Deck 3 Flashcards
An information security manager learns of a new standard related to an emerging technology the organization wants to implement. Which of the following should the information security manager recommend be done first?
A. Perform a risk assessment of the new technology
B. obtain legal counsels opinion on the standards applicability to regulations
C. determine whether the organization can benefit from adopting the new standard
D. Review industry specialists’ analyses of the new standard
A
Which of the following should an information security manager do first when a legacy application is not compliant with a regulatory requirement, but the business unit does not have the budget for remediation?
A. Develop a business case for funding remediation efforts
B. advise senior management to accept the risk of noncompliance
C. notify legal and internal audit of the non compliant legacy application
D. assess the consequences of non compliance against the cost of remediation
D
An information security manager has been tasked with developing materials to update the board, regulatory agencies, and the media about a security incident. Which of the following should the information security manager do first?
A. Invoke the organization’s incident response plan
B. set up communication channels for the target audience
C. create a comprehensive singular communication
D. determine the needs and requirements of each audience
D
Which of the following is the most important reason for an organization to develop an information security governance program?
A. Establishment of accountability
B. compliance with audit requirements
C. creation of tactical solutions
D. monitoring of security incident
A
When establishing metrics for an information security program, the BEST approach is to identify indicators that:
A. Support major information security initiatives
B. reflect the corporate risk culture
C. reduce information security program spending
D. demonstrate the effectiveness of the security program
D
Which of the following provides the most comprehensive information related to an organization’s current risk profile?
A. Gap analysis results
B. risk register
C. heat map
D. risk assessment results
D
Which type of recovery site is most reliable and can support stringent recovery requirements?
A. Cold site
B. warm site
C. Mobile site
D. Hot site
D
Which of the following is the PRIMARY reason that an information security manager should restrict the use of generic administrator accounts in a multi-user environment?
A. To prevent accountability issues
B. To ensure segregation of duties is maintained
C. To ensure system audit trails are not bypassed
D. To prevent unauthorized user access
A
Which of the following backup methods requires the MOST time to restore data for an application?
A. Disk mirroring
B. Differential
C. Incremental
D. Full backup
C
Which of the following is MOST important to do after a security incident has been verified?
A. Notify the appropriate law enforcement authorities of the incident
B. Follow the escalation process to inform key stakeholders
C. Prevent the incident from creating further damage to the organization
D. Contact forensic investigators to determine the root cause
B
Which of the following is MOST important to review following a security incident?
A. Incident response procedures
B. Response tools and techniques
C. Incident response plan
D. Lesson learned
D
An organization has experienced multiple instances of privileged users misusing their access. Which of the following processes would be MOST helpful in identifying such violations?
A. Policy exception review
B. Review of access controls
C. Security assessment
D. Log review
D
An IT department plans to migrate to the public cloud. Which of the following is the information security manager’s MOST important action in support of this initiative?
A. Review cloud provider independent assessment reports
B. Provide cloud security requirements
C. Evaluate service level agreements (SLAs)
D. Calculate security implementation costs
A
Which of the following is the MOST important reason to implement information security governance?
A. To align the security strategy with the organization’s strategy
B. To monitor the performance of business goals and objectives
C. To monitor the achievement of business goals and objectives
D. To provide adequate resources to achieve business goals
A
Which of the following is the PRIMARY reason for an information security manager to present the business case for an information security initiative to senior management?
A. To aid management in the decision-making process for purchasing the solution
B. To represent stakeholders who will benefit from enhancements in information security
C. To provide management with the status of the information security program
D. To demonstrate to management the due diligence involved with selecting the solution
D
IT projects have gone over budget with too many security controls being added post-production. Which of the following would MOST help to ensure are relevant to a project?
A. Involving information security at each stage of project management
B. Creating a data classification framework and providing it to stakeholders
C. Identifying responsibilities during the project business case analysis
D. Providing stakeholders with minimum information security requirements
A
An information security manager has been asked to provide contract guidance from a security perspective for outsourcing the organization’s payroll processing. Which of the following is MOST important to address?
