CISM Test Bank Quiz With Complete Solution. Accurate answers, Rated A

CISM Test Bank Quiz With Complete Solution The PRIMARY selection criterion for an offsite media storage facility is: Select an answer: A. that the primary and offsite facilities not be subject to the same environmenta ...

CISM Test Bank Quiz With Complete Solution The PRIMARY selection criterion for an offsite media storage facility is: Select an answer: A. that the primary and offsite facilities not be subject to the same environmental disasters. B. that the offsite storage facility be in close proximity to the primary site. C. the overall storage and maintenance costs of the offsite facility. D. the availability of cost-effective media transportation services.>>> You are correct, the answer is A. It is important to prevent a disaster that could affect both sites. The distance between sites may be important in cases of widespread disasters; however, this is covered by choice A. The costs should not be the primary criteria to selection. A cost-effective media transport service may be a consideration, but is not the main concern. In which of the following areas are data owners PRIMARILY responsible for establishing risk mitigation? Select an answer: A. Platform security B. Entitlement changes C. Intrusion detection D. Antivirus controls>>> You are correct, the answer is B. Data owners are responsible for assigning user entitlements and approving access to the systems for which they are responsible. Platform security, intrusion detection and antivirus controls are all within the responsibility of the information security manager. Which of the following is the BEST justification to convince management to invest in an information security program? Select an answer: A. Cost reduction B. Compliance with company policies C. Protection of business assets D. Increased business value>>> You answered C. The correct answer is D. Investing in an information security program should increase business value and confidence. Cost reduction by itself is rarely the motivator for implementing an information security program. Compliance is secondary to business value. Increasing business value may include protection of business assets. To improve the security of an organization's human resources (HR) system, an information security manager was presented with a choice to either implement an additional packet filtering firewall OR a heuristics-based intrusion detection system (IDS). How should the security manager with a limited budget choose between the two technologies? Select an answer: A. Risk analysis B. Business impact analysis (BIA)C. Return on investment (ROI) analysis D. Cost-benefit analysis>>> You answered A. The correct answer is D. Cost-benefit analysis measures the cost of a safeguard versus the benefit it provides, and does include risk assessment. The cost of a control should not exceed the benefit to be derived from it. The degree of control employed is a matter of good business judgment. Risk analysis identifies the risk and appropriate mitigation strategies. A BIA identifies the impact from the loss of systems. ROI analysis compares the magnitude and timing of investment gains directly with the magnitude and timing of investment costs. An organization's information security manager has been asked to hire a consultant to help assess the maturity level of the organization's information security management. What is the MOST important element of the request for proposal (RFP)? Select an answer: A. References from other organizations B. Past experience of the engagement team C. Sample deliverable D. Methodology to be used in the assessment>>> You answered C. The correct answer is D. Methodology illustrates the process and formulates the basis to align expectations and the execution of the assessment. This also provides a picture of what is required of all parties involved in the assessment. References from other organizations are important, but not as important as the methodology used in the assessment. Past experience of the engagement team is not as important as the methodology used. Sample deliverables only tell how the assessment is presented, not the process. An organization is implementing intrusion protection in their demilitarized zone (DMZ). Which of the following steps is necessary to make sure that the intrusion prevention system (IPS) can view all traffic in the DMZ? Select an answer: A. Ensure that intrusion prevention is placed in front of the firewall. B. Ensure that all devices that are connected can easily see the IPS in the network. C. Ensure that all encrypted traffic is decrypted prior to being processed by the IPS. D. Ensure that traffic to all devices is mirrored to the IPS.>>> You answered A. The correct answer is C. All encryption should be terminated to allow all traffic to be viewed by the IPS. The encryption should be terminated at a hardware Secure Sockets Layer (SSL) accelerator or virtual private network (VPN) server to allow all traffic to be monitored since encrypted traffic is unreadable. Which of the following are likely to be updated MOST frequently? Select an answer: A. Procedures for hardening database servers B. Standards for password length and complexity C. Policies addressing information security governanceD. Standards for document retention and destruction>>> You answered C. The correct answer is A. Policies and standards should generally be more static and less subject to frequent change. Procedures on the other hand, especially with regard to the hardening of operating systems, will be subject to constant change; as operating systems change and evolve, the procedures for hardening will have to keep pace. When performing a qualitative risk analysis, which of the following will BEST produce reliable results? Select an answer: A. Estimated productivity losses B. Possible scenarios with threats and impacts C. Value of information assets D. Vulnerability assessment>>> You answered C. The correct answer is B. Listing all possible scenarios that could occur, along with threats and impacts, will best frame the range of risks and facilitate a more informed discussion and decision. Estimated productivity losses, value of information assets and vulnerability assessments would not be sufficient on their own. Addressing production risks is PRIMARILY a function of: Select an answer: A. release management. B. incident management. C. change management. D. configuration management.>>> You are correct, the answer is C. Change management is the overall process to assess and control risks introduced by changes. Release management is the specific process to manage risks of production system deployment. Incident management is not directly relevant to life-cycle stages. Configuration management is the specific process to manage risks associated with system configuration. Which of the following requirements would have the lowest level of priority in information security? Select an answer: A. Technical B. Regulatory C. Privacy D. Business>>> You are correct, the answer is A. Information security priorities may, at times, override technical specifications, which then must be rewritten to conform to minimum security standards. Regulatory and privacy requirements are government-mandated and, therefore, not subject to override. The needs of the business should always take precedence in deciding information security priorities. The MOST important component of a privacy policy is: Select an answer:A. notifications. B. warranties. C. liabilities. D. geographic coverage.>>> You answered C. The correct answer is A. Privacy policies must contain notifications and opt-out provisions; they are a high-level management statement of direction. They do not necessarily address warranties, liabilities or geographic coverage, which are more specific. Which of the following groups would be in the BEST position to perform a risk analysis for a business? Select an answer: A. External auditors B. A peer group within a similar business C. Process owners D. A specialized management consultant>>> You are correct, the answer is C. Process owners have the most in-depth knowledge of risks and compensating controls within their environment. External parties do not have that level of detailed knowledge on the inner workings of the business. Management consultants are expected to have the necessary skills in risk analysis techniques but are still less effective than a group with intimate knowledge of the business. Obtaining senior management support for an information security initiative can BEST be accomplished by: Select an answer: A. developing and presenting a business case. B. defining the risk that will be addressed. C. presenting a financial analysis of benefits. D. aligning the initiative with organizational objectives.>>> You are correct, the answer is A. A. A business case is inclusive of the other options and includes and specifically addresses them. B. A business case must enumerate the risk that the initiative will address. C. The value proposition is an essential part of the business case that addresses the financial aspects of the initiative. D. The business case must show how the initiative will align with and support organizational objectives. Which of the following training mechanisms is the MOST effective means of promoting an organizational security culture? Select an answer: A. Choose a subset of influential people to promote the benefits of the security program. B. Hold structured training in small groups on an annual basis. C. Require each employee to complete a self-paced training module once per year. D. Deliver training to all employees across the organization via streaming video.>>> You answered C. The correct answer is A.A. Certain people are either individually inclined or required by their positions to have greater interest in promoting security than others. By selecting these people and offering them broad, diverse opportunities for security education, they are able to act as ambassadors to their respective teams and departments, imparting a gradual and significant change in an organizational culture toward security. B. Structured training rarely aligns with the interests of individual employees when chosen at random to fill a small-group setting. C. Computer-based training is a common approach to annual information awareness, but there is no evidence that employees retain the information or adopt it into their regular activities. D. Streaming-video "webinars" are among the least effective means of presenting information, requiring very little interaction from end users. Data owners are PRIMARILY responsible for: Select an answer: A. providing access to systems. B. approving access to systems. C. establishing authorization and authentication. D. handling identity management.>>> You are correct, the answer is B. Approving access to systems is the only answer that fits since choices A and C are the work of data custodians and choice D is the work of the information security staff. Which of the following are the MOST important individuals to include as members of an information security steering committee? Select an answer: A. Direct reports to the chief information officer B. IT management and key business process owners C. Cross-section of end users and IT professionals D. Internal audit and corporate legal departments>>> You answered D. The correct answer is B. Security steering committees provide a forum for management to express its opinion and take some ownership in the decision making process. It is imperative that business process owners be included in this process. None of the other choices includes input by business process owners. Which one of the following measures will BEST indicate the effectiveness of an incident response process? Select an answer: A. Number of open incidents B. Reduction of the number of security incidents C. Reduction of the average response time to an incident D. Number of incidents handled per month>>> You are correct, the answer is C. Of the list provided, the best measure of incident response effectiveness is the reduction of average response time to an incident. Reduction of response time helps minimize the impact of the incident. The total number of open incidents is not an indicator of incident response effectiveness because the team does not have directcontrol over the number of incidents it must handle at any given time. Reduction of the number of security incidents generally cannot be attributed to the effectiveness of the response team, but rather to improved controls. The number of incidents handled per month would not be a direct indicator of team effectiveness. The BEST way to obtain senior management commitment and support for information security investments is to: Select an answer: A. link security risk to organization business objectives. B. explain the technical risk to the organization. C. include industry best practices as they relate to information security. D. detail successful attacks against a competitor.>>> You are correct, the answer is A. Senior management seeks to understand the business justification for investing in security. Support can be best obtained by linking security to key business objectives. Senior management will not be as interested in technical risk or examples of successful attacks against a competitor if they are not linked to the impact on business environment and objectives. Industry best practices are important to senior management, but management will give the right level of importance to the best practices when they are presented in terms of key business objectives. When securing wireless access points, which of the following controls would BEST assure confidentiality? Select an answer: A. Implementing wireless intrusion prevention systems B. Not broadcasting the service set IDentifier (SSID) C. Implementing wired equivalent privacy (WEP) authentication D. Enforcing a virtual private network (VPN) over wireless>>> You are correct, the answer is D. Enforcing a VPN over wireless is the best option to enforce strong authentication and encryption of the sessions. Implementing wireless intrusion prevention systems is a detective system and would not prevent wireless sniffing. Not broadcasting the SSID does not reduce the risk of wireless packets being captured. WEP authentication is known to be weak and does not protect individual confidentiality. Who should PRIMARILY provide direction on the impact of new regulatory requirements that may lead to major application system changes? Select an answer: A. The internal audit department B. System developers/analysts C. Key business process owners D. Corporate legal counsel>>> You are correct, the answer is C. Business process owners are in the best position to understand how new regulatory requirements may affect their systems. Legal counsel and infrastructure management, as well as internal auditors, would not be in as good a position to fully understand all ramifications.Which of the following choices will MOST influence how the information security program will be designed and implemented? Select an answer: A. Type and nature of risk B. Organizational culture C. Overall business objectives D. Lines of business>>> You answered A. The correct answer is B. A. The specific risk faced by the organization will affect the security program, but how this risk is perceived and dealt with depends on the organizational culture. B. The organizational culture generally influences risk appetite and risk tolerance, which in turn have significant influence over how an information security program should be designed and implemented. C. Business objectives will determine the specific kinds of risk to be addressed, but will not greatly influence the actual program development and implementation. D. The lines of business will affect the specific kinds of risk to be addressed, but will not greatly influence the actual program development and implementation. The relationship between policies and corporate standards can BEST be described by which of the following associations? Select an answer: A. Standards and policies have only an indirect relationship. B. Standards provide a detailed description of the meaning of a policy. C. Standards provide direction on achieving compliance with policy intent. D. Standards can exist without a relationship to any particular policy.