Deck 2 Flashcards
Which of the following is the BEST way to enhance training for incident response teams?
A. Conduct interviews with organizational units
B. establish incident key performance indicators (KPIs)
C. participate in emergency response activities
D. perform post-incident reviews
D
Which of the following is the BEST way to present the status of an information security program to senior management?
A. Detail latest security trends
B. display concise dashboards
C. provide detailed information regarding risk exposure
D. report on root causes of security incident
B
What would be an information security manager’s BEST recommendation upon learning that an existing contract with a third party does not clearly identify requirements for safeguarding the organization’s critical data?
A. Cancel the outsourcing contract
B. transfer the risk to the provider
C. create an addendum to the existing contract
D. initiate an external audit of the provider’s data center
C
An intrusion has been detected and contained. Which of the following steps represents the BEST practice for ensuring the integrity of the recovered system?
A. Restore the application and data from a forensic copy
B. install the OS, patches, and application from the original source
C. restore the OS, patches, and application from a backup
D. remove all signs of the intrusion from the OS and application
B
Which of the following is the GREATEST value provided by a security information and event management (SIEM) system?
A. Facilitating the monitoring of risk occurrences
B. measuring impact of exploits on business processes
C. maintaining A repository base of security policies
D. redirecting event logs to an alternate location for business continuity plan (BCP)
A
When performing a data classification project, an information security manager should:
A. assign information criticality and sensitivity
B. identify information custodians
C. identify information owners
D. assign information access privileges
A
Which of the following is the MOST effective way to help assure the integrity of an organization’s accounting system?
A. Performing frequent security reviews of the audit log
B. implementing 2 factor authentication
C. conducting an annual security audit of the system
D. providing security awareness training to accounting staff
A
Which of the following risk scenarios is MOST likely to emerge from a supply chain attack?
A. Unreliable delivery of hardware and software resources by a supplier
B. unavailability of services provided by a supplier
C. loss of customers due to availability of products
D. compromise of critical assets via third-party resources
D
Which of the following is the PRIMARY driver for determining the classification of application systems?
A. The cost of repairing damage to system elements
B. the extent that compromise can affect revenue
C. the cost to implement regulatory requirements
D. controlling access based on the need to know
D
Which Of the following service offerings in a typical infrastructure as a service (IaaS) model will BEST enable a cloud service provider to assist customers when recovering from a security incident?
A. Capability to take a snapshot of virtual machines
B. capability of online virtual machine analysis
C. availability of web application firewall logs
D. availability of current infrastructure documentation
A
An information security manager has contracted with a company to design security architecture for an application. Which of the following is accountable for identification associated with this initiative?
A. The project steering committee
B. the information security manager
C. the infrastructure management team
D. the application development team
B
Which of the following is the FIRST Step 2 establishing an effective information security program?
A. Assign accountability
B. perform a business impact analysis(BIA)
C. create a business case
D. conduct A compliance review
C
Which of the following provides the MOST relevant information to determine the overall effectiveness of an information security program and underlying business processes?
A. SWOT analysis
B. industry benchmarks
C. cost-benefit analysis
D. balanced scorecard
D
Application data integrity risk is MOST directly addressed by a design that includes:
A. strict application of an authorized data dictionary
B. reconciliation routine such as checksums, hash totals, and record counts
C. application log requirements such as field-level audit trails and user activity logs
D. access control technologies such as role-based entitlement
B
Which of the following would BEST ensure that security is integrated during application development?
A. Performing application security testing during acceptance testing
B. introducing security requirements during the initiation phase
C. employing global security standards during development processes
D. providing training on secure development practices to programmers
D
Which of the following should include contact information for representatives of equipment and software vendors?
A. Business continuity plan (BCP)
B. service level agreements (SLAs)
C. information security program charter
D. business impact analysis (BIA)
A
An organization finds unauthorized software has been installed on a number of workstations. The software was found to contain a Trojan, which had been uploading data to an unknown external party. Which of the following would have BEST prevented the installation of the unauthorized software?
A. Banning executable file downloads at the Internet firewall
B. implementing an intrusion detection system (IDS)
C. implementing application blacklisting
D. removing local administrator rights
D
Which of the following is the GREATEST risk of centralized information Security Administration within a multinational organization?
A. Slower turn around
B. less uniformity
C. less objectivity
D. violation of local law
C
Which of the following is the BEST reason to consolidate security operations teams across the global organization?
A. Compliance with regulatory requirements
B. enhanced visibility of threats
C. detection and fraud
D. cost reduction
B
Which of the following is the MOST appropriate resource to determine whether or not a particular solution should utilize encryption based on its location and data classification?
A. Guidelines
B. Procedures
C. Standards
D. Policies
C
If the inherent risk of a business activity is higher than the acceptable risk level, the information security manager should FIRST:
A. transfer risk to a third party to avoid cost of impact
B. recommend that management avoid the business activity
C. assess the gap between current and acceptable level of risk
D. implement controls to mitigate the risk to an acceptable level
C
Which of the following should be done FIRST when selecting performance metrics to report on the vendor risk management process?