A. Vendor compliance with the most stringent data security regulations
B. Vendor compliance with the organization’s information security policies
C. Vendor compliance with organizational service level agreement (SLA) requirements
D. Vendor compliance with recognized industry standards
B
A cloud application used by an organization is found to have a serious vulnerability. After assessing the risk, which of the following would be the information security manager’s BEST course of action?
A. Instruct the vendor to conduct penetration testing
B. Suspend the connection to the application in the firewall
C. Initiate the organization’s incident response process
D. Report the situation to the business owner of the application
D
Which of the following is the MOST important element in the evaluation of inherent security risks?
A. Impact to the organization
B. Control effectiveness
C. Residual risk
D. Cost of countermeasures
A
Which of the following is the PRIMARY purpose of implementing information security standards?
A. To provide a basis for developing information security policies
B. To provide step-by-step instructions for performing security-related tasks
C. To provide management direction with a specific security objective
D. To establish a minimum acceptable security baseline
D
Company A, a cloud service provider, is in the process of acquiring Company B to gain new benefits by incorporating their technologies within it’s cloud services. Which of the following should be the PRIMARY focus of company A’s information security manager?
A. The cost to align to Company A’s security policies
B. The organizational structure of Company B
C. Company B’s security policies
D. Company A’s security architecture
C
Which of the following metrics provides the BEST measurement of the effectiveness of a security awareness program?
A. Variance of program cost to allocated budget
B. The number of security breaches
C. Mean time between incident detection and remediation
D. The number of reported security incidents
C
A risk owner has accepted a large amount of risk due to the high cost controls. Which of the following should be the information security manager’s PRIMARY focus in this situation?
A. Conducting an independent review of risk responses
B. Establishing a strong ongoing risk monitoring process
C. Presenting the risk profile for approval by the risk owner
D. Updating the information security standards to include the accepted risk
D
Which of the following should be the PRIMARY driver for selecting and implementing appropriate controls to address the risk associated with weak user passwords?
A. The organization’s risk tolerance
B. The organization’s culture
C. The cost of risk mitigation controls
D. Direction from senior management
B
Which of the following is the BEST reason for an organization to use Disaster Recovery as a Service (DRaaS)?
A. It transfers the risk associated with recovery to a third party
B. It eliminates the need for the business to perform testing
C. It eliminates the need to maintain offsite facilities
D. It lowers the annual cost to the business
A
An organization performed a risk analysis and found a large number of assets with low-impact vulnerabilities. The NEXT action of the information security manager should be to:
A. Transfer to risk to a third party
B. Determine appropriate countermeasures
C. Report to management
D. Quantify the aggregated risk
D
Which of the following is an important criterion for developing effective key risk indicators (KRIs) to monitor information security risk?
A. The indicator should provide a retrospective view of risk impacts and be measured annually
B. The indicator should focus on IT and accurately represent risk variances
C. The indicator should align with key performance indicators (KPIs) and measure root causes of process performance issues
D. The indicator should possess a high correlation with a specific risk and be measured on a regular basis
D
Signature based anti-malware controls are MOST effective against:
A. Poorly configured firewall rules
B. Reused virus code
C. Known threats
D. Zero-day exploits
B
Which of the following analyses will BEST identify the external influences to an organization’s information security?
A. Threat analysis
B. Business impact analysis (BIA)
C. Gap analysis
D. Vulnerability analysis
A
An organization has decided to outsource its disaster recovery function. Which of the following is the MOST important consideration when drafting the service level agreement (SLA)?
A. Testing requirements
B. Authorization chain
C. Recovery time objectives (RTOs)
D. Recovery point objectives (RPOs)
A
Which of the following would provide the MOST value to senior management when presenting the results of a risk assessment?
A. Mapping the risks to existing controls
B. Illustrating risk on a heat map
C. Providing a technical risk assessment report
D. Mapping the risks to the security classification scheme
B
What should a global information security manager do FIRST when informed that a new regulation with significant impact will go into effect soon?