>>> You answered B. The correct answer is C. A. In most cases, there is a direct relationship between policy and corporate standards. B. Corporate standards generally do not provide details on the meaning of policy, rather on the acceptable limits needed to comply with policy intent. C. Corporate standards set the allowable limits and boundaries for people, processes and technology as an expression of policy intent, and therefore provide direction on policy compliance. D. It would be a poor practice to have corporate standards not directly expressing the intent of a particular policy. To the extent that they exist, they should rely on an implicit policy. Which one of the following factors of a risk assessment typically involves the GREATEST amount of speculation? Select an answer: A. Exposure B. Impact C. Vulnerability D. Likelihood>>> You answered A. The correct answer is D. The likelihood of a threat encountering a susceptible vulnerability can only be estimated statistically. Exposure, impact and vulnerability can be determined within a range. Which of the following is a key component of an incident response policy?Select an answer: A. Updated call trees B. Escalation criteria C. Press release templates D. Critical backup files inventory>>> You answered D. The correct answer is B. Escalation criteria, indicating the circumstances under which specific actions are to be undertaken, should be contained within an incident response policy. Telephone trees, press release templates and lists of critical backup files are too detailed to be included in a policy document. The MOST complete business case for security solutions is one that: Select an answer: A. includes appropriate justification. B. explains the current risk profile. C. details regulatory requirements. D. identifies incidents and losses.>>> You are correct, the answer is A. Management is primarily interested in security solutions that can address risks in the most cost-effective way. To address the needs of an organization, a business case should address appropriate security solutions in line with the organizational strategy. What is the MOST essential attribute of an effective key risk indicator (KRI)? Select an answer: A. The KRI is accurate and reliable. B. The KRI provides quantitative metrics. C. The KRI indicates required action. D. The KRI is predictive of a risk event.>>> You answered A. The correct answer is D. A. Key risk indicators (KRIs) are usually indicators that risk is developing and typically are neither accurate nor reliable in the sense that they indicate what the actual risk is. B. Key risk indicators (KRIs) typically do not provide quantitative metrics about risk. C. Key risk indicators (KRIs) will not indicate that any particular action is required other than to investigate further. D. A key risk indicator (KRI) should indicate that a risk is developing or changing to show that investigation is needed to determine the nature and extent of a risk. Which of the following is MOST effective in protecting against the attack technique known as phishing? Select an answer: A. Firewall blocking rules B. Up-to-date signature files C. Security awareness training D. Intrusion detection monitoring>>> You are correct, the answer is C. Phishing relies on social engineering techniques. Providing good security awareness training will best reduce the likelihood of such an attack being successful. Firewall rules, signature files and intrusion detection system (IDS) monitoring will be largely unsuccessful at blocking this kind of attack.The acceptability of a partial system recovery after a security incident is MOST likely to be based on the: Select an answer: A. ability to resume normal operations. B. maximum tolerable outage (MTO). C. service delivery objective (SDO). D. acceptable interruption window (AIW).>>> You answered D. The correct answer is C. A prior determination of acceptable levels of operation in the event of an outage is the SDO. The SDO may be set at less than normal operation levels, but sufficient to sustain essential business functions. The ability to resume normal operations is situational and would not be a standard for acceptability. While the MTO and the AIW, in addition to many other factors, are parts of an SDO, neither the MTO nor the AIW, by itself, addresses the acceptability of a specific level of operational recovery. Which of the following presents the GREATEST exposure to internal attack on a network? Select an answer: A. User passwords are not automatically expired B. All network traffic goes through a single switch C. User passwords are encoded but not encrypted D. All users reside on a single internal subnet>>> You answered D. The correct answer is C. When passwords are sent over the internal network in an encoded format, they can easily be converted to cleartext. All passwords should be encrypted to provide adequate security. Not automatically expiring user passwords does create an exposure, but not as great as having unencrypted passwords. Using a single switch or subnet does not present a significant exposure. Which of the following is the MOST important aspect that needs to be considered from a security perspective when payroll processes are outsourced to an external service provider? Select an answer: A. A cost-benefit analysis has been completed. B. Privacy requirements are met. C. The service provider ensures a secure data transfer. D. No significant security incident occurred at the service provider.>>> You are correct, the answer is B. Applicable privacy requirements may be a matter of law or policy and will require consideration when outsourcing processes that involve personal information. A costbenefit analysis should be undertaken from a business perspective, but not from a security perspective. When data are transferred, it may be necessary to ensure data security, but there are many other privacy and security issues to consider. Past incidents may not reflect the current security posture of the service provider, nor do they reflect applicable security requirements.Which of the following BEST supports continuous improvement of the risk management process? Select an answer: A. Regular review of risk treatment options B. Classification of assets in order of criticality C. Adoption of a maturity model D. Integration of assurance functions>>> You answered B. The correct answer is C. A. Risk treatment is an element of the risk management process. Other elements such as risk identification, risk communication and acceptance also need to be considered. B. Classification of assets is important, but is an element of the risk management process and is not sufficient to ensure continuous improvement. C. A maturity model such as the capability maturity model (CMM) can be used to classify an organization as initial, repeatable, defined, managed or optimized. As a result, an organization can easily know where it falls and then start working to reach the optimized state. D. There are many benefits from integrating assurance functions. However, this is not a holistic approach because the best of assurance functions will be reactive if risk management does not cascade through the entire organization. Measures must be taken to ensure that the entire staff, rather than only the assurance functions, is risk conscious. Who would be the PRIMARY user of metrics regarding the number of email messages quarantined due to virus infection versus the number of infected email messages that were not caught? Select an answer: A. The security steering committee B. The board of directors C. IT managers D. The information security manager>>> You are correct, the answer is D. Metrics support decisions. Knowing the number of email messages blocked due to viruses would not on its own be an actionable piece of information for senior management (choices A and B) or for IT management (choice C). Information regarding the effectiveness of the current email antivirus control is most useful to the information security manager and staff because they can use the information to initiate an investigation to determine why the control is not performing as expected and to determine whether there are other factors contributing to the failure of the control. When these determinations are made, the information security manager can use these metrics, along with data collected during the investigation, to support decisions to alter processes or add to (or change) the controls in place. Which of the following is the MOST effective way to measure strategic alignment of an information security program? Select an answer: A. Survey business stakeholders B. Track audits over time C. Evaluate incident lossesD. Analyze business cases>>> You answered B. The correct answer is A. The best indicator of strategic alignment is the opinion of the business stakeholders— and the best way to obtain this information is to ask them. The other choices do not have a direct correlation with the effectiveness of the information security program to support business goals and objectives. Ongoing tracking of remediation efforts to mitigate identified risks can BEST be accomplished through the use of which of the following? Select an answer: A. Tree diagrams B. Venn diagrams C. Heat charts D. Bar charts>>> You answered D. The correct answer is C. Heat charts, sometimes referred to as stoplight charts, quickly and clearly show the current status of remediation efforts. Venn diagrams show the connection between sets; tree diagrams are useful for decision analysis; and bar charts show relative size. Which of the following is the MAIN objective in contracting with an external company to perform penetration testing? Select an answer: A. To mitigate technical risks B. To have an independent certification of network security C. To receive an independent view of security exposures D. To identify a complete list of vulnerabilities>>> You are correct, the answer is C. Even though the organization may have the capability to perform penetration testing with internal resources, third-party penetration testing should be performed to gain an independent view of the security exposure. Mitigating technical risks is not a direct result of a penetration test. A penetration test would not provide certification of network security nor provide a complete list of vulnerabilities. The MOST effective approach to ensure the continued effectiveness of information security controls is by: Select an answer: A. ensuring inherent control strength. B. ensuring strategic alignment. C. utilizing effective life cycle management. D. utilizing effective change management.>>> You answered D. The correct answer is C. Managing controls over their life cycle will allow for compensation of decreased effectiveness over time. Inherent strength will not ensure that controls do not degrade over time. Maintaining strategic alignment will help identify life cycle stages of controls, but by itself will not address control degradation. Change management strongly supports life cycle management, but by itself does not address the complete cycle. Which of the following documents would be the BEST reference to determine whether access control mechanisms are appropriate for a critical application?Select an answer: A. User security procedures B. Business process flow C. IT security standards D. Regulatory requirements>>> You answered A. The correct answer is C. IT management should ensure that mechanisms are implemented in line with IT security standards. Procedures are determined by the policy. A user security procedure does not describe the access control mechanism in place. The business process flow is not relevant to the access control mechanism. The organization's own policy and procedures should take into account regulatory requirements. The IT function has declared that it is not necessary to update the business impact analysis (BIA) when putting a new application into production because it does not produce modifications in the business processes. The information security manager should: Select an answer: A. verify the decision with the business units. B. check the system's risk analysis. C. recommend update after postimplementation review. D. request an audit review.>>> You are correct, the answer is A. Verifying the decision with the business units is the correct answer because it is not the IT function's responsibility to decide whether a new application modifies business processes. Choice B does not consider the change in the applications. Choices C and D delay the update. Information security governance is PRIMARILY driven by: Select an answer: A. technology constraints. B. regulatory requirements. C. litigation potential. D. business strategy.>>> You are correct, the answer is D. Governance is directly tied to the strategy and direction of the business. Technology constraints, regulatory requirements and litigation potential are all important factors, but they are necessarily in line with the business strategy. The FIRST step in developing an information security management program is to: Select an answer: A. identify business risk that affects the organization. B. establish the need for creating the program. C. assign responsibility for the program. D. assess adequacy of existing controls.>>> You answered A. The correct answer is B. In developing an information security management program, the first step is to establish the need for creating the program. This is a business decision based more on judgment than on any specific quantitative measures. After establishing the need, the other choices are assigned and acted on.A privacy statement on a company's e-commerce web site should include: Select an answer: A. a statement regarding what the company will do with the information it collects. B. a disclaimer regarding the accuracy of information on its web site. C. technical information regarding how information is protected. D. a statement regarding where the information is being hosted.