Activedumpsnet Logo
SCENARIO: A Chief Information Security Officer (CISO) recently had a third party conduct an audit of the security program. Internal policies and international standards were used as audit baselines. The audit report was presented to the CISO and a variety of high, medium and low rated gaps were identified.
After determining the audit findings are accurate, which of the following is the MOST logical next activity?
Scenario: The new CISO was informed of all the Information Security projects that the section has in progress. Two projects are over a year behind schedule and way over budget.
Which of the following will be most helpful for getting an Information Security project that is behind schedule back on schedule?
A CISO has implemented a risk management capability within the security portfolio. Which of the following
terms best describes this functionality?
Scenario: An organization has made a decision to address Information Security formally and consistently by adopting established best practices and industry standards. The organization is a small retail merchant but it is expected to grow to a global customer base of many millions of customers in just a few years.
Which of the following frameworks and standards will BEST fit the organization as a baseline for their security program?
If the result of an NPV is positive, then the project should be selected. The net present value shows the present
value of the project, based on the decisions taken for its selection. What is the net present value equal to?
The process for management approval of the security certification process which states the risks and mitigation of such risks of a given IT system is called
As the Chief Information Security Officer, you are performing an assessment of security posture to understand
what your Defense-in-Depth capabilities are. Which network security technology examines network traffic flows
to detect and actively stop vulnerability exploits and attacks?
Scenario: Your program is developed around minimizing risk to information by focusing on people, technology, and operations.
You have decided to deal with risk to information from people first. How can you minimize risk to your most sensitive information before granting access?
Simon had all his systems administrators implement hardware and software firewalls to ensure network
security. They implemented IDS/IPS systems throughout the network to check for and stop any unauthorized
traffic that may attempt to enter. Although Simon and his administrators believed they were secure, a hacker
group was able to get into the network and modify files hosted on the company's website. After searching
through the firewall and server logs, no one could find how the attackers were able to get in. He decides that
the entire network needs to be monitored for critical and essential file changes. This monitoring tool alerts
administrators when a critical file is altered. What tool could Simon and his administrators implement to
accomplish this?
As the Chief Information Security Officer, you want to ensure data shared securely, especially when shared with
third parties outside the organization. What protocol provides the ability to extend the network perimeter with
the use of encapsulation and encryption?
A system is designed to dynamically block offending Internet IP-addresses from requesting services from a secure website. This type of control is considered
A newly-hired CISO needs to understand the organization’s financial management standards for business units
and operations. Which of the following would be the best source of this information?
An organization has a number of Local Area Networks (LANs) linked to form a single Wide Area Network
(WAN). Which of the following would BEST ensure network continuity?
SCENARIO: Critical servers show signs of erratic behavior within your organization’s intranet. Initial information indicates the systems are under attack from an outside entity. As the Chief Information Security Officer (CISO), you decide to deploy the Incident Response Team (IRT) to determine the details of this incident and take action according to the information available to the team.
During initial investigation, the team suspects criminal activity but cannot initially prove or disprove illegal actions. What is the MOST critical aspect of the team’s activities?
Which of the following defines the boundaries and scope of a risk assessment?
As the Business Continuity Coordinator of a financial services organization, you are responsible for ensuring assets are recovered timely in the event of a disaster. Which is the BEST Disaster Recovery performance indicator to validate that you are prepared for a disaster?
The new CISO was informed of all the Information Security projects that the organization has in progress. Two projects are over a year behind schedule and over budget. Using best business practices for project management you determine that the project correctly aligns with the company goals.
Which of the following needs to be performed NEXT?
The Annualized Loss Expectancy (Before) minus Annualized Loss Expectancy (After) minus Annual Safeguard Cost is the formula for determining:
The total cost of security controls should:
Access Control lists (ACLs), Firewalls, and Intrusion Prevention Systems are examples of
Scenario: You are the CISO and have just completed your first risk assessment for your organization. You find many risks with no security controls, and some risks with inadequate controls. You assign work to your staff to create or adjust existing security controls to ensure they are adequate for risk mitigation needs.
You have identified potential solutions for all of your risks that do not have security controls. What is the NEXT step?
Annual Loss Expectancy is derived from the function of which two factors?