A. Perform a vulnerability assessment
B. Perform a business impact analysis (BIA)
C. Perform a privacy impact assessment
D. Perform a gap analysis
D
Which of the following is the MOST important reason to involve external forensics experts in evidence collection when responding to a major security breach?
A. To provide the response team with expert training on evidence handling
B. To ensure evidence is handled by qualified resources
C. To prevent evidence from being disclosed to any internal staff members
D. To validate the incident response processes
B
Which of the following is an information security manager’s FIRST priority after a high-profile system has been compromised?
A. Implement improvements to prevent recurrence
B. Identify the malware that compromised the system
C. Restore the compromised system
D. Preserve incident-related data
C
While classifying information assets, an information security manager notices that several production databases do not have owners assigned to them. What should the information security manager address in this situation?
A. Assign the highest classification level to those databases
B. Assign responsibility to the database administrator (DBA)
C. Prepare a report of the databases for senior management
D. Review the databases for sensitive content
B
In a business proposal, a potential vendor promotes being certified for the international security standards as a measure of its security capability. Before relying on this certification, it is MOST important that the information security manager confirms that the:
A. Certification scope is relevant to the service being offered
B. Certification will remain current through the life of the contract
C. Current international standard was used to assess security processes
D. Certification can be extended to cover the client’s business
A
The PRIMARY goal of the eradication phase in an incident response is to:
A. Provide effective triage and containment of the incident
B. Remove the threat and restore affected systems
C. Maintain a strict chain of custody
D. Obtain a forensic evidence from the affected system
B
To overcome the perception that security is a hindrance to business activities, it is important for an information security manager to:
A. Focus on compliance
B. Reiterate the necessity of security
C. Promote the relevance and contribution of security
D. Rely on senior management to enforce security
C
Which of the following should be the PRIMARY basis for determining information security objectives?
A. Business strategy
B. Regulatory requirements
C. Information security strategy
D. Data classification
C
Which of the following is the MOST important issue in a penetration test?
A. Performing the test without the benefit of any insider knowledge
B. Having an independent group perform the test
C. Having a defined goal as well as success and failure criteria
D. Obtaining permission from an audit
C
Which of the following is the BEST approach to incident response for an organization migrating to a cloud-based solution?
A. Transfer responsibility for incident response to the cloud provider
B. Continue using the existing incident response procedures
C. Revise incident response procedures to encompass the cloud environment
D. Adopt the cloud provider’s incident response procedures
C
Which of the following is MOST important to include in an information security status report to senior management?
A. Review of information security policies
B. List of recent security events
C. Key risk indicators (KRIs)
D. Information security budget requests
C
Which of the following is an information security manager’s BEST course of action upon discovering an organization with budget constraints lacks several important security capabilities?
A. Suggest the deployment of open-source security tools to mitigate identified risks
B. Establish a business case to demonstrate return on investment (ROI) of a security tool
C. Recommend that the organization avoid the most severe risks
D. Review the most recent audit report and request funding to address the most serious finding
B
The MOST important reason for having an information security manager servce on the change management committee it to:
A. Ensure changes are properly documented
B. Advise on change-related risk
C. Identify changes to the information security policy
D. Ensure that changes are tested
B
When choosing the best controls to mitigate risk to acceptable levels, the information security managers decision should be MAINLY driven by:
A. Regulatory requirements
B. Control framework
C. Best practices
D. Cost-benefit analysis
D
Which of the following is MOST important when designing an information security governance framework?
A. Assessing the availability of information security resources
B. Assessing the current state of information security
C. Aligning with the information security strategy
D. Aligning with industry-best practice frameworks
D
Which of the following BEST enables an information security manager to determine the comprehensiveness Inadvertant disclosure of the internal business information on social media is BEST minimized by which of the following?of an organization’s information security strategy?
A. Internal security audit
B. Organizational risk appetite
C. External security audit
D. Business impact analysis (BIA)
B
Inadvertent disclosure of the internal business information on social media is BEST minimized by which of the following?
