CCISO
CISO
CISO
-
- 1 / 296
-
Lernkarten
Who in the organization determines access to information?
A. Legal department
B. Compliance officer
C. Data Owner
D. Information security officer
C
What two methods are used to assess risk impact?
A. Cost and annual rate of expectance
B. Subjective and Objective
C. Qualitative and percent of loss realized
D. Quantitative and qualitative
A
A security officer wants to implement a vulnerability scanning program. The officeris uncertain of the state of vulnerability resiliency within the organization’slarge ITinfrastructure.What would be theBEST approach to minimize scan data output while retaining a realistic view of system vulnerability?
A. Scan a representative sample of systems
B. Perform the scans only during off-business hours
C. Decrease the vulnerabilities within the scan tool settings
D. Filter the scan output so only pertinent data is analyzed
A
The Information Security Management program MUST protect:
A. all organizational assets
B. critical business processes and /or revenue streams
C. intellectual property released into the public domain
D. against distributed denial of service attacks
A
You have purchased a new insurance policy as part of your risk strategy. Which of the following risk strategy options have you engaged in?
A. Risk Avoidance
B. Risk Acceptance
C. Risk Transfer
D. Risk Mitigation
C
A
The establishment of a formal risk management framework and system authorization program is essential. The LAST step of the system authorization process is:
A. Contacting the Internet Service Provider for an IP scope
B. Getting authority to operate the system from executive management
C. Changing the default passwords
D. Conducting a final scan of the live system and mitigating all high and medium level vulnerabilities
B
Which of the following is MOST important when dealing with an Information Security Steering committee?
A. Include a mix of members from different departments and staff levels.
B. Ensure that security policies and procedures have been vetted and approved.
C. Review all past audit and compliance reports.
D. Be briefed about new trends and products at each meeting by a vendor.
C
An organization has defined a set of standard security controls. This organization has also defined the circumstances and conditions in which they must be applied. What is the NEXT logical step in applying the controls in the organization?
A. Determine the risk tolerance
B. Perform an asset classification
C. Create an architecture gap analysis
D. Analyze existing controls on systems
B
In accordance with best practices and international standards, how often is security awareness training provided to employees of an organization?
A. High risk environments 6 months, low risk environments 12 months
B. Every 12 months
C. Every 18 months
D. Every six months
B
What is the definition of Risk in Information Security?
A. Risk = Probability x Impact
B. Risk = Threat x Probability
C. Risk = Financial Impact x Probability
D. Risk = Impact x Threat
A
Which of the following are the MOST important factors for proactively determining system vulnerabilities?
A. Subscribe to vendor mailing list to get notification of system vulnerabilities
B. Deploy Intrusion Detection System (IDS) and install anti-virus on systems
C. Configure firewall, perimeter router and Intrusion Prevention System (IPS)
D. Conduct security testing, vulnerability scanning, and penetration testing
D
When managing the security architecture for your company you must consider:
A. Security and IT Staff size
B. Company Values
C. Budget
D. All of the above
D
If your organization operates under a model of "assumption of breach", you should:
A. Protect all information resource assets equally
B. Establish active firewall monitoring protocols
C. Purchase insurance for your compliance liability
D. Focus your security efforts on high value assets
D
According to the National Institute of Standards and Technology (NIST) SP 800-40, which of the following considerations are MOST important when creating a vulnerability management program?
A. Susceptibility to attack, mitigation response time, and cost
B. Attack vectors, controls cost, and investigation staffing needs
C. Vulnerability exploitation, attack recovery, and mean time to repair
D. Susceptibility to attack, expected duration of attack, and mitigation availability
C
When dealing with a risk management process, asset classification is important because it will impact the overall:
A. Threat identification
B. Risk monitoring
C. Risk treatment
D. Risk tolerance
C
One of the MAIN goals of a Business Continuity Plan is to
A. Ensure all infrastructure and applications are available in the event of a disaster
B. Allow all technical first-responders to understand their roles in the event of a disaster
C. Provide step by step plans to recover business processes in the event of a disaster
D. Assign responsibilities to the technical teams responsible for the recovery of all data.
C
A method to transfer risk is to:
A. Implementredundancy
B. move operations to another region
C. purchase breach insurance
D. Alignment with business operations
C
The FIRST step in establishing a security governance program is to?
A. Conduct a risk assessment.
B. Obtain senior level sponsorship.
C. Conduct a workshop for all end users.
D. Prepare a security budget.
A
Regulatory requirementstypically force organizationsto implement?
A. Mandatory controls
B. Discretionary controls
C. Optional controls
D. Financial controls
A
Which of the following has the GREATEST impact on the implementation of an information security governancemodel?
