer information. What actions should the board take next?
A. Direct information security on what they need to do
B. Research solutions to determine the proper solutions
C. Require management to report on compliance
D. Nothing; information security does not report to the board

Answer 207

Answer: C
Explanation:
Information security governance is the responsibility of the board of directors and executive
management. In this instance, the appropriate action is to ensure that a plan is in place for
implementation of needed safeguards and to require updates on that implementation.

Question 208

Information security should be:
A. focused on eliminating all risks.
B. a balance between technical and business requirements.
C. driven by regulatory requirements.
D. defined by the board of directors.

Answer 208

Answer: B
Explanation:
Information security should ensure that business objectives are met given available technical
capabilities, resource constraints and compliance requirements. It is not practical or feasible to
eliminate all risks. Regulatory requirements must be considered, but are inputs to the business
considerations. The board of directors does not define information security, but provides direction
in support of the business goals and objectives.

Question 209

What is the MOST important factor in the successful implementation of an enterprise wide information security program?
A. Realistic budget estimates
B. Security awareness
C. Support of senior management
D. Recalculation of the work factor

Answer 209

Answer: C
Explanation:
Without the support of senior management, an information security program has little chance of
survival. A company’s leadership group, more than any other group, will more successfully drive
the program. Their authoritative position in the company is a key factor. Budget approval, resource
commitments, and companywide participation also require the buy-in from senior management.
Senior management is responsible for providing an adequate budget and the necessary
resources. Security awareness is important, but not the most important factor. Recalculation of the
work factor is a part of risk management.

Question 210

What is the MAIN risk when there is no user management representation on the Information Security Steering Committee?
A. Functional requirements are not adequately considered.
B. User training programs may be inadequate.
C. Budgets allocated to business units are not appropriate.
D. Information security plans are not aligned with business requirements

Answer 210

Answer: D
Explanation:
The steering committee controls the execution of the information security strategy, according to
the needs of the organization, and decides on the project prioritization and the execution plan.
User management is an important group that should be represented to ensure that the information
security plans are aligned with the business needs. Functional requirements and user training
programs are considered to be part of the projects but are not the main risks. The steering
committee does not approve budgets for business units.

Question 211

The MAIN reason for having the Information Security Steering Committee review a new security controls implementation plan is to ensure that:
A. the plan aligns with the organization’s business plan.
B. departmental budgets are allocated appropriately to pay for the plan.
C. regulatory oversight requirements are met.
D. the impact of the plan on the business units is reduced.

Answer 211

Answer: A
Explanation:
The steering committee controls the execution of the information security strategy according to the
needs of the organization and decides on the project prioritization and the execution plan. The
steering committee does not allocate department budgets for business units. While ensuring that
regulatory oversight requirements are met could be a consideration, it is not the main reason for
the review. Reducing the impact on the business units is a secondary concern but not the main
reason for the review.

Question 212

Which of the following should be determined while defining risk management strategies?
A. Risk assessment criteria
B. Organizational objectives and risk appetite
C. IT architecture complexity
D. Enterprise disaster recovery plans

Answer 212

Answer: B
Explanation:
While defining risk management strategies, one needs to analyze the organization’s objectives and risk appetite and define a risk management framework based on this analysis. Some
organizations may accept known risks, while others may invest in and apply mitigation controls to reduce risks. Risk assessment criteria would become part of this framework, but only after proper analysis. IT architecture complexity and enterprise disaster recovery plans are more directly related to assessing risks than defining strategies.

Question 213

When implementing effective security governance within the requirements of the company’s security strategy, which of the following is the MOST important factor to consider?
A. Preserving the confidentiality of sensitive data
B. Establishing international security standards for data sharing
C. Adhering to corporate privacy standards
D. Establishing system manager responsibility for information security

Answer 213

Answer: A
Explanation:
The goal of information security is to protect the organization’s information assets. International security standards are situational, depending upon the company and its business. Adhering to corporate privacy standards is important, but those standards must be appropriate and adequate and are not the most important factor to consider. All employees are responsible for information security, but it is not the most important factor to consider.