>>> You are correct, the answer is A. Most privacy laws and regulations require disclosure on how information will be used. A disclaimer is not necessary since it does not refer to data privacy. Technical details regarding how information is protected are not mandatory to publish on the web site and in fact would not be desirable. It is not mandatory to say where information is being hosted. What are the essential elements of risk? Select an answer: A. Impact and threat B. Likelihood and consequence C. Threat and exposure D. Sensitivity and exposure>>> You are correct, the answer is B. A. Threat is an element of risk only in combination with vulnerability. B. Risk is the combination of the probability of an event and its consequence. (ISO/IEC 73) The probability of an event is threat exploiting a vulnerability. C. Threat and exposure are insufficient to determine risk. D. Sensitivity is a measure of consequence, but does not take into account probability. Exposure moderates risk, but is not in itself a component of risk. From an information security manager perspective, what is the immediate benefit of clearly-defined roles and responsibilities? Select an answer: A. Enhanced policy compliance B. Improved procedure flows C. Segregation of duties D. Better accountability>>> You answered C. The correct answer is D. Without well-defined roles and responsibilities, there cannot be accountability. Choice A is incorrect because policy compliance requires adequately defined accountability first and therefore is a byproduct. Choice B is incorrect because people can be assigned to execute procedures that are not well designed. Choice C is incorrect because segregation of duties is not automatic, and roles may still include conflicting duties. What action should the security manager take FIRST when incident reports from different organizational units are inconsistent and highly inaccurate? Select an answer: A. Ensure that a clear organizational incident definition and severity hierarchy exists. B. Initiate a companywide incident identification training and awareness program. C. Escalate the issue to the security steering committee for appropriate action.D. Involve human resources (HR) in implementing a reporting enforcement program.>>> You are correct, the answer is A. A. The first action is to validate that clear incident definition and severity criteria are established and communicated throughout the organization. B. A training program will not be effective until clear incident identification and severity criteria have been established. C. The steering committee may become involved after incident criteria have been clearly established and communicated. D. Enforcement activities will not be effective unless incident criteria have been clearly established and communicated. What is the BIGGEST concern for an information security manager reviewing firewall rules? Select an answer: A. The firewall allows source routing. B. The firewall allows broadcast propagation. C. The firewall allows unregistered ports. D. The firewall allows nonstandard protocols.>>> You are correct, the answer is A. If the firewall allows source routing, any outsider can carry out spoofing attacks by stealing the internal (private) IP addresses of the organization. Broadcast propagation, unregistered ports and nonstandard protocols do not create a significant security exposure. Which of the following is the MOST important reason for an information security review of contracts? Select an answer: A. To help ensure the parties to the agreement can perform B. To help ensure confidential data are not included in the agreement C. To help ensure appropriate controls are included D. To help ensure the right to audit is a requirement>>> You answered D. The correct answer is C. Agreements with external parties can expose an organization to information security risks that must be assessed and appropriately mitigated. The ability of the parties to perform is normally the responsibility of legal and the business operation involved. Confidential information may be in the agreement by necessity and, while the information security manager can advise and provide approaches to protect the information, the responsibility rests with the business and legal. Audit rights may be one of many possible controls to include in a third-party agreement, but is not necessarily a contract requirement, depending on the nature of the agreement. Logging is an example of which type of defense against systems compromise? Select an answer: A. Containment B. Detection C. Reaction D. Recovery>>> You are correct, the answer is B.Detection defenses include logging as well as monitoring, measuring, auditing, detecting viruses and intrusion. Examples of containment defenses are awareness, training and physical security defenses. Examples of reaction defenses are incident response, policy and procedure change, and control enhancement. Examples of recovery defenses are backups and restorations, failover and remote sites, and business continuity plans and disaster recovery plans. Which of the following would be the MOST important goal of an information security governance program? Select an answer: A. Review of internal control mechanisms B. Effective involvement in business decision making C. Total elimination of risk factors D. Ensuring trust in data>>> You answered B. The correct answer is D. The development of trust in the integrity of information among stakeholders should be the primary goal of information security governance. Review of internal control mechanisms relates more to auditing, while the total elimination of risk factors is not practical or possible. Proactive involvement in business decision making implies that security needs dictate business needs when, in fact, just the opposite is true. Involvement in decision making is important only to ensure business data integrity so that data can be trusted. Which of the following is the FIRST step after the intrusion detection system (IDS) sends out an alert about a possible attack? Select an answer: A. Assess the type and severity of the attack. B. Determine whether it is an actual incident. C. Contain the damage to minimize the risk. D. Minimize the disruption of computer resources.>>> You are correct, the answer is B. A. The type and severity of the attack should be studied once it is concluded that the incident is valid. B. An administrator conducting regular maintenance activities may trigger a falsepositive alarm from the IDS. One must validate a real incident before taking any action. C. Damage should be contained and risk minimized after confirming a valid incident, thus discovering the type and severity of the attack. D. One of the goals of incident response is to minimize the disruption of computer resources. Which of the following devices should be placed within a demilitarized zone (DMZ)? Select an answer: A. Network switch B. Web server C. Database server D. File/print server>>> You are correct, the answer is B. A web server should normally be placed within a demilitarized zone (DMZ) to shield the internal network. Database and file/print servers may contain confidential or valuabledata and should always be placed on the internal network, never on a DMZ that is subject to compromise. Switches may bridge a DMZ to another network but do not technically reside within the DMZ network segment. Which of the following BEST protects confidentiality of information? Select an answer: A. Information classification B. Segregation of duties C. Least privilege D. Systems monitoring>>> You answered A. The correct answer is C. A. While classifying information can help focus the assignment of privileges, classification itself does not provide enforcement. B. Only in very specific situations does segregation of duties safeguard confidentiality of information. C. Restricting access to information to those who need to have access is the most effective means of protecting confidentiality. D. Systems monitoring is a detective control rather than a preventive control. What is the MOST cost-effective method of identifying new vendor vulnerabilities? Select an answer: A. External vulnerability reporting sources B. Periodic vulnerability assessments performed by consultants C. Intrusion prevention software D. Honeypots located in the DMZ>>> You are correct, the answer is A. External vulnerability sources are going to be the most cost-effective method of identifying these vulnerabilities. The cost involved in choices B and C would be much higher, especially if performed at regular intervals. Honeypots would not identify all vendor vulnerabilities. In addition, honeypots located in the DMZ can create a security risk if the production network is not well protected from traffic from compromised honeypots. Which one of the following measures will BEST indicate the effectiveness of an incident response process? Select an answer: A. Number of open incidents B. Reduction of the number of security incidents C. Reduction of the average response time to an incident D. Number of incidents handled per month>>> You are correct, the answer is C. Of the list provided, the best measure of incident response effectiveness is the reduction of average response time to an incident. Reduction of response time helps minimize the impact of the incident. The total number of open incidents is not an indicator of incident response effectiveness because the team does not have direct control over the number of incidents it must handle at any given time. Reduction of the number of security incidents generally cannot be attributed to the effectiveness of the response team, but rather to improved controls. The number of incidents handled per month would not be a direct indicator of team effectiveness.What is the MOST important factor in the successful implementation of an enterprisewide information security program? Select an answer: A. Realistic budget estimates B. Security awareness C. Support of senior management D. Recalculation of the work factor>>> You are correct, the answer is C. Without the support of senior management, an information security program has little chance of survival. A company's leadership group, more than any other group, will more successfully drive the program. Their authoritative position in the company is a key factor. Budget approval, resource commitments, and companywide participation also require the buy-in from senior management. Senior management is responsible for providing an adequate budget and the necessary resources. Security awareness is important, but not the most important factor. Recalculation of the work factor is a part of risk management. An organization's IT change management process requires that all change requests be approved by the asset owner and the information security manager. The PRIMARY objective of getting the information security manager's approval is to ensure that: Select an answer: A. changes comply with security policy. B. risk from proposed changes is managed. C. rollback to a current status has been considered. D. changes are initiated by business managers.>>> You answered A. The correct answer is B. A. A change affecting a security policy is not handled by an IT change process. B. Changes in the IT infrastructure may have an impact on existing risk. An information security manager must ensure that the proposed changes do not adversely affect the security posture. C. Rollback to a current state may cause a security risk event and is normally part of change management, but is not the primary reason that security is involved in the review. D. The person who initiates a change has no effect on the person who reviews and authorizes an actual change. The MOST important purpose of implementing an incident response plan is to: Select an answer: A. prevent the occurrence of incidents. B. ensure business continuity. C. train users on resolution of incidents. D. promote business resiliency.>>> You answered B. The correct answer is D. A. The incident response plan is a means to respond to an event, but does not prevent the occurrence. B. Business continuity plans (BCPs), not incident response plans, are designed to restore business operations after a disaster; they cannot assure the actual outcome.C. The incident management plan may address training users, but the incident response plan does not. D. Business resilience refers to the ability of the business to withstand disruption. An effective incident response plan minimizes the impact of an incident to the level that it ideally is transparent to end users and business partners. Which one of the following groups has final responsibility for the effectiveness of security controls? Select an answer: A. The security administrator who implemented the controls B. The organization's chief information security officer (CISO) C. The organization's senior management D. The information systems (IS) auditor who recommended the controls>>> You are correct, the answer is C. Senior management holds ultimate responsibility for the effectiveness of security controls. Which of the following factors will MOST affect the extent to which controls should be layered? Select an answer: A. The extent to which controls are procedural B. The extent to which controls are subject to the same threat C. The total cost of ownership for existing controls D. The extent to which controls fail in a closed condition>>> You answered A. The correct answer is B. To manage the aggregate risk of total risk, common failure modes in existing controls must be addressed by adding or modifying controls so that they fail under different conditions. Whether controls are procedural or technical will not affect layering requirements. Excessive total cost of ownership is unlikely to be reduced by adding additional controls. Controls that fail in a closed condition pose a risk to availability, whereas controls that fail in an open condition may require additional control layers to prevent compromise. What is the PRIMARY focus if an organization considers taking legal action on a security incident? Select an answer: A. Obtaining evidence as soon as possible B. Preserving the integrity of the evidence C. Disconnecting all IT equipment involved D. Reconstructing the sequence of events>>> You are correct, the answer is B. The integrity of evidence should be kept, following the appropriate forensic techniques to obtain the evidence and a chain of custody procedure to maintain the evidence (in order to be accepted in a court of law). All other options are part of the investigative procedure, but they are not as important as preserving the integrity of the evidence.The main mail server of a financial institution has been compromised at the superuser level; the only way to ensure the system is secure would be to: Select an answer: A. change the root password of the system. B. implement multifactor authentication. C. rebuild the system from the original installation medium. D. disconnect the mail server from the network.