A. Organizational budget
B. Distance between physical locations
C. Number of employees
D. Complexity of organizationalstructure
D
Which of the following is MOST likely to be discretionary?
A. Policies
B. Procedures
C. Guidelines
D. Standards
C
What role should the CISO play in properly scoping a PCI environment?
A. Validate the business units’ suggestions as to what should be included in the scoping process
B. Work with a Qualified Security Assessor (QSA) to determine the scope of the PCI environment
C. Ensure internal scope validation is completed and that an assessment has been done to discover all credit card data
D. Complete the self-assessment questionnaire and work with an Approved Scanning Vendor (ASV) to determine scope
B
Which of the following is the MAIN reason to follow a formal risk management process in an organization that hosts and uses privately identifiable information (PII) as part of their business models and processes?
A. Need to comply with breach disclosure laws
B. Need to transfer the risk associated with hosting PII data
C. Need to better understand the risk associated with using PII data
D. Fiduciary responsibility to safeguard credit card information
C
Which of the following is the MOST important benefit of an effective security governance process?
A. Reduction of liability and overall risk to the organization
B. Better vendor management
C. Reduction of security breaches
D. Senior management participation in the incident response process
A
Which of the following provides an audit framework?
A. Control Objectives for IT (COBIT)
B. Payment Card Industry-Data Security Standard (PCI-DSS)
C. International Organization Standard (ISO) 27002
D. National Institute of Standards and Technology (NIST) SP 800-30
A
From an information security perspective, information that no longer supports the main purpose of the business should be:
A. assessed by a business impact analysis.
B. protected under the information classification policy.
C. analyzed under the data ownership policy.
D. analyzed under the retention policy
B
An organization information security policy serves to
A. establish budgetary input in order to meet compliance requirements
B. establish acceptable systems and user behavior
C. define security configurations for systems
D. define relationships with external law enforcement agencies
B
Risk is defined as:
A. Threat times vulnerability divided by control
B. Advisory plus capability plus vulnerability
C. Asset loss times likelihood of event
D. Quantitative plus qualitative impact
C
When briefing senior management on the creation of a governance process, the MOST important aspect should be:
A. information security metrics.
B. knowledge required to analyze each issue.
C. baseline against which metrics are evaluated.
D. linkage to business area objectives.
D
Which of the following is a benefit of information security governance?
A. Questioning the trust in vendor relationships.
B. Increasing the risk of decisions based on incomplete management information.
C. Direct involvement of senior management in developing control processes
D. Reduction of the potential for civil and legal liability
C
Which of the following most commonly falls within the scope of an information security governance steering committee?
A. Approving access to critical financial systems
B. Developing content for security awareness programs
C. Interviewing candidates for information security specialist positions
D. Vetting information security policies
D
The purpose of NIST SP 800-53 as part of the NIST System Certification and Accreditation Project is to establish a set of standardized, minimum security controls for IT systems addressing low, moderate, and high levels of concern for
A. Confidentiality, Integrity and Availability
B. Assurance, Compliance and Availability
C. InternationalCompliance
D. Integrity and Availability
A
When creating a vulnerability scan schedule, who is the MOST critical person to communicate with in order to ensure impact of the scan is minimized?
A. The asset owner
B. The asset manager
C. The data custodian
D. The project manager
B
A security manager has created a risk program. Which of the following is a critical part of ensuring the program is successful?
A. Providing a risk program governance structure
B. Ensuring developers include risk control comments in code
C. Creating risk assessment templates based on specific threats
D. Allowing for the acceptance of risk for regulatory compliance requirements
A
What is the first thing that needs to be completed in order to create a security program for your organization?
A. Risk assessment
B. Security program budget
C. Business continuity plan
D. Compliance and regulatory analysis
A
The PRIMARY objective of security awareness is to:
A. Ensure that security policies are read.
B. Encourage security-conscious employee behavior.
C. Meet legal and regulatory requirements.
D. Put employees on notice in case follow-up action for noncompliance is necessary
B
In which of the following cases, would an organization be more prone to risk acceptance vs. risk mitigation?
A. The organization uses exclusively a quantitative process to measure risk
B. The organization uses exclusively a qualitative process to measure risk
C. The organization’s risk tolerance is high
D. The organization’s risk tolerance is lo
C
Ensuring that the actions of a set of people, applications and systems follow the organization’s rules is BEST described as:
A. Risk management
B. Securitymanagement
C. Mitigationmanagement
D. Compliancemanagement
B
An organization’s firewall technology needs replaced. A specific technology has been selected that is less costly than others and lacking in some important capabilities. The security officer has voiced concerns about sensitive data breaches but the decision is made to purchase. What does this selection indicate?
A. A high threat environment
B. A low risk tolerance environment
C. I low vulnerability environment
D. A high-risk tolerance environment
D