A. Select the data source
B. review the confidentiality requirements
C. identify the intended audience
D. identify the data owner
C
When a critical system incident is reported, the FIRST step of the incident handler should be to:
A. power off the system
B. determine the scope of the incident
C. validate the incident
D. notify the appropriate parties
C
The information security manager of a multinational organization has been asked to consolidate the information security policies of its regional locations. Which of the following would be of GREATEST concern?
A. Varying threat environments
B. disparate reporting lines
C. conflicting legal requirements
D. differences in work culture
C
Which of the following BEST enables an organization to appropriately prioritize information security-focused projects?
A. Return on investment (ROI)
B. privacy compliance requirements
C. organizational risk appetite
D. historical security incidents
C
An organization’s disaster recovery plan (DRP) is documented and kept at a disaster recovery site. Which of the following is the BEST way to ensure the plan can be carried out in an emergency?
A. Require disaster recovery documentation be stored with all key decision makers
B. provide annual disaster recovery training to appropriate staff
C. maintain an outsource contact center in another country
D. store disaster recovery documentation in a public cloud
B
When collecting admissible evidence, which of the following is the MOST important requirement?
A. Need to know
B. due diligence
C. chain of custody
D. preserving audit logs
C
A software vendor has announced a zero-day vulnerability that exposes an organization’s critical business systems. The vendor has released an emergency patch. Which of the following should be the information security manager’s PRIMARY concern?
A. Ability to test the patch prior to deployment
B. adequacy of the incident response plan
C. availability of resources to implement controls
D. documentation of patching procedures
A
To prevent ransomware attacks, it in MOST important to ensure:
A. adequate backup and restoration processes are in place
B. regular security awareness training is conducted
C. the latest security appliances are installed
D. updated firewall software is installed
A
What is the role of the information security manager in finalizing contract negotiations with service providers?
A. To perform a risk analysis on the outsourcing process
B. to obtain a security standard certification from the provider
C. to update security standards for the outsourced process
D. to ensure that clauses for periodic audits are included
D
An information security policy was amended recently to support an organization’s new information security strategy. Which of the following should be the information security manager’s NEXT step?
A. Evaluate the alignment with business strategy
B. update standards and procedures
C. review technical controls
D. refresh the security training program
B
Which of the following is the MOST important consideration when reporting on the status of information security activities?
A. The report is comprehensive
B. the report is updated on a regular basis
C. the report is tailored to stakeholder needs
D. the report structure is consistent with industry standards
C
A newly appointed information security manager has been asked to update the security related policies and procedures that have been static for five years or more. What is the BEST next step?
A. To gain an understanding of the current business direction
B. to update in accordance with the best business practices
C. to perform a risk assessment of the current IT environment
D. to assess corporate culture
D
Which of the following should be the PRIMARY objective of the information security incident response process?
A. Classifying incidents
B. conducting incident triage
C. communicating with internal and external parties
D. minimizing negative impact to critical operations
D
How does an organization’s information security steering committee facilitate the achievement of information security program objectives?
A. Monitoring information security resources
B. making decisions on security priorities
C. enforcing regulatory and policy compliance
D. evaluating information security metrics
D
Which of the following is MOST important to the effectiveness of an information security program?
A. The program is aligned to legal and regulatory requirements
B. the program is aligned to a security control framework
C. annual audits of the program are conducted
D. users are trained on security policies and procedures
B
An executive’s personal mobile device used for business purposes is reported lost. The information security manager should respond based on:
A. the acceptable use policy
B. asset management guidelines
C. the business impact analysis (BIA)
D. incident classification
D
The PRIMARY Benefit of a centralized time server is that it:
A. decreases the likelihood of an unrecoverable systems failure
B. reduces individual time of day request by client applications
C. allows decentralized logs to be kept In synchronization
D. is required by password synchronization programs
C
Which of the following is the BEST way for an organization to ensure that incident response teams are properly prepared?
A. Documenting multiple scenarios for the organization and response steps
B. providing training from third party forensics firms
C. obtaining industry certifications for the response team
D. conducting tabletop exercises appropriate for the organization
D
Which of the following is MOST Important for building a robust information security culture within an organization?
A. Mature information security awareness training across the organization
B. security controls embedded within the development and operation of the IT environment
C. senior management approval of information security policies
D. strict enforcement of employee compliance with organizational security policies
A
When evaluating vendors for sensitive data processing, which of the following should be the FIRST step two ensure the correct level of information security is provided?
A. Develop metrics for vendor performance
B. include information security criteria as part of vendor selection
C. review third party reports of potential vendors
D. include information security clauses in the vendor contract
B
An information security manager discovers that the organization’s new information security policy is not being followed across all departments. Which of the following should be of GREATEST concern to the information security manager?
