Exam Misses Flashcards
An organization experienced a breach of credit card data, how should it respond?
notify affected card brands immediately. They are required to notify all affected credit card brands
An organization experienced a breach of credit card data, how should it respond?
Notify affected credit card brands immediately (it’s a requirement)
When should executives be made aware of changes in applicable cybersecurity laws?
during a routine monthly risk update
The classification of an incident is an indication of what 3 things?
data, application or system involved (incident classification can also be tied to the location)
A CISO noticed that dwell time metrics aren’t improving, what should be done?
improve incident detection capabilities
Does an executive level security council include allocating security budgets to business units?
no.
It’s a good way to get executives talking about cyber risk and business risk, and making risk decisions
In a quantitative risk analysis, how is risk expressed in terms of the partial loss of functionality of an asset?
Exposure Factor (EF)
A risk assessment of an organization’s SDLC might compel the organization to do what?
Introduce secure coding standards
not update coding standards, because that may not address security specifically
The purpose of a security incident tabletop exercise includes all of the following except which one?
Maintain familiarity with incident response procedures
Ensure that procedures are still correct and relevant
Ensure that internal and external communications are established
Ensure that an organization will be able to detect an incident
D. Ensure that an organization will be able to detect an incident
What elements should be included in a business case document template?
Current State Desired End State Requirements Approach Plan
A basic security incident response has how many steps, and what are they?
8
detect initiate evaluate eradicate recovery remediate closure review
True or False?
In addition to documenting roles and responsibilities, an incident response program should include detailed procedures for responding to common incidents
True
What activity helps ensure a security program is aligned with a security strategy?
Periodic Management Review
What is the best indicator of effectiveness?
The trend line for the number of critical and high vulnerabilities found in application penetration tests
How does the percentage of effective controls show value (how is it a value delivery metric?)
By illustrating how well the security program is ensuring control effectiveness
Who is included in a directory of parties to notify in an emergency?
regulators offsite media storage companies contract personnel services suppliers law enforcement insurance company agents
What is the problem with the following control statement, “Endpoints are protected from malware with McAfee Antivirus”
It’s overly specific. If they switched to Symantec, they would technically be out of compliance
Note that it is also unambiguous, but that’s not the best answer.
How will a security manager determine the actions needed to achieve the desired end state for a new security program?
Perform a gap analysis
That will help understand the present state and the actions needed to move from the present to the desired state
How can a CISO best understand the organization’s risk tolerance?
Interview board members and senior executives.
Examining the risk ledger or other artifacts or capabilities may not accurately reflect the organization’s current risk tolerance.
A control’s effectiveness can be tested with a review. True or False?
False.
A self-assessment, internal or external audit are all ok but a review is less rigorous
What does this describe?
A document describing the need for a mobile device management program that describes required resources, benefits, and a high-level plan
Business case
not a proposal
If an organization has a nonstandard IT governance framework, should the security governance framework be built to resemble it?
Yes
An organization’s security governance framework should be similar to other frameworks, especially that of IT
(don’t build it around industry standards)
If an auditor examines a business activity for which there is no control and scores the control as ineffective, what’s the best response?
To treat the activity as though a control should exist - develop a control and ensure it’s effective
Can organizations ever opt out of PCI DSS controls?
no
Compare leading vs trailing indicators
trailing indicators show past events
leading indicators show future risks
Is it common to require project managers to earn security certifications?
no
Security related improvements to project management would not include getting the PM certified in security
Is a control self-assessment the most effective way to determine compliance with internal policies?
yes
What does a qualified opinion mean?
That the audit has failed in one or more of its high-level control objectives. This is cause for concern and further inquiry
