Audits, Assessments, and Awareness

Question 1

What is a more cost-effective assessment solution that enables an organization’s audit activities to leverage a capable, independent internal validator who is well-versed in security assessment methodology?
A. Self-assessment with Independent Validation (SAIV)
B. Consensus Assessment Initiative Questionnaire (CAIQ)
C. Software Assurance Maturity Model (SAMM)
D. RACI charts

Answer 1

A. Self-assessment with Independent Validation (SAIV)

Question 2

What is the first step in the penetration testing lifecycle?
A. Rules of engagement agreement
B. Privilege escalation
C. Persistence
D. Reconnaissance

Answer 2

A. Rules of engagement agreement

Question 3

Which are used to certify security professionals at various experience levels to participate in auditing and assessments?
A. Security assertions
B. Security acknowledgement
C. Security examinations
D. Security assessments

Answer 3

C. Security examinations

Question 4

Which is a critical internal email hoax designed to replicate a real attack against employees as part of security awareness training?
A. Watering hole
B. Advanced persistent threat
C. Walkthrough test
D. Phishing campaign

Answer 4

D, Phishing campaign

Question 5

Which is considered the gold standard customer experience metric that measures participant loyalty by looking at their probability of recommending a given security training experience?
A. NPS
B. OWASP
C. PTES
D. SSAF

Answer 5

A. NPS
NPS stands for Net Promoter Score. It’s a widely used metric to gauge customer loyalty and satisfaction. By asking customers how likely they are to recommend a product or service, NPS provides valuable insights into overall customer experience. In the context of security training, a high NPS indicates that participants are satisfied with the training and are likely to recommend it to others.

Question 6

Which of these are common topics of user guidance and training? Choose more than one option.
A. Removable media and cables
B. Situational awareness
C. Password policies and management
D. Hybrid/remote worker acceptable use
E. VPN policy configuration
F. Datacenter switch hardening

Answer 6

A. Removable media and cables
B. Situational awareness
C. Password policies and management
D. Hybrid/remote worker acceptable use