>>> You are correct, the answer is C. Rebuilding the system from the original installation medium is the only way to ensure all security vulnerabilities and potential stealth malicious programs have been destroyed. Changing the root password of the system does not ensure the integrity of the mail server. Implementing multifactor authentication is an aftermeasure and does not clear existing security threats. Disconnecting the mail server from the network is an initial step, but does not guarantee security. From an information security manager perspective, what is the immediate benefit of clearly-defined roles and responsibilities? Select an answer: A. Enhanced policy compliance B. Improved procedure flows C. Segregation of duties D. Better accountability>>> You are correct, the answer is D. Without well-defined roles and responsibilities, there cannot be accountability. Choice A is incorrect because policy compliance requires adequately defined accountability first and therefore is a byproduct. Choice B is incorrect because people can be assigned to execute procedures that are not well designed. Choice C is incorrect because segregation of duties is not automatic, and roles may still include conflicting duties. An information security manager is in the process of investigating a network intrusion. One of the enterprise's employees is a suspect. The manager has just obtained the suspect's computer and hard drive. Which of the following is the BEST next step? Select an answer: A. Create an image of the hard drive. B. Encrypt the data on the hard drive. C. Examine the original hard drive. D. Create a logical copy of the hard drive.>>> You are correct, the answer is A. One of the first steps in an investigation is to create an image of the original hard drive. A physical copy will copy the data, block by block, including any hidden data blocks and hidden partitions that can be used to conceal evidence. Encryption is not required. Examining the hard drive is not good practice. A logical copy will only copy the files and folders and may not copy the necessary data to properly examine the hard drive for forensic evidence. Which of the following is the MOST relevant metric to include in an information security quarterly report to the executive committee? Select an answer: A. Security compliant servers trend reportB. Percentage of security compliant servers C. Number of security patches applied D. Security patches applied trend report>>> You are correct, the answer is A. The percentage of compliant servers will be a relevant indicator of the risk exposure of the infrastructure. However, the percentage is less relevant than the overall trend, which would provide a measurement of the efficiency of the IT security program. The number of patches applied would be less relevant, as this would depend on the number of vulnerabilities identified and patches provided by vendors. Which of the following elements are the MOST essential to develop an information security strategy? Select an answer: A. Complete policies and standards B. An appropriate governance framework C. Current state and objectives D. Management intent and direction>>> You answered D. The correct answer is C. A. Policies and standards are some of the primary tools to implement a strategy and are subsequent steps in the process. B. Implementing the information security strategy is the activity that populates or develops the governance framework. C. Because a strategy is essentially a plan to achieve an objective, it is essential to know the current state of information security and the desired future state or objectives. D. Management intent and direction is essential to developing objectives; the current state is also required. Which of the following is the BEST way to erase confidential information stored on magnetic tapes? Select an answer: A. Performing a low-level format B. Rewriting with zeros C. Burning them D. Degaussing them>>> You are correct, the answer is D. Degaussing the magnetic tapes would best dispose of confidential information since information is completely destroyed due to the magnetic effect of the degaussing process. Performing a low-level format and rewriting with zeros may still help, but some forensic tools can be used to retrieve information. Rewriting with zeros is dependent on the procedure used. Burning destroys the tapes and does not allow their reuse. Which of the following is the MAIN reason for performing risk assessment on a continuous basis? Select an answer: A. Justification of the security budget must be continually made. B. New vulnerabilities are discovered every day. C. The risk environment is constantly changing. D. Management needs to be continually informed about emerging risks.>>> You are correct, the answer is C.The risk environment is impacted by factors such as changes in technology, and business strategy. These changes introduce new threats and vulnerabilities to the organization. As a result, risk assessment should be performed continuously. Justification of a budget should never be the main reason for performing a risk assessment. New vulnerabilities should be managed through a patch management process. Informing management about emerging risks is important, but is not the main driver for determining when a risk assessment should be performed. A benefit of using a full disclosure (white box) approach as compared to a blind (black box) approach to penetration testing is that: Select an answer: A. it simulates the real-life situation of an external security attack. B. human intervention is not required for this type of test. C. less time is spent on reconnaissance and information gathering. D. critical infrastructure information is not revealed to the tester.>>> You are correct, the answer is C. Data and information required for penetration are shared with the testers, thus eliminating time that would otherwise have been spent on reconnaissance and gathering of information. Blind (black box) penetration testing is closer to real life than full disclosure (white box) testing. There is no evidence to support that human intervention is not required for this type of test. A full disclosure (white box) methodology requires the knowledge of the subject being tested. Which of the following is the BEST indicator of the level of acceptable risk in an organization? Select an answer: A. The proportion of identified risk that has been remediated B. The ratio of business insurance coverage to its cost C. The percentage of the IT budget allocated to security D. The percentage of assets that has been classified>>> You answered A. The correct answer is B. A. The proportion of unremediated risk may be an indicator, but there are many other factors unrelated to acceptable risk such as treatment feasibility, availability of controls, etc. B. The amount of business insurance coverage carried and the cost provide a directly quantifiable indication of the level of risk the organization will accept and at what cost. C. The percentage of the IT budget allocated to security is an indicator, but does not quantify acceptable levels of risk. D. Classifying assets will indicate which assets are more important than others, but does not quantify the acceptability of risk. Which web application attack facilitates unauthorized access to a database? Select an answer: A. Cross site request forgery B. Structured Query Language (SQL) injection C. MetasploitD. Cross site scripting>>> You are correct, the answer is B. SQL injection is a vulnerability that enables an attacker to execute commands through the web application, directly into the database. By accessing the database, data can potentially be read and altered. Cross site request forgery and cross site scripting attacks occur in the victim's web browser and have no access to database data. Metasploit is an exploit development suite that could allow access to a database by using one of its buffer overflow attacks, but this would not be a web application layer attack. Which of the following is an advantage of a centralized information security organizational structure? Select an answer: A. It is easier to promote security awareness. B. It is easier to manage and control. C. It is more responsive to business unit needs. D. It provides a faster turnaround for security requests.>>> You are correct, the answer is B. It is easier to manage and control a centralized structure. Promoting security awareness is an advantage of decentralization. Decentralization allows you to use field security personnel as security missionaries or ambassadors to spread the security awareness message. Decentralized operations allow security administrators to be more responsive. Being close to the business allows decentralized security administrators to achieve a faster turnaround than that achieved in a centralized operation. Which of the following is the BEST way to verify that all critical production servers are utilizing up-to-date virus signature files? Select an answer: A. Verify the date that signature files were last pushed out B. Use a recently identified benign virus to test if it is quarantined C. Research the most recent signature file and compare to the console D. Check a sample of servers that the signature files are current>>> You answered A. The correct answer is D. The only accurate way to check the signature files is to look at a sample of servers. The fact that an update was pushed out to a server does not guarantee that it was properly loaded onto that server. Checking the vendor information to the management console would still not be indicative as to whether the file was properly loaded on the server. Personnel should never release a virus, no matter how benign. A business unit intends to deploy a new technology in a manner that places it in violation of existing information security standards. What immediate action should an information security manager take? Select an answer: A. Enforce the existing security standard B. Change the standard to permit the deployment C. Perform a risk analysis to quantify the riskD. Perform research to propose use of a better technology>>> You are correct, the answer is C. Resolving conflicts of this type should be based on a sound risk analysis of the costs and benefits of allowing or disallowing an exception to the standard. A blanket decision should never be given without conducting such an analysis. Enforcing existing standards is a good practice; however, standards need to be continuously examined in light of new technologies and the risks they present. Standards should not be changed without an appropriate risk assessment. IT-related risk management activities are MOST effective when they are: Select an answer: A. treated as a distinct process. B. conducted by the IT department. C. integrated within business processes. D. communicated to all employees.>>> You are correct, the answer is C. IT-related risk management activities are more likely to be executed as part of a business process. The scope of IT-related risk management encompasses more than IT processes. Communication alone does not necessarily correlate with successful execution of the process. Which of the following BEST defines the relationships among security technologies? Select an answer: A. Security metrics B. Network topology C. Security architecture D. Process improvement models>>> You are correct, the answer is C. Security architecture explains the use and relationships of security mechanisms. Security metrics measure improvement within the security practice but do not explain the use and relationships of security technologies. Process improvement models and network topology diagrams also do not describe the use and relationships of these technologies. Which of the following is generally considered a fundamental component of an information security program? Select an answer: A. Role-based access control systems B. Automated access provisioning C. Security awareness training D. Intrusion prevention systems (IPSs)>>> You answered A. The correct answer is C. Without security awareness training, many components of the security program may not be effectively implemented. The other options may or may not be necessary, but are discretionary. After a service interruption of a critical system, the incident response team finds that it needs to activate the warm recovery site. Discovering that throughput is only half of theprimary site, the team nevertheless notifies management that it has restored the critical system. This is MOST likely because it has achieved the: Select an answer: A. recovery point objective (RPO). B. recovery time objective (RTO). C. service delivery objective (SDO). D. maximum tolerable outage (MTO).>>> You answered B. The correct answer is C. A. The RPO is determined based on the acceptable data loss in case of a disruption of operations. It indicates the earliest point in time that is acceptable to recover the data. The RPO effectively quantifies the permissible amount of data loss in case of interruption. B. The RTO is the target time to restore services to either the SDO or normal operations. C. The SDO is the agreed-on level of service required to resume acceptable operations. D. MTO is the maximum length of time that the organization can operate at the recovery site. Which of the following is the MOST critical consideration when collecting and preserving admissible evidence during an incident response? Select an answer: A. Unplugging the systems B. Chain of custody C. Separation of duties D. Clock synchronization>>> You answered A. The correct answer is B. Admissible evidence must be collected and preserved by "chain of custody." Unplugging the systems can cause potential loss of information critical to the investigation. Separation of duties is not necessary in evidence collection and preservation since the entire process can be done by a single person. Clock synchronization is not as important for the collection and preservation of admissible evidence. The BEST defense against successful phishing attacks is: Select an answer: A. application hardening. B. spam filters. C. an intrusion detection system (IDS). D. end user awareness.