Practice tests Flashcards
Who in our organization would be the BEST person to set the RPO (Recovery Point Objective) for our business applications? InfoSec Manager COO Internal Audit Manager Business continuity coordinator
COO
Of the people listed the COO would be the person BEST suited to set the RPO. We would ideally want the data owner to set it, but if they are not available the COO would be the person who would be most suited. The Information Security manager, audit manager or the business continuity coordinator should not determine the RPOs for business applications.
Which of these would be an indicator that we need to take a look at our change request procedures? A lot of emergency change requests A lot of postponed change requests A lot of similar change requests A lot of canceled change requests
A lot of emergency change requests
If we get a lot of emergency change request, we should take another look at our change procedures and processes. Emergency change request will happen, but they should be the exception, not the rule. With emergency change requests we rarely have the required time to test the change properly. Changes being postponed, canceled, or many of them being similar is what we would want to see. They are all indicators of a well-functioning change management process.
Who in our organization is responsible for us being in compliance with the legal and regulatory requirements for our line of business? CISO Chief Legal Counsel (CLC) Infosec steering committee Board of directors and senior mgmt
Board of directors and senior mgmt
The board of directors and senior management are always ultimately responsible (and liable). The steering committee would be the ones who chose which Information Security measures we implement, the CISO and CLC may also responsible, but the board/senior management is MORE correct.
With how rapidly Information Security is evolving we often need to update our documentation, standards, and procedures. Which of these would we update MOST often?
Server hardening procedures
Standards for password complexity
Standards for data retention and destruction
Policies for Infosec governance
Server hardening procedures
We would update our server hardening procedures MOST often, they need to be constantly updated to reflect the latest patches and updates. We would still update our standards, and policies, but not very often, and definitely not as often as our specific procedures.
Why is it important to classify and determine the sensitivity of our assets?
Ensure very sensitive assets are protected
Ensure the cost of controls are minimized
Cost of protections should be proportionate with the sensitivity of the asset
Ensure countermeasures are appropriate to the risk
X Ensure countermeasures are appropriate to the risk
We always implement countermeasures that are appropriate for the risk, that is why we clearly classify and determine the sensitivity of our assets. Protection cost being appropriate for sensitivity makes no sense, we base the appropriate cost on the risk. Naturally we want risks to be minimized and sensitive assets are protected, but that is not why we do the classification.
What would be BEST protection against data loss from a stolen laptop? Strong passwords Multifactor authentication Encrypted hard drives Real time network backups
X Encrypted hard drives
The best protection against data loss on a stolen laptop would be if we had the drives encrypted. Strong passwords can be bypassed if a skilled hacker, and multifactor authentication can often be bypassed if we remove the drives and add them to another computer. Backups would do nothing to protect the data, it would just give us a copy of it.
We are deploying VPN (Virtual Private Network) access for our remote employees. As part of the project requirements we need to ensure we have strong authentication. Which of these is the STRONGEST authentication method available? Biometric readers SSL (Secure Socket Layer) authentication Symmetric encryption 2FA (2-factor authentication)
X 2FA (2-factor authentication) 2FA (2-factor authentication) is considered more secure than any of the other answers. That means 2 types of authentication (something you know (type 1), something you have (type 2), or something you are (type 3 or biometrics). Symmetric encryption is normally not used for authentication, neither is SSL normally. Biometrics is an authentication type, but it is not as strong as 2FA (2-factor authentication) by itself.
We use both IDSs (Intrusion Detection Systems) and IPSs (Intrusion Prevention Systems) in our environment. What is the MAIN purpose of the IDSs?
To alert on true negatives
To identify potential attacks on our internal network
To block traffic seen as malicious
To identify network misconfigurations
To identify potential attacks on our internal network
IDSs (Intrusion Detection Systems) are detection systems, they do not act, and their MAIN purpose is to identify potential attacks on our internal network. They do not block malicious traffic, that would be an IPSs (Intrusion Prevention Systems). We could discover potential misconfigurations with vulnerability scanners, not IDSs. Finally, an IDS would alert on “True Positives” (which is good); an attack is happening, and the system detected it, and “False Positives” the system sees normal traffic as malicious (which is bad). The system would not alert on “True Negatives”; that is normal traffic and the system seeing it as such.