Question 214

Which of the following is the BEST reason to perform a business impact analysis (BIA)?
A. To help determine the current state of risk
B. To budget appropriately for needed controls
C. To satisfy regulatory requirements
D. To analyze the effect on the business

Answer 214

Answer: A
Explanation:
The BIA is included as part of the process to determine the current state of risk and helps
determine the acceptable levels of response from impacts and the current level of response,
leading to a gap analysis. Budgeting appropriately may come as a result, but is not the reason to
perform the analysis. Performing an analysis may satisfy regulatory requirements, bill is not the
reason to perform one. Analyzing the effect on the business is part of the process, but one must
also determine the needs or acceptable effect or response.

Question 215

Which of the following BEST enables the deployment of consistent security throughout international branches within a multinational organization?
A. Maturity of security processes
B. Remediation of audit findings
C. Decentralization of security governance
D. Establishment of security governance

Answer 215

Answer: D

Question 216

Which of the following is the BEST way to determine if an information security program aligns with corporate governance?
A. Evaluate funding for security initiatives.
B. Survey end users about corporate governance.
C. Review information security policies.
D. Review the balanced scorecard.

Answer 216

Answer: C
One of the most important aspects of the action plan to execute the strategy is to create or modify,
as needed, policies and standards. Policies are one of the primary elements of governance and
each policy should state only one general security mandate. The road map should show the steps
and the sequence, dependencies, and milestones.

Question 217

Security governance is MOST associated with which of the following IT infrastructure components?
A. Network
B. Application
C. Platform
D. Process

Answer 217

Answer: D

Question 218

Which of the following is the PRIMARY advantage of having an established information security governance framework in place when an organization is adopting emerging technologies?
A. An emerging technologies strategy would be in place.
B. An effective security risk management process is established.
C. End-user acceptance of emerging technologies has been established.
D. A cost-benefit analysis process would be easier to perform.

Answer 218

Answer: B

Question 219

Which of the following is the MOST appropriate board-level activity for information security governance?
A. Establish security and continuity ownership.
B. Develop “what-if” scenarios on incidents.
C. Establish measures for security baselines.
D. Include security in job-performance appraisals.

Answer 219

Answer: A

Question 220

Business units within an organization are resistant to proposed changes to the information security program. Which of the following is the BEST way to address this issue?
A. Implementing additional security awareness training
B. Communicating critical risk assessment results to business unit managers
C. Including business unit representation on the security steering committee
D. Publishing updated information security policies

Answer 220

Answer: B

Question 221

In addition to business alignment and security ownership, which of the following is MOST critical for information security governance?
A. Auditability of systems
B. Compliance with policies
C. Reporting of security metrics
D. Executive sponsorship

Answer 221

Answer: A

Question 222

Senior management has allocated funding to each of the organization’s divisions to address information security vulnerabilities. The funding is based on each division’s technology budget from the previous fiscal year. Which of the following should be of GREATEST concern to the
information security manager?
A. Areas of highest risk may not be adequately prioritized for treatment.
B. Redundant controls may be implemented across divisions.
C. Information security governance could be decentralized by division.
D. Return on investment may be inconsistently reported to senior management.

Answer 222

Answer: A

Question 223

The effectiveness of an information security governance framework will BEST be enhanced if:
A. IS auditors are empowered to evaluate governance activities.
B. risk management is built into operational and strategic activities.
C. a culture of legal and regulatory compliance is promoted by management.
D. consultants review the information security governance framework.

Answer 223

Answer: D

Question 224

When developing an information security governance framework, which of the following would be the MAIN impact when lacking senior management involvement?
A. Accountability for risk treatment is not clearly defined.
B. Information security responsibilities are not communicated effectively.
C. Resource requirements are not adequately considered.
D. Information security plans do not support business requirements.

Answer 224

Answer: C

Question 225

Which of the following is the BEST way to facilitate the alignment between an organization’s information security program and business objectives?
A. Information security is considered at the feasibility stage of all IT projects.
B. The information security governance committee includes representation from key business areas.
C. The chief executive officer reviews and approves the information security program.
D. The information security program is audited by the internal audit department.

Answer 225

Answer: B

Question 226

The effectiveness of the information security process is reduced when an outsourcing organization:
A. is responsible for information security governance activities.
B. receives additional revenue when security service levels are met.
C. incurs penalties for failure to meet security service-level agreements.
D. standardizes on a single access-control software product.