>>> You are correct, the answer is D. Phishing attacks are due to social engineering attacks and are best defended by user awareness training. Application hardening, spam filters and IDSs are inadequate since the phishing attacks usually don't have the same patterns or unique signatures. Which of the following is MOST likely to improve the effectiveness of the incident response team? Select an answer: A. Briefing team members on the nature of new threats to IS security B. Periodic testing and updates to incorporate lessons learnedC. Ensuring that all members have a good understanding of IS technology D. A nonhierarchical structure to ensure that team members can share ideas>>> You are correct, the answer is B. A. The fact that threats can materialize into an incident requires the presence of system vulnerabilities. It is the vulnerabilities that should be the focus of analysis when considering incident management procedures. B. Periodic testing and updates to incorporate lessons learned will ensure that implementation of the incident management response plan is aligned and kept current with the business priorities set by business management. C. All of the members of the incident management response team do not need to have IS skills. Members who take charge of implementing the incident management response plan should be able to utilize different skills to ensure alignment with the organization's procedures and policies. D. It is important that someone take ownership of implementing the incident management plan; for instance, to formally declare that such a plan needs to be put into place after an incident. A nonhierarchical structure can introduce ambiguity as to who is responsible for what aspects of the incident management response plan. An information security manager has been asked to develop a change control process. What is the FIRST thing the information security manager should do? Select an answer: A. Research best practices B. Meet with stakeholders C. Establish change control procedures D. Identify critical systems>>> You are correct, the answer is B. No new process will be successful unless it is adhered to by all stakeholders; to the extent stakeholders have input, they can be expected to follow the process. Without consensus agreement from the stakeholders, the scope of the research is too wide; input on the current environment is necessary to focus research effectively. It is premature to implement procedures without stakeholder consensus and research. Without knowing what the process will be, the parameters to baseline are unknown as well. An organization is using a vendor-supplied critical application which has a maximum password length that does not comply with organizational security standards. Which of the following approaches BEST helps mitigate the weakness? Select an answer: A. Shorten the password validity period. B. Encourage the use of special characters. C. Strengthen segregation of duties (SoD). D. Introduce compensatory controls.>>> You are correct, the answer is D. A. Periodic change of password is a good control against password theft. However, it would not compensate for the shortcoming in password length. B. Use of special characters will enhance password complexity. However, it will not fully replace the shortcoming in password length.C. Segregation of duties (SoD) will tighten the control against fraud. However, it will not resolve password noncompliance. D. Vendor systems are sometimes unable to provide a security control that meets the policy of the organization. In such cases, compensating controls should be sought, e.g., password lockout on failed attempts. The information classification scheme should: Select an answer: A. consider possible impact of a security breach. B. classify personal information in electronic form. C. be performed by the information security manager. D. classify systems according to the data processed.>>> You answered D. The correct answer is A. Data classification is determined by the business risk, i.e., the potential impact on the business of the loss, corruption or disclosure of information. Data classification must be applied to information in all forms, both electronic and physical (paper), and should be applied by the data owner, not the security manager. Classification of personal information in electronic form is an incomplete answer because it addresses a subset of organizational data. Systems are not classified per se, but the data they process and store should definitely be classified. Which of the following choices is MOST likely to ensure that responsibilities are carried out? Select an answer: A. Signed contracts B. Severe penalties C. Assigned accountability D. Clear policies>>> You are correct, the answer is C. A. Contracts can define responsibilities, but it is essential that individuals are accountable. B. Penalties can reinforce accountability and are a deterrent control, but will not ensure that responsibilities are always discharged properly. C. Assigning accountability to individuals is most likely to ensure that duties are properly carried out. D. Policies generally record a high-level principle or course of action that has been decided on; they are advantageous, but it is more effective to establish direct accountability to ensure that responsibilities are performed. Which of the following items determines the acceptable level of residual risk in an organization? Select an answer: A. Management discretion B. Regulatory requirements C. Inherent risk D. Internal audit findings>>> You answered D. The correct answer is A.A. Deciding what level of risk is acceptable to an organization is fundamentally a function of management. At its discretion, organizational management may decide to accept risk. The target risk level for a control is therefore ultimately subject to management discretion. B. Failure to comply with regulatory requirements has consequences, but those consequences are considered in the context of organizational risk. In some cases, the cost of failure to comply may be lower than the cost of compliance; in this case, management may decide to accept the risk. C. Inherent risk is the risk that exists before controls are applied. D. The results of an internal audit are used to determine the actual level of residual risk, but whether this level is acceptable is fundamentally a function of management. It is MOST important that information security architecture be aligned with which of the following? Select an answer: A. Industry best practices B. Business goals and objectives C. Information technology (IT) plans D. International information security frameworks>>> You are correct, the answer is B. Information security architecture should always be aligned with business goals and objectives. It is also important to align it with IT plans, but that should be a natural outcome of business alignment. Alignment with external practices and frameworks should be a secondary consideration. Which of the following is the PRIMARY reason for implementing a risk management program? Select an answer: A. Allows the organization to eliminate risk B. Is a necessary part of management's due diligence C. Satisfies audit and regulatory requirements D. Assists in increasing the return on investment (ROI)>>> You answered A. The correct answer is B. The key reason for performing risk management is that it is part of management's due diligence. The elimination of all risk is not possible. Satisfying audit and regulatory requirements is of secondary importance. A risk management program may or may not increase the ROI. Which of the following is MOST important to achieve proportionality in the protection of enterprise information systems? Select an answer: A. Asset classification B. Risk assessment C. Security architecture D. Configuration management>>> You answered B. The correct answer is A. A. Asset classification is based on the criticality and sensitivity of information assets with the goal of providing the appropriate, and therefore proportional, degree of protection.B. Proper risk assessment requires assets to be classified; asset classification most directly impacts the mitigation efforts an organization will implement. C. Security architecture will be affected by asset classification and, to some extent, may affect how assets are classified; asset classification most directly impacts the mitigation efforts an organization will implement. D. Configuration management is likely to be affected by asset classification levels, but is not directly related to information security. For risk management purposes, the value of a physical asset should be based on: Select an answer: A. original cost. B. net cash flow. C. net present value. D. replacement cost.>>> You are correct, the answer is D. The value of a physical asset should be based on its replacement cost since this is the amount that would be needed to replace the asset if it were to become damaged or destroyed. Original cost may be significantly different than the current cost of replacing the asset. Net cash flow and net present value do not accurately reflect the true value of the asset. Where should a firewall be placed? Select an answer: A. On the web server B. On the intrusion detection system (IDS) server C. On the screened subnet D. On the domain boundary>>> You are correct, the answer is D. A firewall should be placed on a (security) domain boundary. Placing it on a web server or screened subnet, which is a demilitarized zone (DMZ), does not provide any protection. Since firewalls should be installed on hardened servers with minimal services enabled, it is inappropriate to have the firewall and the intrusion detection system (IDS) on the same physical device. Data owners must provide a safe and secure environment to ensure confidentiality, integrity and availability of the transaction. This is an example of an information security: Select an answer: A. baseline. B. strategy. C. procedure. D. policy.>>> You answered A. The correct answer is D. A policy is a high-level statement of an organization's beliefs, goals, roles and objectives. Baselines assume a minimum security level throughout an organization. The information security strategy aligns the information security program with business objectives rather than making control statements. A procedure is a step-by-step process of how policy and standards will be implemented.Which of the following is the BEST quantitative indicator of an organization's current risk tolerance? Select an answer: A. The number of incidents and the subsequent mitigation activities B. The number, type and layering of deterrent control technologies C. The extent of risk management requirements in policies and standards D. The ratio of cost to insurance coverage for business interruption protection>>> You answered A. The correct answer is D. The cost of a business interruption can be accurately determined. The comparison of this expense (added to any deductible) with the total cost of premiums paid for a specific amount of insurance can serve as an accurate indicator of how much the organization will spend to protect against a defined loss. Incident history can provide only an approximation of the organization's efforts to mitigate further occurrences after consequences have been determined. Incident history may also indicate a lack of risk awareness. Controls deployment can provide a qualitative estimation of risk tolerance as long as technologies are tested and effectiveness is determined. Requirements set in policies and standards can only serve as a qualitative approximation of risk tolerance. Which of the following tools should a newly hired information security manager review to gain an understanding of how effectively the current set of information security projects is managed? Select an answer: A. A project database B. A project portfolio database C. Policy documents D. A program management office>>> You answered C. The correct answer is B. A. A project database may contain information for one specific project and updates to various parameters pertaining to the current status of that single project. B. A project portfolio database is the basis for project portfolio management. It includes project data such as owner, schedules, objectives, project type, status and cost. Project portfolio management requires specific project portfolio reports. C. Policy documents on project management set direction for the design, development, implementation and monitoring of the project. D. A program management office is the team that oversees the delivery of the project portfolio. Review of the office may provide meaningful insights into the skill set and organizational structure, but not on how effectively the current set of information security projects is managed. Which of the following is the MOST important objective of an information security strategy review? Select an answer: A. Ensuring that risk is identified and mitigated B. Ensuring that information security strategy is aligned with organizational goals C. Maximizing the return on information security investments D. Ensuring the efficient utilization of information security resources>>> You are correct, the answer is B.The most important part of an information security strategy is that it supports the business objectives and goals of the enterprise. Without alignment with business goals, the risk identified and mitigated as part of the information security strategy may not be the risk that is considered most significant to the business. Maximizing return on information security investment can only be achieved if the information security strategy is aligned with the business strategy. Efficient utilization of resources at the enterprise level can only be achieved if the information security strategy is aligned with the business strategy. Management decided that the organization will not achieve compliance with a recently issued set of regulations. Which of the following is the MOST likely reason for the decision? Select an answer: A. The regulations are ambiguous and difficult to interpret. B. Management has a low level of risk tolerance. C. The cost of compliance exceeds the cost of possible sanctions. D. The regulations are inconsistent with the organizational strategy.>>> You are correct, the answer is C. A. Management should address ambiguous regulations by requesting clarification from the issuer or the legal department. B. Management decisions on compliance should be based on a cost-benefit analysis. C. Management may decide it is less expensive to deal with possible sanctions than to attempt to be in compliance. D. The fact that the regulations are inconsistent with the organizational strategy is not a major factor in deciding not to comply. Which of the following reasons is the MOST important to develop a strategy before implementing an information security program? Select an answer: A. To justify program development costs B. To integrate development activities C. To gain management support for an information security program D. To comply with international standards>>> You answered C. The correct answer is B. A. Justification for program costs will need to be achieved prior to developing the strategy and is more likely based on a business case than on the strategy. B. A strategy is a plan to achieve an objective that serves to align and integrate program activities to achieve the defined outcomes. C. Management support will need to be achieved prior to developing the strategy and is more likely based on a business case than on the strategy. D. Compliance with international standards, such as ISO 27001, does not necessarily require a cohesive plan of action or strategy and can be done piecemeal. If meeting the standard is one of the objectives, a strategy should encompass the actions needed to meet those requirements.Why would an organization decide not to take any action on a denial of service (DoS) risk found by the risk assessment team? Select an answer: A. There are sufficient safeguards in place to prevent this risk from happening. B. The needed countermeasures are too complicated to deploy. C. The cost of countermeasures outweighs the value of the asset and potential loss. D. the likelihood of the risk occurring is unknown.