Which type of access control is the MOST efficient? Centralized Decentralized Discretionary Role-based
Role-based
Role based access control would be the most efficient type of access control based on the answer options. Access is assigned to job roles reducing administrative overhead and making it more efficient. Decentralized would require more administrative overhead, so would discretionary access control, where the data owner would assign access at their discretion. Centralized access control is more efficient than decentralized, but in this example, we do not have enough information for it to the be the right answer.
Bassam is using GAP analysis to prepare for a board meeting presentation. Which of these MOST accurately describes a GAP analysis?
Analysis of current state versus desired state
analysis on the control objects we have to ensure they align with business goals
evaluating the BIA (business impact analysis) to make sure it is aligned with our business goals
Analysis on what we as an org is good at and see if we can use that to our advantage
Analysis of current state versus desired state
A GAP analysis is used for mapping our current state versus our desired state. We would use the GAP analysis to plan out the actionable steps we need to take to get from our current to desired state. The BIA is us analyzing the impact of a certain incident. The analysis where we look at what we are good at is SWOT analysis, and obviously control objects should align with business objectives, but that was not the question here.
Which of these could be MOST effective against internal threats to our confidential information? Defense in depth A privacy policy Role-based access control Monitoring of our audit trails
Role-based access control
Of the options available here, role-based access control would protect our information from internal threats the BEST. A privacy policy is not related to risk, defense in depth is mostly focused on outsider threats and audit trails is detective controls we use after the fact.
Out credit card database has been compromised; what should we do FIRST?
Verify there was an incident
Notify the data owner
Notify the Infosec steering committee
Start containment and network segmentation
Verify there was an incident
Our first step should be to confirm the incident actually happened. After we confirm the incident, then we would contain, segment and notify the data owner and leadership. The sequence is very important, it is possible the incident was a false positive (normal traffic seen as malicious).
We are a large multinational organization with offices in Europe, the US, Asia, Australia, Russia and Africa. Which type of information would we expect to have the LOWEST level of security protection? Previous financial results Strategic plan Upcoming financial results Customer PII
Previous financial results
Our previous financial results would have the LOWEST level of protection, they are already public. Exposing our strategic plan, our upcoming financial results or customer PII would have adverse effects.
A new regulatory requirement has been published for our industry. It looks like the implementation cost will be very high. What should you as the Information Security manager do FIRST? Implement immediate countermeasures Implement compensating controls Start and Infosec steering committee Do a gap analysis
Do a gap analysis
We would start with a GAP analysis, what is our current state, and what is our desired state? Then we would plan how to get from current to desired state. The steering committee would choose which initiatives we move forward with and would not be a FIRST step. Compensating controls, we may implement later, after we know more. We can’t implement immediate countermeasures; we need to do the analysis first.
Who would be responsible in our organization for classifying our information? Data owner CISO DB administrator Data custodian
Data owner
The owner of the data is always responsible for classifying the data, they know the best how sensitive (or not) their data is. The data custodian would do the practical things (patches, security, updates), but never classify anything. The CISO or the DBA are not appropriate for assigning sensitivity, they may have no clue what the data is or how sensitive the data is.
In order to mitigate newly discovered security vulnerabilities in an operating system, we would use which of these processes to address the vulnerability in a timely manner? Patch mgmt Security vulnerability mgmt Change mgmt Server mgmt
Patch mgmt
We would use patch management to address new operating system security vulnerabilities. Change management is the control process we have in place to ensure changes to our environment are planned, tested, and implemented properly; patch management would be part of our change management process. Server management is the management of everything regarding the server, and security vulnerability management is managing vulnerabilities on a server, including patch management, but patch management is a MORE right answer.
Which of these would be the MOST important for our security policies to do?