Answer 226

Answer: A

Question 227

What should be an information security manager’s FIRST course of action when an organization is subject to a new regulatory requirement?
A. Perform a gap analysis
B. Complete a control assessment
C. Submit a business case to support compliance
D. Update the risk register

Answer 227

Answer: A

Question 228

Internal audit has reported a number of information security issues which are not in compliance with regulatory requirements. What should the information security manager do FIRST?
A. Create a security exception
B. Perform a vulnerability assessment
C. Perform a gap analysis to determine needed resources
D. Assess the risk to business operations

Answer 228

Answer: C

Question 229

Which of the following is the MOST important reason for an organization to develop an information security governance program?
A. Establishment of accountability
B. Compliance with audit requirements
C. Monitoring of security incidents
D. Creation of tactical solutions

Answer 229

Answer: B

Question 230

The PRIMARY purpose of aligning information security with corporate governance objectives is to:
A. build capabilities to improve security processes.
B. consistently manage significant areas of risk.
C. identify an organization’s tolerance for risk.
D. re-align roles and responsibilities.

Answer 230

Answer: A

Question 231

Which of the following is the MOST important consideration for designing an effective information security governance framework?
A. Defined security metrics
B. Continuous audit cycle
C. Security policy provisions
D. Security controls automation

Answer 231

Answer: A

Question 232

The PRIMARY goal of information security governance to an organization is to:
A. align with business processes
B. align with business objectives
C. establish a security strategy
D. manage security costs

Answer 232

Answer: B

Question 233

Which of the following is the BEST way to integrate information security into corporate governance?
A. Engage external security consultants in security initiatives.
B. Conduct comprehensive information security management training for key stakeholders.
C. Ensure information security processes are part of the existing management processes.
D. Require periodic security risk assessments be performed.

Answer 233

Answer: C

Question 234

Which of the following is the MOST effective way of ensuring that business units comply with an information security governance framework?
A. Integrating security requirements with processes
B. Performing security assessments and gap analysis
C. Conducting a business impact analysis (BIA)
D. Conducting information security awareness training

Answer 234

Answer: B

Question 235

Which of the following BEST demonstrates alignment between information security governance and corporate governance?
A. Average number of security incidents across business units
B. Security project justifications provided in terms of business value
C. Number of vulnerabilities identified for high-risk information assets
D. Mean time to resolution for enterprise-wide security incidents

Answer 235

Answer: B

Question 236

The MOST important element in achieving executive commitment to an information security governance program is:
A. a defined security framework
B. identified business drivers
C. established security strategies
D. a process improvement model

Answer 236

Answer: B

Question 237

After implementing an information security governance framework, which of the following would provide the BEST information to develop an information security project plan?
A. Risk heat map
B. Recent audit results
C. Balanced scorecard
D. Gap analysis

Answer 237

Answer: C

Question 238

An information security manager’s PRIMARY objective for presenting key risks to the board of directors is to:
A. meet information security compliance requirements.
B. ensure appropriate information security governance.
C. quantity reputational risks.
D. re-evaluate the risk appetite.

Answer 238

Answer: B

Question 239

Which of the following is MOST helpful in integrating information security governance with corporate governance?
A. Assigning the implementation of information security governance to the steering committee.
B. Including information security processes within operational and management processes.
C. Providing independent reports of information security efficiency and effectiveness to the board.
D. Aligning the information security governance to a globally accepted framework.

Answer 239

Answer: B

Question 240

Which of the following is the BEST way to align security and business strategies?
A. Include security risk as part of corporate risk management.
B. Develop a balanced scorecard for security.
C. Establish key performance indicators (KPIs) for business through security processes.
D. Integrate information security governance into corporate governance.

Answer 240

Answer: C

Question 241

When developing an information security governance framework, which of the following should be the FIRST activity?
A. Integrate security within the system’s development life-cycle process.
B. Align the information security program with the organization’s other risk and control activities.
C. Develop policies and procedures to support the framework.
D. Develop response measures to detect and ensure the closure of security breaches.

Answer 241

Answer: B

Question 242

Which of the following is the MOST effective way for senior management to support the integration of information security governance into corporate governance?
A. Develop the information security strategy based on the enterprise strategy.
B. Appoint a business manager as heard of information security.
C. Promote organization-wide information security awareness campaigns.
D. Establish a steering committee with representation from across the organization.