>>> You are correct, the answer is C. An organization may decide to live with specific risks because it would cost more to protect themselves than the value of the potential loss. The safeguards need to match the risk level. While countermeasures could be too complicated to deploy, this is not the most compelling reason. It is unlikely that a global financial institution would not be exposed to such attacks and the frequency could not be predicted. Which would be one of the BEST metrics an information security manager can employ to effectively evaluate the results of a security program? Select an answer: A. Number of controls implemented B. Percent of control objectives accomplished C. Percent of compliance with the security policy D. Reduction in the number of reported security incidents>>> You answered C. The correct answer is B. Control objectives are directly related to business objectives; therefore, they would be the best metrics. Number of controls implemented does not have a direct relationship with the results of a security program. Percentage of compliance with the security policy and reduction in the number of security incidents are not as broad as choice B. Investments in information security technologies should be based on: Select an answer: A. vulnerability assessments. B. value analysis. C. business climate. D. audit recommendations.>>> You are correct, the answer is B. Investments in security technologies should be based on a value analysis and a sound business case. Demonstrated value takes precedence over the current business climate because it is ever changing. Basing decisions on audit recommendations would be reactive in nature and might not address the key business needs comprehensively. Vulnerability assessments are useful, but they do not determine whether the cost is justified. Which of the following items determines the acceptable level of residual risk in an organization? Select an answer: A. Management discretion B. Regulatory requirements C. Inherent risk D. Internal audit findings>>> You are correct, the answer is A.A. Deciding what level of risk is acceptable to an organization is fundamentally a function of management. At its discretion, organizational management may decide to accept risk. The target risk level for a control is therefore ultimately subject to management discretion. B. Failure to comply with regulatory requirements has consequences, but those consequences are considered in the context of organizational risk. In some cases, the cost of failure to comply may be lower than the cost of compliance; in this case, management may decide to accept the risk. C. Inherent risk is the risk that exists before controls are applied. D. The results of an internal audit are used to determine the actual level of residual risk, but whether this level is acceptable is fundamentally a function of management. In controlling information leakage, management should FIRST establish: Select an answer: A. a data leak prevention program. B. user awareness training. C. an information classification process. D. a network intrusion detection system (IDS).>>> You are correct, the answer is C. Information classification must be conducted first. Only after data are determined critical to the organization can a data leak prevention program be properly implemented. User awareness training can be helpful, but only after data have been classified. Network intrusion detection is a technology that can support the data leak prevention program, but it is not a primary consideration. Which of the following is the BEST indicator that operational risks are effectively managed in an enterprise? Select an answer: A. A tested business continuity/disaster recovery plan (BCP/DRP) B. An increase in timely reporting of incidents by employees C. Extent of risk management education D. Regular review of risks by senior management>>> You are correct, the answer is A. A tested BCP/DRP is the best indicator that operational risks are managed effectively in the enterprise. Reporting incidents by employees is an indicator, but not the best choice because it is dependent upon the knowledge of the employees. Extent of risk management education is not correct since this may not necessarily indicate that risks are effectively managed in the enterprise. A high level of risk management education would help, but would not necessarily mean that risks are managed effectively. Regular review of risks by senior management is not correct since this may not necessarily indicate that risks are effectively managed in the enterprise. Top management involvement would greatly help, but would not necessarily mean that risks are managed effectively. For an organization's information security program to be highly effective, who should have final responsibility for authorizing information system access? Select an answer: A. Information ownerB. Security manager C. Chief information officer (CIO) D. System administrator>>> You are correct, the answer is A. Since the information owner best understands the nature of the information in the system and best understands who should need access to the information, the information owner or manager should provide authorization for users to access the information systems under their control. In addition to backup data, which of the following is the MOST important to store offsite in the event of a disaster? Select an answer: A. Copies of critical contracts and service level agreements (SLAs) B. Copies of the business continuity plan C. Key software escrow agreements for the purchased systems D. List of emergency numbers of service providers>>> You answered C. The correct answer is B. Without a copy of the business continuity plan, recovery efforts would be severely hampered or may not be effective. All other choices would not be as immediately critical as the business continuity plan itself. The business continuity plan would contain a list of the emergency numbers of service providers. What is the PRIMARY focus of the change control process? Select an answer: A. To ensure that changes are authorized B. To ensure that changes are applied C. To ensure that changes are documented D. To ensure that changes are tested>>> You are correct, the answer is A. All steps in the change control process must be signed off on to ensure proper authorization. It is important that changes are applied, documented and tested; however, they are not the primary focus. The MOST effective technical approach to mitigate the risk of confidential information being disclosed in email attachments is to implement: Select an answer: A. content filtering. B. data classification. C. information security awareness. D. encryption for all attachments.>>> You answered B. The correct answer is A. Content filtering provides the ability to examine the content of attachments and prevent information containing certain words or phrases, or of certain identifiable classifications, from being sent out of the enterprise. Data classification helps identify the material that should not be transmitted via email attachments, but by itself will not prevent exposure. Information security awareness training also helps limit confidential material from being disclosed via email as long as personnel are aware of what information should not be exposed and willingly comply with the requirements. Encrypting all attachments is noteffective because it does not limit the content and may actually obscure confidential information contained in the email. What is the MAIN drawback of emailing password-protected zip files across the Internet? Select an answer: A. They all use weak encryption. B. They are decrypted by the firewall. C. They may be quarantined by mail filters. D. They may be corrupted by the receiving mail server.>>> You are correct, the answer is C. Often, mail filters will quarantine zip files that are password-protected since the filter (or the firewall) is unable to determine if the file contains malicious code. Many zip file products are capable of using strong encryption. Such files are not normally corrupted by the sending mail server. When recommending a control to protect corporate applications against structured query language (SQL) injection, the information security manager is MOST likely to suggest: Select an answer: A. hardening of web servers. B. consolidating multiple sites into a single portal. C. coding standards and reviewing code. D. using https in place of http.>>> You are correct, the answer is C. Implementing secure coding standards and peer review as part of the enterprise's systems development life cycle (SDLC) are controls that address SQL injection. The other choices do not reduce this type of vulnerability. What is the MAIN risk when there is no user management representation on the Information Security Steering Committee? Select an answer: A. Functional requirements are not adequately considered. B. User training programs may be inadequate. C. Budgets allocated to business units are not appropriate. D. Information security plans are not aligned with business requirements.>>> You answered C. The correct answer is D. The steering committee controls the execution of the information security strategy, according to the needs of the organization, and decides on the project prioritization and the execution plan. User management is an important group that should be represented to ensure that the information security plans are aligned with the business needs. Functional requirements and user training programs are considered to be part of the projects but are not the main risks. The steering committee does not approve budgets for business units. Which of the following is the MAIN reason for performing risk assessment on a continuous basis?Select an answer: A. Justification of the security budget must be continually made. B. New vulnerabilities are discovered every day. C. The risk environment is constantly changing. D. Management needs to be continually informed about emerging risks.>>> You are correct, the answer is C. The risk environment is impacted by factors such as changes in technology, and business strategy. These changes introduce new threats and vulnerabilities to the organization. As a result, risk assessment should be performed continuously. Justification of a budget should never be the main reason for performing a risk assessment. New vulnerabilities should be managed through a patch management process. Informing management about emerging risks is important, but is not the main driver for determining when a risk assessment should be performed. Risk acceptance is a component of which of the following? Select an answer: A. Risk assessment B. Risk treatment C. Risk evaluation D. Risk monitoring>>> You answered A. The correct answer is B. Risk acceptance is one of the alternatives to be considered in the risk treatment process; the other alternatives are risk avoidance, risk transfer and risk mitigation. Risk assessment and evaluation are components of the risk analysis process. Risk acceptance is not a component of risk monitoring. Risk monitoring provides timely information on the actual status of the enterprise with regard to risk. The PRIMARY reason for senior management review of information security incidents is to: Select an answer: A. ensure adequate corrective actions were implemented. B. demonstrate management commitment to the information security process. C. evaluate the incident response process for deficiencies. D. evaluate the ability of the security team.>>> You are correct, the answer is A. Although some corrective actions are being taken by the security team and the incident response team, management review will ensure whether there are any other corrective actions that need to be taken. Sometimes this will result in improvements to information security policies. Management will not review information security incidents merely to demonstrate management commitment. Management will not perform a review for fault finding such as examining the incidence response process for deficiencies and the ability of the security team. The value of tangible assets can be BEST determined by which of the following? Select an answer: A. The market value minus the book value B. The book value minus the market value C. Adding the totals of the asset classificationD. A business impact assessment and analysis>>> You answered D. The correct answer is A. A. The value of tangible assets, such as inventory, is defined as the market value minus the book value. B. The value of assets is defined as the market value minus the book value. C. Asset classification is the assignment of a level of sensitivity to assets that results in the specification of controls for each level of classification. The classification level is an indication of the value or importance of the data to the organization. These specific values are generally qualitative and cannot be added. D. A business impact analysis (BIA) is an exercise that determines the impact to an organization of losing the support of any resource. It helps establish the escalation of that loss over time, identifies the minimum resources needed to recover, and prioritizes the recovery of processes and the supporting system. A BIA does not determine asset values. While governance, risk and compliance (GRC) can be applied to any area of an organization, it is MOST often focused on which of the following areas? Select an answer: A. Operations and marketing B. IT, finance and legal C. Audit, risk and regulations D. Information security and risk>>> You answered C. The correct answer is B. A. Governance, risk and compliance (GRC) is generally not used in support of operations and marketing. B. Governance, risk and compliance (GRC) is largely concerned with ensuring that processes in IT, finance and legal are in compliance with regulatory requirements, that proper rules are in place and that risk is appropriately addressed. C. Audit, risk and regulations are support functions to IT, finance and legal. D. Information security and risk can be a part of governance, risk and compliance (GRC), and interrelate to audit, risk and regulations, but are primarily in support of IT, finance and legal. The MOST important characteristic of good security policies is that they: Select an answer: A. state expectations of IT management. B. state only one general security mandate. C. are aligned with organizational goals. D. govern the creation of procedures and guidelines.