A. Implementing data loss prevention (DLP) solutions
B. Limiting access to social media sites
C. Developing social media guidelines
D. Education users on social media risks
B
Which of the following is MOST important to consider when determining asset valuation?
A. Potential business loss
B. Asset classification level
C. Asset recovery cost
D. Cost of insurance premiums
A
Changes have been proposed to a large organization’s enterprise resource planning (ERP) system that would violate existing security standards. Which of the following should be done FIRST to address this conflict?
A. Perform a cost-benefit analysis
B. Calculate business impact levels
C. Validate current standards
D. Implement updated standards
B
The PRIMARY goal of a post-incident review should be to:
A. Identify policy changes to prevent reoccurrence
B. Establish the cost of the incident to the business
C. Determine why the incident occurred
D. Determine how to improve the incident handling process
D
Which of the following BEST indicates that information assets are classified accurately?
A. An accurate and complete information asset catalog
B. Appropriate assignment of information asset owners
C. Appropriate prioritization of information risk treatment
D. Increased compliance with information security
A
Which of the following is the BEST approach to make strategic information security decisions?
A. Establish periodic senior management meetings
B. Establish regular information security status reporting
C. Establish an information security steering committee
D. Establish business unit security working groups
C
An organization wants to ensure its confidential data is isolated in a multi-tenanted environment at a well-known cloud service provider. Which of the following is the BEST way to ensure the data is adequately protected?
A. Verify the provider follows a cloud service framework standard
B. Review the provider’s information security policies and procedures
C. Obtain documentation of the encryption management practices
D. Ensure an audit of the provider is conducted to identify control gaps
D
Which of the following would BEST support an information security manager’s efforts to obtain management approval for an identify and access management (IAM) system implementation?
A. A recent security incident involving access authorization
B. An established security policy with access management requirements
C. A third-party audit finding based on regulatory requirements
D. A business case proposal for the solution
D
Over the last year, an information security manager has performed risk assessments on multiple third-party vendors. Which of the following criteria would be MOST helpful in determining the associated level of risk applied to each vendor?
A. Compliance requirements associated with the regulation
B. Criticality of the service to the organization
C. Corresponding breaches associated with each vendor
D. Compensating controls in place to protect information security
B
Following a significant change to the underlying code of an application, it is MOST important for the information security manager to:
A. Inform senior management
B. Update the risk assessment
C. Validate the user acceptance testing (UAT)
D. Modify key risk indicators (KRIs)
D
Determining the risk for a particular threat/vulnerability pair before controls are applied can be expressed as:
A. The likelihood of a given threat attempting to exploit a vulnerability
B. The magnitude of the impact, should a threat exploit a vulnerability
C. A function of the cost and effectiveness of controls over a vulnerability
D. A function of the likelihood and impact, should a threat exploit a vulnerability
D
Which of the following is the BEST justification for making a revision to a password policy?
A. A risk assessment
B. Industry best practice
C. Audit recommendation
D. Vendor recommendation
A
An organization’s outsourced firewall was poorly configured and allowed unauthorized access that resulted in downtime of 48 hours. Which of the following should be the information security manager’s NEXT course of action?
A. Reconfigure the firewall in accordance with best practices
B. Obtain supporting evidence that the problem has been corrected
C. Seek damages from the service provider
D. Revisit the contract and improve accountability of the service provider
B
The PRIMARY purpose for defining key risk indicators (KRIs) for a security program is to:
A. Support investments in the security program
B. Compare security program effectiveness to benchmarks
C. Provide information needed to take action
D. Ensure mitigating controls meet specifications
C
The PRIMARY advantage of performing black-box controls tests as opposed to white-box control testes is that they:
A. Require les IT staff preparation
B. Identify more threats
C. Simulate real-world attacks
D. Cause fewer potential production issues
A
In a multinational organization, local security regulations should be implemented over global security policy because:
A. Business objectives are defined by local business unit managers
B. Deploying awareness of local regulations is more practical than of global policy
C. Global security policies include unnecessary controls for local businesses
D. Requirements of local regulations take precedence
D