Answer 242

Answer: A

Question 243

Which of the following would BEST help to ensure the alignment between information security and business functions?
A. Developing information security polices
B. Establishing an information security governance committee
C. Establishing a security awareness program
D. Providing funding for information security efforts

Answer 243

Answer: B

Question 244

When establishing an information security governance framework, it is MOST important for an information security manager to understand:
A. the regulatory environment.
B. information security best practices.
C. the corporate culture.
D. risk management techniques.

Answer 244

Answer: A

Question 245

Which of the following is a PRIMARY responsibility of the information security governance function?
A. Defining security strategies to support organizational programs
B. Ensuring adequate support for solutions using emerging technologies
C. Fostering a risk-aware culture to strengthen the information security program
D. Advising senior management on optimal levels of risk appetite and tolerance

Answer 245

Answer: A

Question 246

Which of the following is the MOST important requirement for the successful implementation of security governance?
A. Implementing a security balanced scorecard
B. Performing an enterprise-wide risk assessment
C. Mapping to organizational strategies
D. Aligning to an international security framework

Answer 246

Answer: C

Question 247

A large organization is in the process of developing its information security program that involves working with several complex organizational functions. Which of the following will BEST enable the successful implementation of this program?
A. Security governance
B. Security policy
C. Security metrics
D. Security guidelines

Answer 247

Answer: A

Question 248

Which of the following is a PRIMARY responsibility of an information security governance committee?
A. Analyzing information security policy compliance reviews
B. Approving the purchase of information security technologies
C. Reviewing the information security strategy
D. Approving the information security awareness training strategy

Answer 248

Answer: C

Question 249

An information security manager discovers that the organization’s new information security policy is not being followed across all departments. Which of the following should be of GREATEST concern to the information security manager?
A. Different communication methods may be required for each business unit.
B. Business unit management has not emphasized the importance of the new policy.
C. The corresponding controls are viewed as prohibitive to business operations.
D. The wording of the policy is not tailored to the audience.

Answer 249

Answer: C

Question 250

An organization has detected potential risk emerging from noncompliance with new regulations in its industry. Which of the following is the MOST important reason to report this situation to senior management?
A. The risk profile needs to be updated.
B. An external review of the risk needs to be conducted.
C. Specific monitoring controls need to be implemented.
D. A benchmark analysis needs to be performed.

Answer 250

Answer: A

Question 251

Which of the following is the BEST way for an information security manager to identify compliance with information security policies within an organization?
A. Analyze system logs.
B. Conduct security awareness testing.
C. Perform vulnerability assessments.
D. Conduct periodic audits.

Answer 251

Answer: D

Question 252

The BEST way to encourage good security practices is to:
A. schedule periodic compliance audits.
B. discipline those who fail to comply with the security policy.
C. recognize appropriate security behavior by individuals.
D. publish the information security policy.

Answer 252

Answer: C

Question 253

Which of the following enables compliance with a nonrepudiation policy requirement for electronic transactions?
A. Digital certificates
B. Digital signatures
C. Encrypted passwords
D. One-time passwords

Answer 253

Answer: B

Question 254

Which of the following is the BEST approach to identify noncompliance issues with legal, regulatory, and contractual requirements?
A. Risk assessment
B. Business impact analysis (BIA)
C. Vulnerability assessment
D. Gap analysis

Answer 254

Answer: D

Question 255

A new version of an information security regulation is published that requires an organization’s compliance. The information security manager should FIRST:
A. perform an audit based on the new version of the regulation.
B. conduct a risk assessment to determine the risk of noncompliance.
C. conduct benchmarking against similar organizations.
D. perform a gap analysis against the new regulation.

Answer 255

Answer: D

Question 256

When an organization and its IT-hosting service provider are establishing a contract with each other, it is MOST important that the contract includes:
A. details of expected security metrics.
B. each party’s security responsibilities.
C. penalties for noncompliance with security policy.
D. recovery time objectives (RTOs).