>>> You are correct, the answer is C. The most important characteristic of good security policies is that they be aligned with organizational goals. Failure to align policies and goals significantly reduces the value provided by the policies. Stating expectations of IT management omits addressing overall organizational goals and objectives. Stating only one general security mandate is the next best option since policies should be clear; otherwise, policies may be confusing and difficult to understand. Governing the creation of procedures and guidelines is most relevant to information security standards.Which of the following roles would represent a conflict of interest for an information security manager? Select an answer: A. Evaluation of third parties requesting connectivity B. Assessment of the adequacy of disaster recovery plans C. Final approval of information security policies D. Monitoring adherence to physical security controls>>> You are correct, the answer is C. Since management is ultimately responsible for information security, it should approve information security policy statements; the information security manager should not have final approval. Evaluation of third parties requesting access, assessment of disaster recovery plans and monitoring of compliance with physical security controls are acceptable practices and do not present any conflicts of interest. Which two components PRIMARILY must be assessed in an effective risk analysis? Select an answer: A. Visibility and duration B. Likelihood and impact C. Probability and frequency D. Financial impact and duration>>> You are correct, the answer is B. The probability or likelihood of the event and the financial impact or magnitude of the event must be assessed first. Duration refers to the length of the event; it is important in order to assess impact but is secondary. Once the likelihood is determined, the frequency is also important to determine overall impact. To be effective, risk management should be applied to: Select an answer: A. all organizational activities. B. those elements identified by a risk assessment. C. any area that exceeds acceptable risk levels. D. only those areas that have potential impact.>>> You are correct, the answer is A. A. While not all organizational activities will pose an unacceptable risk, the practice of risk management is still applied to determine which risk requires treatment. B. Risk assessment is part of the risk management function. Risk assessment does not precede inclusion of the activity in the risk management program. C. Whether a risk level is acceptable can be determined only when the risk is known. D. Potential impact can be evaluated only when the risk is known and the value of the asset is determined. Which of the following is the MOST important information to include in an information security standard? Select an answer: A. Creation date B. Author name C. Initial draft approval dateD. Last review date>>> You answered A. The correct answer is D. The last review date confirms the currency of the standard, affirming that management has reviewed the standard to assure that nothing in the environment has changed that would necessitate an update to the standard. The name of the author, as well as the creation and draft dates, are not that important. An appropriate risk treatment method is: Select an answer: A. the method that minimizes risk to the greatest extent. B. based on the organization's risk tolerance. C. an efficient approach to achieve control objectives. D. the method that maximizes risk mitigation.>>> You answered B. The correct answer is C. A. While minimizing risk is generally preferable, doing so beyond what is acceptable is likely too costly and counterproductive. B. The risk tolerance triggers the risk response; however, it does not define the actual treatment method. C. Control objectives will have been determined based on acceptable risk and the least costly or most efficient approach to do so will be the most appropriate. D. Mitigation is just one treatment option and may not be the most appropriate. Which of the following would raise security awareness among an organization's employees? Select an answer: A. Distributing industry statistics about security incidents B. Monitoring the magnitude of incidents C. Encouraging employees to behave in a more conscious manner D. Continually reinforcing the security policy>>> You answered C. The correct answer is D. Employees must be continually made aware of the policy and expectations of their behavior. Choice A would have little relevant bearing on the employee's behavior. Choice B does not involve the employees. Choice C could be an aspect of continual reinforcement of the security policy. An enterprise is transferring its IT operations to an offshore location. An information security manager should PRIMARILY focus on: Select an answer: A. reviewing new laws and regulations. B. updating operational procedures. C. validating staff qualifications. D. conducting a risk assessment.>>> You are correct, the answer is D. A risk assessment should be conducted to determine new risks introduced by the outsourced processes. The other choices may or may not be identified as mitigating measures based on the risks determined by the assessment. What is the MAIN objective for developing an information security program?Select an answer: A. To create the information security policy B. To maximize system uptime C. To develop strong controls D. To implement the strategy>>> You are correct, the answer is D. A. The policy should not be written for its own sake. To be effective, the policy must address the threat and risk landscape that is usually the basis for strategy development. B. The degree of uptime required will be defined as a part of strategy development balanced against costs. C. Not all controls need to be strong, and the degree of control must be determined by cost effectiveness, impact on productivity and other factors. D. The information security strategy provides a development road map to which the program is built. What mechanisms are used to identify deficiencies that would provide attackers with an opportunity to compromise a computer system? Select an answer: A. Business impact analyses B. Security gap analyses C. System performance metrics D. Incident response processes>>> You are correct, the answer is B. A security gap analysis is a process which measures all security controls in place against typically good business practice, and identifies deficiencies. A business impact analysis is less suited to identify security deficiencies. System performance metrics may indicate security weaknesses, but that is not their primary purpose. Incident response processes exist for cases where security weaknesses are exploited. Which of the following controls is MOST effective in providing reasonable assurance of physical access compliance to an unmanned server room controlled with biometric devices? Select an answer: A. Regular review of access control lists B. Security guard escort of visitors C. Visitor registry log at the door D. A biometric coupled with a PIN>>> You answered C. The correct answer is A. A review of access control lists is a detective control that will enable an information security manager to ensure that authorized persons are entering in compliance with corporate policy. Visitors accompanied by a guard will also provide assurance but may not be cost effective. A visitor registry is the next cost-effective control. A biometric coupled with a PIN will strengthen the access control; however, compliance assurance logs will still have to be reviewed. A critical device is delivered with a single user and password that is required to be shared for multiple users to access the device. An information security manager has been tasked with ensuring all access to the device is authorized. Which of the following would be the MOST efficient means to accomplish this?Select an answer: A. Enable access through a separate device that requires adequate authentication B. Implement manual procedures that require password change after each use C. Request the vendor to add multiple user IDs D. Analyze the logs to detect unauthorized access>>> You answered B. The correct answer is A. Choice A is correct because it allows authentication tokens to be provisioned and terminated for individuals and also introduces the possibility of logging activity by individual. Choice B is not effective because users can circumvent the manual procedures. Choice C is not the best option because vendor enhancements may take time and development, and this is a critical device. Choice D could, in some cases, be an effective complementary control but, because it is detective, it would not be the most effective in this instance. Which of the following is the MOST important element of information asset classification? Select an answer: A. Residual risk B. Separation of duties C. Potential impact D. Need to know>>> You are correct, the answer is C. Classification levels must be based on the level of impact that would occur as a result of compromise. Residual risk is considered for acceptability after controls are implemented. Separation of duties and need to know are controls unrelated to asset classification. What is the PRIMARY factor that should be taken into consideration when designing the technical solution for a disaster recovery site? Select an answer: A. Services delivery objective B. Recovery time objective (RTO) C. Recovery window D. Maximum tolerable outage (MTO)>>> You answered B. The correct answer is C. The length of the recovery window is defined by business management and determines the acceptable time frame between a disaster and the restoration of critical services/applications. The technical implementation of the disaster recovery (DR) site will be based on this constraint, especially the choice between a hot, warm or cold site. The service delivery objective is supported during the alternate process mode until the normal situation is restored, which is directly related to business needs. The recovery time objective (RTO) is commonly agreed to be the time frame between a disaster and the return to normal operations. It is then longer than the interruption window and is very difficult to estimate in advance. The time frame between the reduced operation mode at the end of the interruption window and the return to normal operations depends on the magnitude of the disaster. Technical disaster recovery solutions alone will not used for returning to normal operations. Maximum tolerable outage (MTO) is the maximum time acceptable by a company operating in reduced mode before experiencing losses.Theoretically, recovery time objectives (RTOs) equal the interruption window plus the maximum tolerable outage. This will not be the primary factor for the choice of the technical disaster recovery solution. Which of the following is the FIRST phase in which security should be addressed in the development cycle of a project? Select an answer: A. Design B. Implementation C. Application security testing D. Feasibility>>> You answered A. The correct answer is D. Information security should be considered at the earliest possible stage. Security requirements must be defined before you enter into design specification, although changes in design may alter these requirements later on. Security requirements defined during system implementation are typically costly add-ons that are frequently ineffective. Application security testing occurs after security has been implemented. Which of the following types of risk is BEST assessed using quantitative risk assessment techniques? Select an answer: A. Stolen customer data B. An electrical power outage C. A defaced web site D. Loss of the software development team>>> You answered A. The correct answer is B. The effect of the theft of customer data or web site defacement by hackers could lead to a permanent decline in customer confidence, which does not lend itself to measurement by quantitative techniques. Loss of a majority of the software development team could have similar unpredictable repercussions. However, the loss of electrical power for a short duration is more easily measurable and can be quantified into monetary amounts that can be assessed with quantitative techniques. An organization has decided to implement governance, risk and compliance (GRC) processes into several critical areas of the enterprise. Which of the following objectives is the MAIN one? Select an answer: A. To reduce governance costs B. To improve risk management C. To harmonize security activities D. To meet or maintain regulatory compliance>>> You are correct, the answer is B. A. Governance costs may or may not be reduced, but that is not the primary objective. B. The overarching objective of governance, risk and compliance (GRC) is improved risk management achieved by integrating these interrelated activities across the enterprise, primarily focused on finance, legal and IT domains. C. Convergence of security activities would be just one element of governance, risk and compliance (GRC).D. Achieving an appropriate level of regulatory compliance is likely to be one of the goals, but with the overall objective of more effective and efficient management of risk. What is the BEST method for mitigating against network denial of service (DoS) attacks? Select an answer: A. Ensure all servers are up-to-date on OS patches B. Employ packet filtering to drop suspect packets C. Implement network address translation to make internal addresses nonroutable D. Implement load balancing for Internet facing devices>>> You answered D. The correct answer is B. Packet filtering techniques are the only ones which reduce network congestion caused by a network denial of service (DoS) attack. Patching servers, in general, will not affect network traffic. Implementing network address translation and load balancing would not be as effective in mitigating most network DoS attacks. While a disaster recovery exercise in the organization's hot site successfully restored all essential services, the test was deemed a failure. Which of the following circumstances would be the MOST likely cause? Select an answer: A. The maximum tolerable outage (MTO) exceeded the acceptable interruption window (AIW). B. The recovery plans specified outdated operating system (OS) versions. C. Some restored systems exceeded service delivery objectives (SDO). D. Aggregate recovery activities exceeded the acceptable interruption window (AIW).