Be in clear and easily understood language
Be tailored to each business unit
Have verbiage about our network vulnerabilities
Address the process for communication internally and externally during a security incident.
Be in clear and easily understood language
Our security policies should be clear and easy to understand, they should be available to our entire staff. We would not have network vulnerabilities in our policies, and we do not want our entire organization to know about them. The process for communication would be in our DRP (Disaster Recovery Plan) or CCP (Crisis Communication Plan). The security policies are high level and vague, we would never want to have tailored versions for each business unit. The security policies are built from the vision and mission of the business, they should be consistent across the organization.
Our organization is spread across many smaller offices across the country. Which of these would present the LARGEST security risk?
System operations are not being followed
System capacity mgmt process are not being followed
Software dev is outsources
Change mgmt process are not being followed
X Change mgmt process are not being followed
If our branches do not follow proper change management, it is a cause for concern. Implementing fixes and solutions without proper change control can introduce a lot of security risks. System operating procedures and capacity management procedures should always be followed, but they are not as severe as lack of proper change management. We often outsource our software development, it in itself poses no security risk, as long as security is designed into the software and we do proper change control and management.
If we want to protect our organization against internal security threats, which of these would be the BEST to use? User training Server hardening Background checks Static IP addresses
Background checks
Background checks is the best way to protect against internal security threats of the options, their past behavior and actions are good indicators how and what they will do in the future. Server hardening may help, but we have no clue which type of internal threat we are dealing with. Static IPs really do nothing to protect us against internal security threats. User training is us giving them the training, in itself it does nothing. What we want is to raise their awareness, which is them acting on the knowledge and doing the right thing.
We want to ensure non-repudiation. Which of these would be the BEST for that? Collisions resistant hashes Digital signatures Strong complex passwords Symmetric encryption
Digital signatures Digital signatures (or PKI (Public Key Infrastructure) would be the BEST to ensure non-repudiation. You should be the only person with your private key; if a file was signed with your private key, you would have a very hard time proving you didn't. Strong passwords would possibly make us more secure, hashes would ensure integrity, and symmetric encryption can possibly ensure confidentiality, but none of them would give us non-repudiation.
One of our critical systems has an administrator account, the account prevents account locking, privileges and name changes. What could we implement that would protect us BEST against brute force password attacks?
Make a strong random password for the account
Don’t allow the system to be accessed from outside our org
Log all account usage
Request a patch from the vendor
Make a strong random password for the account
Since we are unable to lock the account, our best option is to create a very strong random password. It may not be an option to only allow internal access, and even if we do, attackers could get onto our network and brute force from there. We can request a patch, but we have no way making them provide it, and logging usage is a detective control and does not prevent attacks.
We are doing audits on our firewalls. What would be the best metric for measuring their effectiveness?
How many firewall rules we have configured on each firewall
The number of attacks they have blocked
The average throughput
The number of packets they have dropped
X The number of attacks they have blocked
Of the options available the best metric to evaluate the effectiveness of our firewalls would be how many attacks they have blocked. How many packets they dropped, the throughput, and how many rules we have configured are not indicators of the effectiveness of the firewall.
Bob has been tasked with integrating our new risk management processes into our existing production systems. What would be the BEST way to do that? Process monitoring Update our policies Change management User training
X Change management
We would use our change management to integrate new processes into exciting production systems. We would also as part of the integration do user training, update our policies and possibly monitor the processes, but they are not the BEST way to integrate.
As the Information Security Director, you are assisting the Information Security steering committee and the application owners in assigning RTO's (Recovery Time Objectives) for the applications we use in our organization. Which of these should have the SHORTEST RTO? Our intranet Our change mgmt system Our VPN access for remote contractors Our e-commerce website
Our e-commerce website
Of the systems listed here, the e-commerce system would have the SHORTEST RTO. We would want it to be back to at least limited capacity within less than an hour. In most cases we should have a true redundant solution in place with no downtime. Our change management system would have procedures in place in case of a change management outage, it is non-critical. Our intranet is possibly important depending on our work process flow, but it is not as important as our e-commerce. The same with our VPN access for contractors, it is important, but not as important as e-commerce.