Answer 256

Answer: B

Question 257

It’s very important when organization start work with third party before signing the SLA negotiate the company current security needs and new security risk. Which of the following would be MOST useful to help senior management understand the status of information security compliance?
A. Industry benchmarks
B. Risk assessment results
C. Business impact analysis (BIA) results
D. Key performance indicators (KPIs)

Answer 257

Answer: D

Question 258

Which of the following is MOST likely to be included in an enterprise information security policy?
A. Security monitoring strategy
B. Audit trail review requirements
C. Password composition requirements
D. Consequences of noncompliance

Answer 258

Answer: D

Question 259

Which of the following BEST demonstrates that an organization supports information security governance?
A. Employees attend annual organization-wide security training.
B. Information security policies are readily available to employees.
C. The incident response plan is documented and tested regularly.
D. Information security steering committee meetings are held regularly.

Answer 259

Answer: D

Question 260

Which of the following should be the PRIMARY expectation of management when an organization introduces an information security governance framework?
A. Optimized information security resources
B. Consistent execution of information security strategy
c. Improved accountability to shareholders
D. Increased influence of security management

Answer 260

Answer: B

Question 261

Which of the following is the STRONGEST indicator of effective alignment between corporate governance and information security governance?
A. Senior management sponsors information security efforts.
B. Senior management requests periodic information security updates.
C. Key performance indicators (KPIs) for controls trend positively.
D. Information security initiatives meet scope. schedule, and budget.

Answer 261

Answer: C

Question 262

In information security governance, the PRIMARY role of the board of directors is to ensure:
A. approval of relevant policies and standards.
B. communication of security posture to stakeholders.
C. compliance with regulations and best practices.
D. alignment with the strategic goals of the organization.

Answer 262

Answer: D

Question 263

Which of the following is the BEST evidence that an organization’s information security governance framework is effective?
A. Threats to the organization have diminished.
B. The risk register is reviewed annually.
C. The framework focuses primarily on technical controls.
D. The framework can adapt to organizational changes.

Answer 263

Answer: A

Question 264

An organization enacted several information security policies to satisfy regulatory requirements. Which of the following situations would MOST likely increase the probability of noncompliance to these requirements?
A. Inadequate buy-in from system owners to support the policies
B. Availability of security policy documents on a public website
C. Lack of training for end users on security policies
D. Lack of an information security governance framework

Answer 264

Answer: A

Question 265

When creating an information security governance program, which of the following will BEST enable the organization to address regulatory compliance requirements?
A. Guidelines for processes and procedures
B. A security control framework
C. An approved security strategy plan
D. Input from the security steering committee

Answer 265

Answer: A

Question 266

Which of the following is MOST important when establishing a successful information security governance framework?
A. Selecting information security steering committee members
B. Developing an information security strategy
C. Determining balanced scorecard metrics for information security
D. Identifying information security risk scenarios

Answer 266

Answer: B

Question 267

Which of the following is MOST critical for an effective information security governance framework?
A. Board members are committed to the information security program.
B. Information security policies are reviewed on a regular basis.
C. The information security program is continually monitored.
D. The CIO is accountable for the information security program.

Answer 267

Answer: A

Question 268

Which of the following is the BEST approach for an information security manager when developing new information security policies?
A. Create a stakeholder map.
B. Reference an industry standard.
C. Establish an information security governance committee.
D. Download a policy template.

Answer 268

Answer: C

Question 269

When supporting a large corporation’s board of directors in the development of governance, which of the following is the PRIMARY function of the information security manager?
A. Gaining commitment of senior management
B. Preparing the security budget
C. Providing advice and guidance
D. Developing a balanced scorecard

Answer 269

Answer: C

Question 270

When making an outsourcing decision, which of the following functions is MOST important to retain within the organization?
A. Security management
B. Incident response
C. Risk assessment
D. Security governance

Answer 270

Answer: D

Question 271

Which of the following would be MOST important to consider when implementing security settings for a new system?
A. Results from internal and external audits
B. Government regulations and related penalties
C. Business objectives and related IT risk
D. Industry best practices applicable to the business

Answer 271

Answer: C

Question 272

The MOST important outcome of information security governance is:
A. business risk avoidance.
B. informed decision making.
C. alignment with business goals.
D. alignment with compliance requirements.

Answer 272

Answer: C

Question 273

Senior management commitment and support will MOST likely be offered when the value of information security governance is presented from a:
A. threat perspective.
B. compliance perspective.
C. risk perspective.
D. policy perspective.