Scenario: Your organization employs single sign-on (user name and password only) as a convenience to your employees to access organizational systems and data. Permission to individual systems and databases is vetted and approved through supervisors and data owners to ensure that only approved personnel can use particular applications or retrieve information. All employees have access to their own human resource information, including the ability to change their bank routing and account information and other personal details through the Employee Self-Service application. All employees have access to the organizational VPN.
What type of control is being implemented by supervisors and data owners?
What are the three hierarchically related aspects of strategic planning and in which order should they be done?
The primary purpose of a risk register is to:
The formal certification and accreditation process has four primary steps, what are they?
Which of the following is a common technology for visual monitoring?
What is the primary reason for performing vendor management?
SCENARIO: A Chief Information Security Officer (CISO) recently had a third party conduct an audit of the security program. Internal policies and international standards were used as audit baselines. The audit report was presented to the CISO and a variety of high, medium and low rated gaps were identified.
Which of the following is the FIRST action the CISO will perform after receiving the audit report?
What is one key difference between Capital expenditures and Operating expenditures?
When should IT security project management be outsourced?
Which of the following is the MOST important component of any change management process?
Information Security is often considered an excessive, after-the-fact cost when a project or initiative is completed. What can be done to ensure that security is addressed cost effectively?
The security team has investigated the theft/loss of several unencrypted laptop computers containing sensitive corporate information. To prevent the loss of any additional corporate data it is unilaterally decided by the CISO that all existing and future laptop computers will be encrypted. Soon, the help desk is flooded with complaints about the slow performance of the laptops and users are upset. What did the CISO do wrong? (choose the BEST answer):
Which of the following is the BEST indicator of a successful project?
Which of the following is considered one of the most frequent failures in project management?
Knowing the potential financial loss an organization is willing to suffer if a system fails is a determination of which of the following?
Which of the following represents the BEST method of ensuring security program alignment to business needs?
Which of the following represents the BEST method for obtaining business unit acceptance of security controls within an organization?
When managing the critical path of an IT security project, which of the following is MOST important?
Which of the following are not stakeholders of IT security projects?
The ultimate goal of an IT security projects is:
Which of the following is critical in creating a security program aligned with an organization’s goals?
A severe security threat has been detected on your corporate network. As CISO you quickly assemble key members of the Information Technology team and business operations to determine a modification to security controls in response to the threat. This is an example of:
How often should the Statements of Standards for Attestation Engagements-16 (SSAE16)/International Standard on Assurance Engagements 3402 (ISAE3402) report of your vendors be reviewed?
A CISO decides to analyze the IT infrastructure to ensure security solutions adhere to the concepts of how hardware and software is implemented and managed within the organization. Which of the following principles does this best demonstrate?
This occurs when the quantity or quality of project deliverables is expanded from the original project plan.
Which one of the following BEST describes which member of the management team is accountable for the day-to-day operation of the information security program?
Which of the following represents the best method of ensuring business unit alignment with security program requirements?
A CISO decides to analyze the IT infrastructure to ensure security solutions adhere to the concepts of how hardware and software is implemented and managed within the organization. Which of the following principles does this best demonstrate?
As the CISO for your company you are accountable for the protection of information resources commensurate with:
Which of the following is considered a project versus a managed process?
A CISO has recently joined an organization with a poorly implemented security program. The desire is to base the security program on a risk management approach. Which of the following is a foundational requirement in order to initiate this type of program?
How often should the SSAE16 report of your vendors be reviewed?
You are the CISO of a commercial social media organization. The leadership wants to rapidly create new methods of sharing customer data through creative linkages with mobile devices. You have voiced concern about privacy regulations but the velocity of the business is given priority. Which of the following BEST describes this organization?
When gathering security requirements for an automated business process improvement program, which of the following is MOST important?
A CISO sees abnormally high volumes of exceptions to security requirements and constant pressure from business units to change security processes. Which of the following represents the MOST LIKELY cause of this situation?
A department within your company has proposed a third party vendor solution to address an urgent, critical business need. As the CISO you have been asked to accelerate screening of their security control claims. Which of the following vendor provided documents is BEST to make your decision:
Which of the following information may be found in table top exercises for incident response?