Jane needs to determine an assets value. What would be the BEST source for her to use? Business mgr. for the asset Infosec mgr. Business analyst for the asset Average industry cost
Business mgr. for the asset
The business manager for the asset (also often the system owner) would be the person who would be best at assigning the real asset value. They have the in-depth knowledge of what the system does and how critical it is. We may need to assist them with quantifying the value, but they are the best resource. The business analyst knows how the system works, but not the value, and average industry costs is never something we should use for asset value. Our systems are unique, our organization is unique, we would at best use the industry average as a benchmark.
What is our Information Security governance PRIMARILY driven by? The potential of lawsuits Our business strategy Regulatory requirements in our industry Technology constraints we face today
Our business strategy
Governance is directly tied back to the organization’s strategy, vision and mission. Our technological constraints, the legal requirements, and the potential for lawsuits is important, but the primary driver is our strategy.
The relationship between different security technologies would BEST be defined in which of these? The process improvement models we use Our security architecture Our network topology Our security metrics
Our security architecture
Our security architecture would define how we use and the relationships of different security mechanisms. The security metrics would show improvement in our security practices. The process improvement models are focused on us improve our processes but does nothing to explain the relationship between our security mechanisms. Our network topology would show us our network layout, but not how our security mechanisms relate.
We are making an entirely new set of user awareness training materials. Which of these is the MOST important element?
The materials are easy to read and understand
Detailed info about social engineering
Buy-in from the infosec steering committee
Detailed info about our security policies and consequences for not following them
The materials are easy to read and understand
It is critical that the information is easy to read and understand. If it is too confusing or use too many technical words, many employees will either not read it at all or forget it almost right away. We would want senior managements buy-in, but for the materials to be effective, it is more important they are easy to understand. Staff should learn about social engineering and our policies, but in a simplified language they can understand and relate to.
Our organizations risk appetite is represented by which of these? Audit risk Control risk Residual risk Inherent risk
Residual risk
Senior management sets our risk appetite and residual risk is what is what is left after we have implemented the countermeasures and senior management has decided it is not worth mitigating the risk anymore. Inherent risk is the unmitigated risk, control risk is when control fail, and audit risk is how auditors approach their work.
What should the retention of our business records PRIMARILY be based on?
A business case and value analysis
Our storage capacity and how long we are keeping the data for
Our business strategy
The regulatory and legal requirements we need to adhere to
X Our business strategy
Our retention is dictated by our business strategy. We can chose not to comply with regulations if the cost of compliance is higher than the penalties for instance. Just like anything else we do a cost-benefit analysis. Business case and value analysis would be based on our strategy, making strategy a MORE right answer. How easy it is to use or the capacity on our data stores should never be a deciding factor.
Which group of people would be the BEST for performing risk analysis on our organization?
The process owners
External auditors
An external mgmt. consultant specialized on our line of business
A group of peers from our competitors
The process owners
Our process owners would be the group best suited for performing the risk analysis, they have the most accurate overview of the risks to their areas. Management consultants, our peers, or external auditors may be able to help in other aspects, but they would not be the BEST risk analysis for our organization.
Jane is working on risk analysis for all of our systems, facilities, and applications. Where would it be BEST to use quantitative risk analysis?
A power outage
To deal with stolen customer data
Half of our marketing department leaving our or to work for a competing business
When our ecommerce website is defaced by hackers
X A power outage
We would be able to quantify the financial loss we would see after a power outage. The loss of customer data and confidence, our website being defaced or how it would impact us if we lose half of your marketing team would be hard to quantify, for those we would probably use qualitative risk analysis.
Jane is building a business case for adding IDSs (Intrusion Detection Systems) to our network. Where would it be BEST to place those? On a screened subnet Outside of our firewalls On an external router On the firewall
X On a screened subnet
We would place our IDSs on our screened subnet (our DMZ (demilitarized zone)). Placing them outside our firewalls would leave them vulnerable to attacks, the same if we placed them on external routers. Placing them on the firewall would not be appropriate since the firewall is a hardened device and adding non-firewall services to it would weaken its security posture.