Answer 273

Answer: D

Question 274

Within a security governance framework, which of the following is the MOST important characteristic of the information security committee? The committee:
A. conducts frequent reviews of the security policy
B. has established relationships with external professionals
C. has a clearly defined charter and meeting protocols
D. includes a mix of members from all levels of management

Answer 274

Answer: D

Question 275

Which of the following is MOST important to the successful implementation of an information security governance framework across the organization?
A. Organizational security controls deployed in line with regulations
B. Security management processes aligned with security objectives
C. The existing organizational security culture
D. Security policies that adhere to industry best practices

Answer 275

Answer: B

Question 276

Which of the following is the MOST effective way to achieve the integration of information security governance into corporate governance?
A. Align information security budget requests to organizational goals
B. Ensure information security efforts support business goals
C. Provide periodic IT balanced scorecards to senior management
D. Ensure information security aligns with IT strategy

Answer 276

Answer: A

Question 277

To gain a clear understanding of the impact that a new regulatory requirement will have on an organization’s information security controls, an information security manager should FIRST:
A. interview senior management
B. conduct a risk assessment
C. conduct a cost-benefit analysis
D. perform a gap analysis

Answer 277

Answer: D

Question 278

The PRIMARY purpose of implementing information security governance metrics is to:
A. measure alignment with best practices.
B. assess operational and program metrics.
C. refine control operations,
D. guide security towards the desired state.

Answer 278

Answer: D

Question 279

Which of the following MOST effectively helps an organization to align information security governance with corporate governance?
A. Promoting security as enabler to achieve business objectives
B. Prioritizing security initiatives based on IT strategy
C. Adopting global security standards to achieve business goals
D. Developing security performance metrics

Answer 279

Answer: A

Question 280

Which of the following is MOST helpful for aligning security operations with the IT governanceframework?
A. Information security policy
B. Security risk assessment
C. Security operations program
D. Business impact analysis (BIA)

Answer 280

Answer: A

Question 281

Which of the following is the BEST approach for an information security manager to effectively manage third-party risk?
A. Ensure controls are implemented to address changes in risk.
B. Ensure senior management has approved the vendor relationship.
C. Ensure risk management efforts are commensurate with risk exposure.
D. Ensure vendor governance controls are in place.

Answer 281

Answer: D

Question 282

When trying to integrate information security across an organization, the MOST important goal for a governing body should be to ensure:
A. the resources used for information security projects are kept to a minimum.
B. information security is treated as a business critical issue.
C. funding is approved for requested information security projects.
D. periodic information security audits are conducted.

Answer 282

Answer: B

Question 283

Which of the following should be the PRIMARY consideration when developing a security governance framework for an enterprise?
A. Understanding of the current business strategy
B.Assessment of the current security architecture
C. Results of a business impact analysis (BIA)
D. Benchmarking against industry best practice

Answer 283

Answer: A

Question 284

Who should decide the extent to which an organization will comply with new cybersecurity regulatory requirements?
A. Senior management
B. IT steering committee
C. Legal counsel
D. Information security manager

Answer 284

Answer: A

Question 285

Which of the following would BEST help an information security manager prioritize remediation activities to meet regulatory requirements?
A. A capability maturity model matrix
B. Annual loss expectancy (ALE) of noncompliance
C. Cost of associated controls
D. Alignment with the IT strategy

Answer 285

Answer: D

Question 286

Which of the following is the PRIMARY reason an information security strategy should be deployed across an organization?
A. To ensure that the business complies with security regulations
B. To ensure that management’s intent is reflected in security activities
C. To ensure that employees adhere to security standards
D. To ensure that security-related industry best practices are adopted

Answer 286

Answer: A

Question 287

Which of the following is the BEST option for addressing regulations that will adversely affect the allocation of information security program resources?
A. Prioritize compliance efforts based on probability.
B. Determine compliance levels of peer organizations.
C. Delay implementation of compliance activities.
D. Conduct assessments for management decisions

Answer 287

Answer: D

Question 288

Which of the following should an information security manager do FIRST after learning about a new regulation that affects the organization?
A. Evaluate the changes with legal counsel.
B. Notify the affected business units.
C. Assess the noncompliance risk.
D. Inform senior management of the new regulation.