You currently cannot provide for 24/7 coverage of your security monitoring and incident response duties and your company is resistant to the idea of adding more full-time employees to the payroll. Which combination of solutions would help to provide the coverage needed without the addition of more dedicated staff? (choose the best answer):
A new CISO just started with a company and on the CISO's desk is the last complete Information Security Management audit report. The audit report is over two years old. After reading it, what should be the CISO's FIRST priority?
The BEST organization to provide a comprehensive, independent and certifiable perspective on established security controls in an environment is
After a risk assessment is performed, a particular risk is considered to have the potential of costing the organization 1.2 Million USD. This is an example of
A business unit within your organization intends to deploy a new technology in a manner that places it in violation of existing information security standards. What immediate action should the information security manager take?
What two methods are used to assess risk impact?
Which of the following is the PRIMARY purpose of International Organization for Standardization (ISO) 27001?
A security manager regualrly checks work areas after buisness hours for security violations; such as unsecured files or unattended computers with active sessions. This activity BEST demonstrates what part of a security program?
When dealing with a risk management process, asset classification is important because it will impact the overall:
When briefing senior management on the creation of a governance process, the MOST important aspect should be:
When a critical vulnerability has been discovered on production systems and needs to be fixed immediately, what is the BEST approach for a CISO to mitigate the vulnerability under tight budget constraints?
The CIO of an organization has decided to assign the responsibility of internal IT audit to the IT team. This is consider a bad practice MAINLY because
Control Objectives for Information and Related Technology (COBIT) is which of the following?
You have a system with 2 identified risks. You determine the probability of one risk occurring is higher than the
Which of the following activities is the MAIN purpose of the risk assessment process?
Information security policies should be reviewed:
You have implemented a new security control. Which of the following risk strategy options have you engaged in?
To have accurate and effective information security policies how often should the CISO review the organization policies?
A security officer wants to implement a vulnerability scanning program. The officer is uncertain of the state of vulnerability resiliency within the organization’s large IT infrastructure. What would be the BEST approach to minimize scan data output while retaining a realistic view of system vulnerability?
Which of the following is MOST important when dealing with an Information Security Steering committee:
When choosing a risk mitigation method what is the MOST important factor?
When creating a vulnerability scan schedule, who is the MOST critical person to communicate with in order to ensure impact of the scan is minimized?
The Information Security Management program MUST protect:
The PRIMARY objective for information security program development should be:
A global health insurance company is concerned about protecting confidential information. Which of the following is of MOST concern to this organization?
When a CISO considers delaying or not remediating system vulnerabilities which of the following are MOST important to take into account?
When managing an Information Security Program, which of the following is of MOST importance in order to influence the culture of an organization?
Which of the following international standards can be BEST used to define a Risk Management process in an organization?
The effectiveness of social engineering penetration testing using phishing can be used as a Key Performance Indicator (KPI) for the effectiveness of an organization’s
The success of the Chief Information Security Officer is MOST dependent upon:
Many times a CISO may have to speak to the Board of Directors (BOD) about their cyber security posture. What would be the BEST choice of security metrics to present to the BOD?
What is the FIRST step in developing the vulnerability management program?
SQL injection is a very popular and successful injection attack method. Identify the basic SQL injection text:
Your organization provides open guest wireless access with no captive portals. What can you do to assist with law enforcement investigations if one of your guests is suspected of committing an illegal act using your network?
Which of the following is MOST important when tuning an Intrusion Detection System (IDS)?
Which of the following is a symmetric encryption algorithm?
Which of the following is a countermeasure to prevent unauthorized database access from web applications?
As a CISO you need to understand the steps that are used to perform an attack against a network. Put each step into the correct order.
1.Covering tracks
2.Scanning and enumeration
3.Maintaining Access
4.Reconnaissance
5.Gaining Access
Which of the following statements about Encapsulating Security Payload (ESP) is true?
One of your executives needs to send an important and confidential email. You want to ensure that the message cannot be read by anyone but the recipient. Which of the following keys should be used to encrypt the message?
Which of the following backup sites takes the longest recovery time?
Which of the following is the MAIN security concern for public cloud computing?
Your incident handling manager detects a virus attack in the network of your company. You develop a signature based on the characteristics of the detected virus. Which of the following phases in the incident handling process will utilize the signature to resolve this incident?
The general ledger setup function in an enterprise resource package allows for setting accounting periods. Access to this function has been permitted to users in finance, the shipping department, and production scheduling. What is the most likely reason for such broad access?