Bob is making a risk mitigation report; the report would include recommendations for which of these? Risk evaluation Risk acceptance Risk quantification Risk assessment
Risk acceptance
Part of the risk mitigation report would be risk acceptance, either as an alternative to the mitigation or after the mitigation, we would consider accepting the residual risk. Risk assessments, evaluations and quantifications would be part of the risk analysis we did to make the risk mitigation report, but not part of the report itself.
When a security standard conflicts with a business objective, the situation should be resolved by:
Do a risk analysis
Make updates to the security standard to match the business objective
Accept the risk
Make updates to the business objective to match the security standard
Do a risk analysis
Any discrepancy between our objectives and policies should be resolved by a risk analysis. What is the potential gain and loss from changing the policy or the objective? As part of our due diligence we would never just let policy or objective be updated without doing the proper analysis. We may choose to accept the risk, but that would be after the analysis.
The server team is building an intranet server. As the Information Security member of the project team, where should Bob recommend the server is placed? On our internal network Behind an external router Attached to a firewall In the DMZ
On our internal network
We would want the intranet server on our internal network, where it would be accessible for our employees and inaccessible to external sources. It would not be appropriate to place the intranet server attached to a firewall, behind an external router, or in the DMZ, we would want in further inside our internal network and not so close to the external network.
Bassam is finishing up this iteration of our risk management program. What is the BIGGEST benefit of the program?
It can align our risk with the cost of countermeasures
It can identify and remove all threats posed by people
It can bring our losses in alignment with what we have budgeted for
In can eliminate or transfer all organizational risks
It can align our risk with the cost of countermeasures
When our risk management process is successful, we are able to align our risk reduction with the cost of the countermeasure. We can never eliminate or transfer all organizational risks or man-made risks. We can also not budget with risk losses with any degree of certainty.
Bassam has just been hired as our new CISO (Chief Information Security Officer). Which of these options should Bassam focus on FIRST?
He should develop a new security architecture
He should hire a highly skilled staff
He should establish good communication with the steering committee
He should do a risk analysis on the entire enterprise and present that to senior management
He should establish good communication with the steering committee
Bassam should establish good communication with the steering committee first. They make most of the Information Security decisions and prioritization. While he may at some point need to develop the security architecture, do an enterprise wide risk analysis or hire more staff, we have no information about the need for any of those in the question and regardless we would always want to build report and communication channels with the steering committee and senior management.
We want to reduce risk to an acceptable level, what is that determined by the requirements of: International standards Our org Our IT systems Information Security
Our org
When a risk is reduced to an acceptable level is determined by our organizational requirements. We would never base it on the requirements of our IT systems, Information Security or international standards. Those factors may guide us, but they would never be the determining factor.
In any organization the PRIMARY goal of the risk management program is to ensure that:
Critical IT assets are protected
Business risks we face are acted on with preventative controls
Objectives are achievable
IT systems are always available
X Objectives are achievable
The PRIMARY goal of our risk management program is to ensure the business objectives are achievable. We are there to make sure the business is successful and reaches its objectives, by having an efficient and effective risk management program. Part of that could be protecting our critical IT assets, having IT systems always available and us having preventative controls for the business risks we face. They are however not the PRIMARY goal.
What would the data owner be responsible for?
Deploying security controls
Moving updated application changes from dev to prod
Determining the required levels of security for the data
Applying emergency patches
Determining the required levels of security for the data
The data owner would be responsible for determining the level of security required, the classification of the data, and who has access to it. The patches, deploying security controls, and moving updated applications from development to production would be performed by different data custodians.
As the CISO of our organization, it is one of Jane's responsibilities to get senior management's commitment and support for Information Security. Which of these would be the MOST effective for Jane to do? Explain the need for Infosec User enterprise wide metrics Explain the needs of the operation units Explain the organizational risk
Explain the organizational risk
For senior leadership it is important to understand Information Security in relations to organizational risk, and we would often use a cost benefit analysis for this. We may use enterprise metrics, but it would be possibly be part of the organizational risk. The needs of organizational units or Information Security would have to tie back to the organizational risk and the cost benefit analysis.