A. Business unit management has not emphasized the importance of the new policy
B. different communication methods may be required for each business unit
C. the wording of the policy is not tailored to the audience
D. the corresponding controls are viewed as prohibitive to business operations
D
Which of the following is the MOST relevant information to include in an information security risk report to facilitate senior management’s understanding of impact to the organization?
A. Detailed assessment of the security risk profile
B. risks inherent in new security technologies
C. findings from recent penetration testing
D. status of identified key security risks
C
Which of the following is the MOST Reliable way to ensure network security incidents are identified as soon as possible?
A. Install stateful inspection firewalls
B. conduct workshops and training sessions with end users
C. collect and correlate IT infrastructure event logs
D. train help desk staff to identify and prioritize security incidents
C
When preparing an information security policy for a global organization, how should an information security manager BEST address local legislation in multiple countries?
A. Rely on local interpretation of the global policy to comply with local legislation
B. create a policy exception process for each country
C. enforce the same global policy in every country
D. establish local policies for each country that supplement the global policy
D
When evaluating the risk from an external hackers the maximum exposure time would be the difference between:
A. log refresh and restoration
B. Identification and resolution
C. detection and response
D. compromise and containment
C
Which of the following is MOST important to include in monthly information security reports to the board?
A. Root cause analysis of security incidents
B. threat intelligence
C. risk assessment results
D. trend analysis of secure metrics
C
Which of the following has the GREATEST influence on an organization’s information security strategy?
A. Industry security standards
B. the organizational structure
C. the organization’s risk tolerance
D. information security awareness
C
Which of the following BEST Facilitates an information security manager’s efforts to obtain senior management commitment for an information security program?
A. Presenting evidence of inherent risk
B. reporting the security maturity level
C. presenting compliance requirements
D. communicating the residual risk
D
The business value of an information asset is derived from:
A. it’s replacement cost
B. the risk assessment
C. it’s criticality
D. the threat profile
C
Which of the following is the BEST Message to align and information security strategic plan to the corporate strategy?
A. Ensuring the plan complies with business unit expectations
B. involving industry experts in the development of the plan
C. involving senior management in the development of the plan
D. obtaining adequate funds from senior management
C
Which of the following is MOST likely to trigger an update and revision of information security policies?
A. Engagement with a new service provider
B. replacement of the information security manager
C. attainment of business process maturity
D. changes in the organization’s risk appetite
B
Which of the following is MOST Helpful for protecting an enterprise from advanced persistent threats (APTs)?
A. Updated security policies
B. regular antivirus updates
C. define security standards
D. threat intelligence
D
A data-hosting organization’s data center houses servers, applications, and data for a large number of geographically dispersed customers. Which of the following strategies is the BEST approach for developing a physical access control policy for the organization?
A. Review customers’ security policies
B. design single sign-on (SSO) or Federated access
C. develop access control requirements for each system and application
D. conductive risk assessment to determine security risks and mitigating controls
D
An organization permits the storage and use of its critical and sensitive information on employee-owned smartphones which of the following is the BEST security control?
A. Monitoring how often the smartphone is used
B. developing security awareness training
C. requiring the backup of the organization’s data by the user
D. establishing the authority to remove wipe
D
When developing a business case to justify an information security investment, which of the following would BEST enable an informed decision by senior management?
A. The information security strategy
B. security investment trends in the industry
C. losses due to security incidents
D. the results of a risk assessment
D
Security program development is PRIMARILY driven by which of the following?
A. Regulatory requirements
B. business strategy
C. risk appetite
D. available resources
C
When developing security processes for handling credit card data on the business units information system, the information security manager should FIRST:
A. ensure that systems that handle credit card data are segmented
B. review industry best practices for handling secure payments
C. ensure alignment with industry encryption standards
D. review corporate policies regarding credit card information
D
An organization’s main product is a customer facing application delivered using software as a service (SaaS). The lead security engineer has just identified a major security vulnerability at the primary cloud provider. Within the organization, who is PRIMARILY accountable for the associated risk?
A. The data owner
B. the information security manager
C. the security engineer
D. the application owner
B
Which of the following is the BEST Approach for managing user access permissions to ensure alignment with data classification?
A. Delegate the management of access permissions to an independent third party
B. review access permissions annually or whenever job responsibilities change
C. lockout accounts after a set number of unsuccessful login attempts
D. enable multi factor authentication on user and admin accounts
B
Which of the following is the GREATEST Benefit of integrating information security program requirements into vendor management?
A. The ability to meet industry compliance requirements
B. the ability to define service level agreements (SLAs)
C. the ability to reduce risk in the supply chain
D. the ability to improve vendor performance
C
In a call center, the BEST reason to conduct a social engineering exercise is to:
A. gain funding for information security initiatives
B. identify candidates for additional security training
C. improve password policy
D. minimize the likelihood of successful attacks
D