Answer 288

Answer: A

Question 289

Which of the following should be the FIRST step to ensure an information security program meets the requirements of new regulations?
A. Validate the asset classification schema.
B. Integrate compliance into the risk management process.
C. Assess organizational security controls.
D. Conduct a gap analysis to determine necessary changes.

Answer 289

Answer: B

Question 290

Which of the following is MOST important to consider when handling digital evidence during the forensics investigation of a cybercrime?
A. Business strategies
B. Industry best practices
C. Global standards
D. Local regulations

Answer 290

Answer: D

Question 291

A legacy application does not comply with new regulatory requirements to encrypt sensitive data at rest, and remediating this issue would require significant investment. What should the
information security manager do FIRST?
A. Investigate alternative options to remediate the noncompliance.
B. Assess the business impact to the organization.
C. Present the noncompliance risk to senior management.
D. Determine the cost to remediate the noncompliance.

Answer 291

Answer: B

Question 292

During the establishment of a service level agreement (SLA) with a cloud service provider, it is MOST important for the information security manager to:
A. update the security policy to reflect the provider’s terms of service.
B. ensure security requirements are contractually enforceable.
C. set up proper communication paths with the provider.
D. understand the cloud storage architecture in use to determine security risk.

Answer 292

Answer: B

Question 293

An outsourced vendor handles an organization’s business-critical data.
Which of the following is the MOST effective way for the client organization to obtain assurance of the vendor’s security practices?
A. Verifying security certifications held by the vendor
B. Reviewing the vendor’s security audit reports
C. Requiring periodic independent third-party reviews
D. Requiring business continuity plans (BCPs) from the vendor

Answer 293

Answer: C

Question 294

Which of the following is MOST important when carrying out a forensic examination of a laptop to determine an employee’s involvement in a fraud?
A. The employee’s network access should be suspended.
B. the laptop should not be removed from the company premises.
C. An HR representative should be present during the laptop examination.
D. The investigation should be conducted on an image of the original disk drive.

Answer 294

Answer: D

Question 295

Which of the following is a PRIMARY responsibility of an information security steering committee?
A. Reviewing the information security strategy
B. Approving the information security awareness training strategy
C. Analyzing information security policy compliance reviews
D. Approving the purchase of information security technologies

Answer 295

Answer: A

Question 296

Which of the following BEST demonstrates that the objectives of an information security governance framework are being met?
A. Risk dashboard
B. Key performance indicators (KPIs)
C. Penetration test results
D. Balanced scorecard

Answer 296

Answer: D

Question 297

Which of the following would BEST enable integration of information security governance into corporate governance?
A. Ensuring appropriate business representation on the information security steering committee
B. Using a balanced scorecard to measure the performance of the information security strategy
C. Implementing IT governance, risk and compliance (IT GRC) dashboards
D. Having the CIO chair the information security steering committee

Answer 297

Answer: C

Question 298

Which of the following BEST enables effective information security governance?
A. Periodic vulnerability assessments
B. Established information security metrics
C. Advanced security technologies
D. Security-aware corporate culture

Answer 298

Answer: D

Question 299

The PRIMARY reason to classify information assets should be to ensure:
A. proper access control.
B. senior management buy-in.
C. insurance valuation is appropriate.
D. proper ownership is established.

Answer 299

Answer: D

Question 300

The MOST important factor in ensuring the success of an information security program is effective:
A. communication of information security requirements to all users in the organization.
B. formulation of policies and procedures for information security.
C. alignment with organizational goals and objectives.
D. monitoring compliance with information security policies and procedures.

Answer 300

Answer: C
Explanation:
The success of security programs is dependent upon alignment with organizational goals and
objectives. Communication is a secondary step. Effective communication and education of users
is a critical determinant of success but alignment with organizational goals and objectives is the
most important factor for success. Mere formulation of policies without effective communication to
users will not ensure success. Monitoring compliance with information security policies and
procedures can be, at best, a detective mechanism that will not lead to success in the midst of
uninformed users.