We are a financial institution and changes are being made to some of the security aspects of the PCI-DSS standard. What should our Information Security manager do FIRST?
Assess if existing controls fulfill the new requirements
Meet with the financial and legal leadership teams and decide how to comply
Update our current security and privacy policies
Analyze the key risks in the compliance
Assess if existing controls fulfill the new requirements
The first thing we should assess is if our current controls are sufficient. If they are there is no need to meet with the financial or legal teams, nor update any policies or procedures. Risk analysis of the compliance would come much later, if we decide our current countermeasures are not sufficient.
Which of these is the MOST important ability we should look for when we are interviewing candidates for a new CISO (Chief Information Security Officer) for our organization?
A clear understanding of how to map Infosec tech to the needs of the org
A clear understanding of the regulatory and legal requirements that are relevant to our industry and our org
Knowledge about he latest IT technology platforms, trends and development methodologies
The ability to lead a diverse group of employees efficiently and effectively
A clear understanding of how to map Infosec tech to the needs of the org
Information Security should always be aligned to the organizational needs, a clear understanding of what those needs are is critical for a new CISO. They should also know the technologies, the regulatory requirements and be able to effective lead their team, but MOST important is understanding our mission, vision and goals.
Which of these is MOST important to ensure is in place before we have outside contractors do a penetration test on our organization?
Everyone including senior mgmt. is unaware of the penetration test to ensure the pen test is as close to a real attack as possible
The goals and objectives are clearly defined
Out IT staff has been inform about the pen test
The pen testers show us what the plan to do on a test system
The goals and objectives are clearly defined
It is MOST important to have very clearly defined goals and objectives for the penetration test. We would also possibly have certain timeframes the attackers are allowed to use, certain IP ranges, and also clear guidance on what they are not allowed to do. We may have them try to access a test system, but that is after the clear goals and objectives. On top of that test systems often do not have the same posture as production systems, being able to get access to a test system may not mean they can access our production systems. We may inform the IT staff, but not always. Senior management HAS to know about the penetration test, they sign off on it, and they are ultimately liable.
We have had a year with a lot of security incidences, we have experienced all of these. Which of them would have the MOST negative impact? A power outage at our data center Internal fraud with monetary loss The loss of customer confidence Stolen software
The loss of customer confidence
One of the most valuable assets to any business is the confidence our customers have in us. If we lose it, it can be very hard to repair. Internal fraud, a power outage and stolen software are all problems, but ones we can most likely fix without a lot of problems.
When we are implementing a security control, the cost should NOT exceed what?
The financial benefit gained from the implementation
Annual loss expectancy (ALE)
The asset value
The cost of an incident
X The asset value
The cost of the security control should not exceed the asset value. If the cost of a countermeasure is greater than the asset value, we would not implement. We always base our security controls on a cost-benefit analysis. We would use the ALE and the cost of an incident in the analysis, but we would not base the decision on just those. The cost of the security control not exceeding the benefit from the implementation doesn’t even make sense.
We are implementing wireless networks at our new corporate office. Which of these would be the MOST secure way of doing so? Use WPA-2 (Wi-Fi Protected Access-2) Filter traffic based on MAC addresses Hide our SSIDs Use WEP (Wired Equivalent Privacy)
Use WPA-2 (Wi-Fi Protected Access-2)
Of the options here WPA-2 (Wi-Fi Protected Access-2) is the most secure protocol to implement on our new wireless network. Hiding our SSID does very little, since it still broadcasts, it takes a few seconds to find it regardless of it being hidden. Adding MAC filtering on our switch ports is also easy to bypass, the attacker would just have to spoof the MAC address of a trusted divide on a specific port and they would have network access. Finally, WEP is very easy break today, there are weaknesses in the algorithm, even very long complex passwords can be broken in less than 10 minutes.
