The Chief Information Officer (CIO) is reviewing the IT centric BIA and RA documentation.
The documentation shows that a single 24 hours downtime in a critical business function will
cost the business $2.3 million. Add
...
The Chief Information Officer (CIO) is reviewing the IT centric BIA and RA documentation.
The documentation shows that a single 24 hours downtime in a critical business function will
cost the business $2.3 million. Additionally, the business unit which depends on the critical
business function has determined that there is a high probability that a threat will materialize
based on historical data. The CIO's budget does not allow for full system hardware replacement
in case of a catastrophic failure, nor does it allow for the purchase of additional compensating
controls. Which of the following should the CIO recommend to the finance director to minimize
financial loss? - ✔✔The company should transfer the risk.
The latest independent research shows that cyber-attacks involving SCADA systems grew an
average of 15% per year in each of the last four years, but that this year's growth has slowed to
around 7%. Over the same time period, the number of attacks against applications has decreased
or stayed flat each year. At the start of the measure period, the incidence of PC boot loader or
BIOS based attacks was negligible. Starting two years ago, the growth in the number of PC boot
loader attacks has grown exponentially. Analysis of these trends would seem to suggest which of
the following strategies should be employed? - ✔✔Spending on SCADA security controls
should stay steady; application control spending should decrease slightly and spending on PC
boot loader protections should increase substantially
A security administrator has noticed that an increased number of employees' workstations are
becoming infected with malware. The company deploys an enterprise antivirus system as well as
a web content filter, which blocks access to malicious web sites where malware files can be
downloaded. Additionally, the company implements technical measures to disable external
storage. Which of the following is a technical control that the security administrator should
implement next to reduce malware infection? - ✔✔Block cloud-based storage software on the
company network
A security manager is looking into the following vendor proposal for a cloud-based SIEM
solution. The intention is that the cost of the SIEM solution will be justified by having reduced
the number of incidents and therefore saving on the amount spent investigating incidents.
Proposal: External cloud-based software as a service subscription costing $5,000 per month and
is expected to reduce the number of current incidents per annum by 50%. The company currently
has ten security incidents per annum at an average cost of $10,000 per incident. Which of the
following is the ROI for this proposal after three years? - ✔✔-$30,000(50% Reduction; 5 incidents per year x $10,000 = $50,000 x 3 years = $150,000 (GAIN) $5,000
per month x 12 = $60,000 per year x 3 years = $180,000 (COST) ROI = $150,000 - $180,000 = -
$30,00)
The risk manager at a small bank wants to use quantitative analysis to determine the ALE of
running a business system at a location which is subject to fires during the year. A risk analyst
reports to the risk manager that the asset value of the business system is $120,000. Based on
industry data, the exposure factor to fires is only 20% due to the fire suppression system installed
at the site. Fires occur in the area on average every four years. Which of the following is the
ALE? - ✔✔$6,000
(Single Loss Expectancy (SLE) is mathematically expressed as: Asset value (AV) x Exposure
Factor (EF) SLE = AV x EF = $120,000 x 20% = $ 24,000 (this is over 4 years) Thus ALE =
$24,000 / 4 = $6,000)
An infrastructure team is at the end of a procurement process and has selected a vendor. As part
of the final negotiations, there are a number of outstanding issues, including: -1. Indemnity
clauses have identified the maximum liability -2. The data will be hosted and managed outside of
the company's geographical location The number of users accessing the system will be small,
and no sensitive data will be hosted in the solution. As the security consultant on the project,
which of the following should the project's security consultant recommend as the NEXT step? -
✔✔Require the solution owner to accept the identified risks and consequences
Two new technical SMB security settings have been enforced and have also become policies that
increase secure communications. Network Client: Digitally sign communication Network Server:
Digitally sign communication A storage administrator in a remote location with a legacy storage
array, which contains time-sensitive data, reports employees can no longer connect to their
department shares. Which of the following mitigation strategies should an information security
manager recommend to the data owner? - ✔✔Accept the risk, reverse the settings for the remote
location, and have the remote location file a risk exception until the legacy storage device can be
upgraded
An organization has employed the services of an auditing firm to perform a gap assessment in
preparation for an upcoming audit. As part of the gap assessment, the auditor supporting the
assessment recommends the organization engage with other industry partners to share
information about emerging attacks to organizations in the industry in which the organization
functions. Which of the following types of information could be drawn from such participation?
- ✔✔Exploit frameworksThe generalized format for expressing the security category, SC, of an information type is -
✔✔SC information type = {(confidentiality, impact), (integrity, impact), (availability, impact)},
where the acceptable values for potential impact are LOW, MODERATE, HIGH
Following a security assessment, the Chief Information Security Officer (CISO) is reviewing the
results of the assessment and evaluating potential risk treatment strategies. As part of the CISO's
evaluation, a judgment of potential impact based on the identified risk is performed. To prioritize
response actions, the CISO uses past experience to take into account the exposure factor as well
as the external accessibility of the weakness identified. Which of the following is the CISO
performing? - ✔✔Quantitative risk assessment
[Show More]
.png)
.png)