The ability to hold intruders accountable in a court of law is important. Which of the following activities are needed to ensure the highest possibility for successful prosecution?
Which wireless encryption technology makes use of temporal keys?
Physical security measures typically include which of the following components?
A customer of a bank has placed a dispute on a payment for a credit card account. The banking system uses digital signatures to safeguard the integrity of their transactions. The bank claims that the system shows proof that the customer in fact made the payment. What is this system capability commonly known as?
An access point (AP) is discovered using Wireless Equivalent Protocol (WEP). The ciphertext sent by the AP is encrypted with the same key and cipher used by its stations. What authentication method is being used?
In terms of supporting a forensic investigation, it is now imperative that managers, first-responders, etc., accomplish the following actions to the computer under investigation:
An anonymity network is a series of?
Security related breaches are assessed and contained through which of the following?
The process for identifying, collecting, and producing digital information in support of legal proceedings is called
The process of identifying and classifying assets is typically included in the
You are having a penetration test done on your company network and the leader of the team says they discovered all the network devices because no one had changed the Simple Network Management Protocol (SNMP) community strings from the defaults. Which of the following is a default community string?
What type of attack requires the least amount of technical equipment and has the highest success rate?
The process of creating a system which divides documents based on their security level to manage access to private data is known as
Your penetration testing team installs an in-line hardware key logger onto one of your network machines. Which of the following is of major concern to the security organization?
Network Forensics is the prerequisite for any successful legal action after attacks on your Enterprise Network. Which is the single most important factor to introducing digital evidence into a court of law?
While designing a secondary data center for your company what document needs to be analyzed to determine to how much should be spent on building the data center?
What is the term describing the act of inspecting all real-time Internet traffic (i.e., packets) traversing a major Internet backbone without introducing any apparent latency?
What is the purpose of the statement of retained earnings of an organization?
Effective information security management programs require the active involvement of_________
During a cyber incident, which non-security personnel might be needed to assist the security team?
The Health Insurance Portability and Accountability Act (HIPAA) requires an agreement between Cloud Service Providers (CCSP) and the covered entity. Based on HIPAA. which document must be completed between the covered entity and the CCSP?
Which of the following BEST mitigates ransomware threats?
What is an approach to estimating the strengths and weaknesses of alternatives used to determine options, which provide the BEST approach to achieving benefits while preserving savings called?
What does RACI stand for?
An auditor is reviewing the security classifications for a group of assets and finds that many of the assets are not correctly classified.
What should the auditor’s NEXT step be?
Many successful cyber-attacks currently include:
When evaluating a Managed Security Services Provider (MSSP), which service(s) is/are most important:
If a CISO wants to understand the liabilities of the company, she will refer to the:
Which of the following is NOT an approach for ethical decision making?
Optical biometric recognition such as retina scanning provides access to facilities through reading the unique characteristics of a person’s eye.
However, authorization failures can occur with individuals who have?
Who is PRIMARILY responsible for declaring a disaster and initiating processes to facilitate the recovery of critical assets in an organization?
A Security Operations (SecOps) Manager is considering implementing threat hunting to be able to make better decisions on protecting information and assets.
What is the MAIN goal of threat hunting to the SecOps Manager?
Which of the following is the MOST effective way to secure the physical hardware hosts in a virtualized environment?
Many successful cyber-attacks currently include:
In which of the following cases would an organization be more prone to risk acceptance vs. risk mitigation?
What is the MAIN responsibility of the purple security testing team?
To reduce the threat of spear phishing, which of the following is the MOST critical security control to implement?
What Enterprise Architecture Framework is business-centric and is composed of eight phases?
Which of the following strategies provides the BEST response to a ransomware attack?
When performing a forensic investigation, what are the two MOST common data sources for obtaining evidence from a computer and mobile devices?
As the CISO, you are the project sponsor for a highly visible log management project. The objective of the project is to centralize all the enterprise logs into a security information and event management (SIEM) system. You requested the results of the performance quality audits activity.
The performance quality audit activity is done in what project management process group?
Which of the following is considered the MOST effective tool against social engineering?
What standard would you use to help determine key performance indicators?
To make sure that the actions of all employees, applications, and systems follow the organization’s rules and regulations can BEST be described as which of the following?
What key technology can mitigate ransomware threats?