We are considering implementing a risk reduction control. Which of these would BEST determine if the control should be implemented? Qualitative risk analysis Cost benefit analysis Penetration testing Quantitative risk analysis
Cost benefit analysis
Any risk reduction control should be based on a cost benefit analysis. We would probably use quantitative and qualitative risk analysis as input to the cost benefit analysis, but they are not the BEST at determining if we should implement the control. Penetration testing could also assist but would be part of a bigger analysis and auditing.
What would be the BEST way to treat a natural disaster risk with a low probability and high impact? Transfer the risk Implement countermeasures Eliminate the risk Accept the risk
Transfer the risk
We would most often transfer risks with low probability and high impact. This could be flooding of our data center. If we chose to implement countermeasures it is often cost prohibitive. We may not be able to eliminate the risk and accepting the risk could have a catastrophic impact if it actualized.
What should we do FIRST when we are implementing Information Security governance in our organization?
Make our security policies
Adopt security best practices for our industry
Determine our security baselines
Define our security strategy
Define our security strategy
The FIRST step would be for us to define our security strategy, we would then use that to make our security policies, and baselines, we may use best practices for our industry as well.
What is the MAIN focus of security audits?
To ensure our security controls operate as they should
The ensure our security controls are based on the latest technology
To ensure our security controls are cost-effective
To ensure our security controls focus on preventative measures
To ensure our security controls operate as they should
The main focus of our security audits is to ensure our security controls operate as they should. We would want cost-effective controls, but that is not the purpose of the security audit. It is possible we would want to use the latest technology, but again not something the security audit would look at. Security reviews should look at all controls, not just preventative ones.
We are wanting to build new software for our organization, at what stage of the software development lifecycle should we involve Information Security?
When they start programming the software
When the sw dev team starts testing the sw
When they start to define the detailed requirements for the sw
When requested by the sw dev team
When they start to define the detailed requirements for the sw
Information Security should be involved from the very beginning and security should be a requirement just like the functionality of the software. If we wait for the software developers to contact us, we will wait forever, software testing is at the very end of the development process and when they start programming is also too late, at this point they already have all the requirements and changes will be duct-tape solutions.
Bassam is the Information Security manager of our organization. With us having offices across the globe, Bassam has to ensure that our local security program is in compliance with what?
The data privacy directives that are applicable across the world
The data privacy policies where our headquarters are located
Our corporate data privacy policy
The data privacy policies where we collect the data
X The data privacy policies where we collect the data
Our local offices have to comply with the local law, where the data is collected. Our corporate data privacy policy, the policy where our headquarters are located, or the global data directives never supersede the local laws and regulations.
Which of these would be the BEST option if we wanted to prevent employees from copying files from their workstation to a USB drive?
Disable all USB ports on all workstations
Limit the number of available mappable drives to one
Implement Mandatory Access Control
Do frequent user training
X Limit the number of available mappable drives to one
The BEST option would be to limit the number of drives on the workstations. Users can insert the USB drives, but they would not be registered as a drive. We would not want to disable all USB ports; they are also used for mice and keyboards. Training should be conducted, but it is more efficient to lock down the workstations. Mandatory Access Control would do nothing in this scenario.
Which of these would be BEST to ensure the data in a file has not been altered?
Look at the file size
Encrypt the file using symmetric encryption
Use strong access control to ensure the file can’t be accessed by anyone with out the proper permissions
Hash the original file and compare the hashes
Hash the original file and compare the hashes
If we want to ensure the data has not been altered, the best way to do that is to compare a hash of the original file and a hash of the current file. The 2 hashes should be identical, if they are not the data was altered. We would not be able to tell what was changed, just that something was. The file size can easily be made to look the same as the original even if the data was altered. Using symmetric encryption can give us confidentiality, but not an integrity check. If the file is important, we would most likely use strong access control, but again it would not tell us if the file was altered, only that it would be difficult to access.
In order to evaluate the effectiveness our IDSs (Intrusion Detection Systems), which of these would be the BEST metric to use?