Question 301

An information security manager wants to improve the ability to identify changes in risk levels affecting the organization’s systems. Which of the following is the
BEST method to achieve this objective?
A. Performing business impact analyses (BIA)
B. Monitoring key goal indicators (KGIs)
C. Monitoring key risk indicators (KRIs)
D. Updating the risk register

Answer 301

C. Monitoring key risk indicators (KRIs)

Question 302

When developing an escalation process for an incident response plan, the information security manager should PRIMARILY consider the:
A. affected stakeholders.
B. incident response team.
C. availability of technical resources.
D. media coverage

Answer 302

A. affected stakeholders.

Question 303

Which of the following should be an information security managers MOST important consideration when determining if an information asset has been classified appropriately?
A. Value to the business
B. Security policy requirements
C. Ownership of information
D. Level of protection

Answer 303

A. Value to the business

Question 304

The effectiveness of an incident response team will be GREATEST when:
A. the incident response process is updated based on lessons learned.
B. the incident response team members are trained security personnel.
C. the incident response team meets on a regular basis to review log files.
D. incidents are identified using a security information and event monitoring (SIEM) system.

Answer 304

A. the incident response process is updated based on lessons learned

Question 305

An information security manager MUST have an understanding of the organization’s business goals to:
A. relate information security to change management.
B. develop an information security strategy.
C. develop operational procedures
D. define key performance indicators (KPIs).

Answer 305

D. define key performance indicators (KPIs).

Question 306

An attacker was able to gain access to an organization’s perimeter firewall and made changes to allow wider external access and to steal data. Which of the following would have BEST provided timely identification of this incident?
A. Implementing a data loss prevention (DLP) suite
B. Deploying an intrusion prevention system (IPS)
C. Deploying a security information and event management system (SIEM)
D. Conducting regular system administrator awareness training

Answer 306

C. Deploying a security information and event management system (SIEM)

Question 307

When establishing metrics for an information security program, the BEST approach is to identify indicators that:
A. support major information security initiatives.
B. reflect the corporate risk culture.
C. reduce information security program spending.
D. demonstrate the effectiveness of the security program.

Answer 307

D. demonstrate the effectiveness of the security program.

Question 308

For an organization that provides web-based services, which of the following security events would MOST likely initiate an incident response plan and be escalated to management?
A. Anti-malware alerts on several employeesג€™ workstations
B. Several port scans of the web server
C. Multiple failed login attempts on an employee’s workstation
D. Suspicious network traffic originating from the demilitarized zone (DMZ)

Answer 308

A. Anti-malware alerts on several employeesג€™ workstations

Question 309

An information security manager is implementing a bring your own device (BYOD) program. Which of the following would BEST ensure that users adhere to the security standards?
A. Publish the standards on the intranet landing page.
B. Deploy a device management solution.
C. Establish an acceptable use policy.
D. Monitor user activities on the network.

Answer : C

Answer 309

C. Establish an acceptable use policy.

Question 310

When monitoring the security of a web-based application, which of the following is MOST frequently reviewed?
A. Audit reports
B. Access logs
C. Access lists
D. Threat metrics

Answer : B

Answer 310

B. Access logs

Question 311

Which of the following is the MOST effective way for an information security manager to ensure that security is incorporated into an organization’s project development processes?
A. Develop good communications with the project management office (PMO).
B. Participate in project initiation, approval, and funding.
C. Conduct security reviews during design, testing, and implementation.

Answer 311

D. Integrate organizationג€™s security requirements into project management.

Question 312

Which of the following provides the MOST relevant information to determine the overall effectiveness of an information security program and underlying business processes?
A. SWOT analysis
B. Industry benchmarks
C. Cost-benefit analysis
D. Balanced scorecard

Answer : D

Answer 312

D. Balanced scorecard

Question 313

An organization finds unauthorized software has been installed on a number of workstations. The software was found to contain a Trojan, which had been uploading data to an unknown external party. Which of the following would have BEST prevented the installation of the unauthorized software?
A. Banning executable file downloads at the Internet firewall
B. Implementing an intrusion detection system (IDS)
C. Implementing application blacklisting
D. Removing local administrator rights

Answer 313

D. Removing local administrator rights

Question 314

When developing a tabletop test plan for incident response testing, the PRIMARY purpose of the scenario should be to:
A. measure management engagement as part of an incident response team.
B. provide participants with situations to ensure understanding of their roles.
C. give the business a measure of the organization’s overall readiness.
D. challenge the incident response team to solve the problem under pressure.

Answer 314

B. provide participants with situations to ensure understanding of their roles.