The number of attacks we detect
The ration of successful attacks to unsuccessful attacks
The number of successful attacks
The ratio of false positives to false negatives
X The ratio of false positives to false negatives
Looking at the ratio of false positives to false negatives would be the BEST metric to determine how effective our IDSs are. If it is configured to be as effective as possible, we would have minimal false positives (alert on allowed traffic), and minimal false negatives (no alert on malicious traffic). The number of attacks we detect, and number of successful attacks, or the ratio of successful to unsuccessful attacks in themselves are not enough to determine if our IDS is effective
Which of these would help us the MOST to ensure our risk management program to be as effective as possible? A solid risk baseline A flexible Infosec budget Accurate risk reporting New risk detection
X New risk detection
We would want all of these for our risk management program, but us being able to detect new risks would be the MOST helpful.
What would be MOST useful for Jane, when she is working on RTOs (Recovery time objectives) for some of our critical system?
A risk analysis
A gap analysis
A business impact analysis
A SWOT (Strengths, Weaknesses, Opportunities, Threats) analysis
A business impact analysis
We get the RTO from our business impact analysis, and it is part of our MTD (Maximum tolerable downtime). What is the maximum amount we can have a system or function down before we are severely impacted? A GAP analysis we use to map a path from our current state to our desired state. A SWOT analysis is analyzing the Strengths, Weaknesses, Opportunities and Threats of our organization. The risk analysis would be part of the business impact analysis, but not what we use for the RTO.
As the CISO (Chief Information Security Officer) Bob is overseeing risk analysis. Which of these BEST describes what is in scope?
All critical systems and infrastructure
Anything subject to regulatory compliance
All our critical financial systems
All organizational activities
X All organizational activities
We do risk analysis on ALL our organizational activities; we would never limit it to specific systems or infrastructure. We need that holistic approach and protection profile.
When we make investments in Information Security technologies, what should those investments be based on? The business climate Vulnerability assessments Recommendations from our audits A value analysis
A value analysis
We do all our Information Security investments on value analysis. How will this benefit the organization? In most cases it is not revenue gained, but it is loss minimized to an acceptable level. We might look at the audits, the business climate and the vulnerability assessments, but we would still do a value analysis to justify the cost. We want that positive ROI.
What would we use to determine the amount of resources we use to mitigate risks? How much is left in the infosec budget Pen test results Audit reports Risk analysis results
Risk analysis results
The amount of resources we would use on a mitigation would be based on our risk analysis. Everything we do is based on a positive ROI (return on investment). We may use audit reports and penetration testing in our risk analysis, but they are by themselves to incomplete to determine the amount of resources we should use on mitigation. How much is left of the Information Security budget is something we need to consider but should not be how we determine how much we spend on mitigation.
We use risk analysis to determine how to protect our assets the best and mitigate risks as much as it makes sense. We have already rated incidences on likelihood and impact, now we want to get more precise numbers assigned to our assets that got a "High Risk" score. Which of these risk analysis approaches would be the BEST to use? Quantitative Qualitative Iterative Adaptive
Quantitative
When we want to put actual numbers and dollar amounts on both the risks and the mitigations; we would use Quantitative risk analysis (think quantity - it is a specific number). Qualitative risk analysis is where we rate risks on likelihood and impact, we then use that to determine which assets are high enough risk to move to quantitative risk analysis. Our risk analysis is iterative, but there is no risk analysis approach that is named iterative risk analysis. There is also no adaptive risk analysis.
Bob is scanning our internal network for security vulnerabilities. What is the MOST important thing Bob should ensure?
To not interrupt production environments
To not use open sources vulnerability scanners
To follow the normal attack cycle
To only scan production environments
To not interrupt production environments
It is MOST important that Bob does not disrupt any production environments or processes. If we have to run intrusive tests, they would be done off-hours and in a service window. There is not good reason to not use open source scanners, some of the better ones are open source. We would want to scan all environments, not just production. We would not follow the normal attack cycle; this is just scanning.