>>> You answered A. The correct answer is D. A. The maximum tolerable outage (MTO), the amount of time the organization can operate in alternate mode, would normally exceed the acceptable interruption window (AIW). B. While a difference in operating system (OS) versions might cause a delay, it would probably be minor. C. Service delivery objectives (SDOs) are directly related to the business needs. The SDO is the level of services to be reached during the alternate process mode until the normal situation is restored. Not meeting SDOs on some systems might be a concern, but would not necessarily lead to the conclusion that the test was a failure. D. Exceeding the acceptable interruption window (AIW) would cause the organization significant damage and must be avoided. The acceptable interruption window is the maximum period of time that a system can be unavailable before compromising the achievement of the enterprise's business objectives. When implementing regulatory compliance, the PRIMARY controls for defining senior management guidance and intent are: Select an answer: A. guidelines. B. standards. C. policies.D. procedures.>>> You are correct, the answer is C. Policies are statements of intent, expectations and direction, and are owned by senior management. Policies regarding regulatory compliance set broad organizational definitions for compliance and indicate management's position on regulatory compliance. Standards are used to set allowable boundaries for people, technologies, procedures and practices and are used to address meeting specific regulatory requirements; so they are more specific than policies. Guidelines are more granular than policies and they are not mandatory, so they are not typically used to represent high-level guidance. Who would be in the BEST position to determine the recovery point objective (RPO) for business applications? Select an answer: A. Business continuity coordinator B. Chief operations officer (COO) C. Information security manager D. Internal audit>>> You are correct, the answer is B. The recovery point objective (RPO) is the processing checkpoint to which systems are recovered. In addition to data owners, the chief operations officer (COO) is the most knowledgeable person to make this decision. It would be inappropriate for the information security manager or an internal audit to determine the RPO because they are not directly responsible for the data or the operation. Information security governance is PRIMARILY driven by: Select an answer: A. technology constraints. B. regulatory requirements. C. litigation potential. D. business strategy.>>> You are correct, the answer is D. Governance is directly tied to the strategy and direction of the business. Technology constraints, regulatory requirements and litigation potential are all important factors, but they are necessarily in line with the business strategy. Which resource is the most effective in preventing physical access tailgating/piggybacking? Select an answer: A. Card key door locks B. Photo identification C. Awareness training D. Biometric scanners>>> You are correct, the answer is C. Awareness training would most likely result in any attempted tailgating being challenged by the authorized employee. Choices A, B and D are physical controls that, by themselves, would not be effective against tailgating. Which of the following BEST contributes to the design of data restoration plans? Select an answer:A. Transaction turnaround time B. Mean time between failures (MTBF) C. Service delivery objectives (SDOs) D. The duration of the data restoration job>>> You answered B. The correct answer is C. A. Transaction turnaround time may be a concern when the effectiveness of an application system is evaluated. Normally it is not the main agenda in the restoration stage. B. MTBF is the predicted elapsed time between inherent failures of a system during operation. MTBF is not a factor in determining restoration of data. C. The SDO relates directly to the business needs; SDO is the level of services to be reached during the alternate process mode until the normal situation is restored. D. The duration of a data restoration job may be of secondary importance. The strategic importance of data should be considered first. Which one of the following types of detection is NECESSARY to mitigate a denial or distributed denial of service (DoS or DDoS) attack? Select an answer: A. Signature-based detection B. Deep packet inspection C. Virus detection D. Anomaly-based detection>>> You answered B. The correct answer is D. Anomaly-based detection establishes normal traffic patterns and then detects any deviation from that baseline. Traffic baselines are greatly exceeded when under a DDoS attack and are quickly identified by anomaly-based detection. Signature-based detection cannot react to a DDoS attack because it does not have any insight into increases in traffic levels. Deep packet inspection allows a protocol to be inspected, and is not related to DoS attacks. Virus detection would have no effect on DDoS detection or mitigation. The MOST important reason that statistical anomaly-based intrusion detection systems (stat IDSs) are less commonly used than signature-based IDSs is that stat IDSs: Select an answer: A. create more overhead than signature-based IDSs. B. cause false positives from minor changes to system variables. C. generate false alarms from varying user or system actions. D. cannot detect new types of attacks.>>> You answered B. The correct answer is C. A statistical anomaly-based intrusion detection system (stat IDS) collects data from normal traffic and establishes a baseline. It then periodically samples the network activity based on statistical methods and compares samples to the baseline. When the activity is outside the baseline parameter (clipping level), the IDS notifies the administrator. The baseline variables can include a host's memory or central processing unit (CPU) usage, network packet types and packet quantities. If actions of the users or the systems on the network vary widely with periods of low activity and periods of frantic packet exchange, a stat IDS may not be suitable, as the dramatic swing from one level to another almost certainly will generate false alarms. This weakness will have thelargest impact on the operation of the IT systems. Due to the nature of stat IDS operations (i.e., they must constantly attempt to match patterns of activity to the baseline parameters), a stat IDS requires much more overhead and processing than signature-based versions. Due to the nature of operation of a stat IDS—based on statistics and comparing data with baseline parameters—this type of IDS may not detect minor changes to system variables and may generate many false positives. Choice D is incorrect; since the stat IDS can monitor multiple system variables, it can detect new types of variables by tracing for abnormal activity of any kind. Which of the following will BEST prevent external security attacks? Select an answer: A. Static IP addressing B. Network address translation C. Background checks for temporary employees D. Securing and analyzing system access logs>>> You are correct, the answer is B. Network address translation is helpful by having internal addresses that are nonroutable. Background checks of temporary employees are more likely to prevent an attack launched from within the enterprise. Static IP addressing does little to prevent an attack. Writing all computer logs to removable media does not help in preventing an attack. To BEST improve the alignment of the information security objectives in an organization, the chief information security officer (CISO) should: Select an answer: A. revise the information security program. B. evaluate a balanced business scorecard. C. conduct regular user awareness sessions. D. perform penetration tests.>>> You are correct, the answer is B. The balanced business scorecard can track the effectiveness of how an organization executes its information security strategy and determine areas of improvement. Revising the information security program may be a solution, but is not the best solution to improve alignment of the information security objectives. User awareness is just one of the areas the organization must track through the balanced business scorecard. Performing penetration tests does not affect alignment with information security objectives. Who should determine the appropriate classification of accounting ledger data located on a database server and maintained by a database administrator in the IT department? Select an answer: A. Database administrator (DBA) B. Finance department management C. Information security manager D. IT department management>>> You are correct, the answer is B. Data owners are responsible for determining data classification; in this case, management of the finance department would be the owners of accounting ledger data. The database administrator (DBA) and IT management are the custodians of the datawho would apply the appropriate security levels for the classification, while the security manager would act as an advisor and enforcer. The typical requirement for security incidents to be resolved quickly and service restored is: Select an answer: A. always the best option for an enterprise. B. often in conflict with effective problem management. C. the basis for enterprise risk management (ERM) activities. D. a component of forensics training.>>> You answered C. The correct answer is B. Problem management is focused on investigating and uncovering the root cause of incidents, which will often be a problem when restoring service compromises the evidence needed. Quickly restoring service will not always be the best option such as in cases of criminal activity, which requires preservation of evidence precluding use of the systems involved. Managing risk goes beyond the quick restoration of services, e.g., if doing so increased some other risk disproportionately. Forensics is concerned with legally adequate collection and preservation of evidence, not with service continuity. The classification level of an asset must be PRIMARILY based on which of the following choices? Select an answer: A. Criticality and sensitivity B. Likelihood and impact C. Valuation and replacement cost D. Threat vector and exposure>>> You answered B. The correct answer is A. A. The extent to which an asset is critical to business operations or can damage the organization if disclosed is the primary consideration for the level of protection required. B. Asset classification is driven by criticality and sensitivity, not likelihood of compromise. C. Probability and frequency are considerations of risk and not the main consideration of asset classification. D. Threat vector and exposure together do not provide information on impact needed for classification. Which of the following constitutes the MAIN project activities undertaken in developing an information security program? Select an answer: A. Controls design and deployment B. Security organization development C. Logical and conceptual architecture design D. Development of risk management objectives>>> You answered D. The correct answer is A. The majority of program development activities will involve designing, testing and deploying controls that achieve the risk management objectives. The security organization should be fairly well developed prior to attempting to implement a security program. Conceptual and logical architecture designs should have been completed as apart of strategy and road-map development. Risk management objectives are part of strategy development. In a forensic investigation, which of the following would be the MOST important factor? Select an answer: A. Operation of a robust incident management process B. Identification of areas of responsibility C. Involvement of law enforcement D. Expertise of resources>>> You answered A. The correct answer is D. The most important factor in a forensic investigation is the expertise of the resources participating in the project due to the inherent complexity. Operation of a robust incident management process and the identification of areas of responsibility should occur prior to an investigation. Involvement of law enforcement is dependent upon the nature of the investigation. How should an information security manager balance the potentially conflicting requirements of an international organization's security standards with local regulation? Select an answer: A. Give organization standards preference over local regulations B. Follow local regulations only C. Make the organization aware of those standards where local regulations cause conflicts D. Negotiate a local version of the organization standards>>> You answered C. The correct answer is D. Negotiating a local version of the organization's standards is the most effective compromise in this situation. Following local regulations only is incorrect because there must be some recognition of organizational requirements. Making an organization aware of standards is a sensible step, but is not a complete solution. When performing a business impact analysis (BIA), which of the following should calculate the recovery time and cost estimates? Select an answer: A. Business continuity coordinator B. Information security manager C. Business process owners D. IT management>>> You are correct, the answer is C. Business process owners are in the best position to understand the true impact on the business that a system outage would create. The business continuity coordinator, IT management and even the information security manager will not be able to provide that level of detailed knowledge. Control baselines are MOST directly related to the: Select an answer: A. organization's risk appetite. B. external threat landscape. C. effectiveness of mitigation options.D. vulnerability assessment.>>> You are correct, the answer is A. A. Control baselines are designed to mitigate risk and will depend on the organization's risk appetite. B. The viability and existence of threats will have a direct bearing on control baselines, but only to the extent that they can exploit vulnerabilities and create a risk of potential impact. C. In some cases the effectiveness may modify the control objectives if it is not feasible to mitigate the risk, but generally that will not change the objectives. D. Vulnerability assessments are conducted against a control baseline. An information security manager mapping a job description to types of data access is MOST likely to adhere to which of the following information security principles? Select an answer: A. Ethics B. Proportionality C. Integration D. Accountability>>> You answered A. The correct answer is B. Information security controls should be proportionate to the criticality and/or sensitivity of the asset (i.e., the potential impact of compromise). Principles of ethics and integration have the least to do with mapping job description to types of data access. The principle of accountability would be the second most adhered to principle since people with access to data may not always be accountable but may be required to perform an operation. What is the BEST means to standardize security configurations in similar devices? Select an answer: A. Policies B. Procedures C. Technical guides D. Baselines>>> You answered C. The correct answer is D. Baselines describe the minimum configuration requirements across similar devices, activities or resources. Policies set high-level direction, not technical details. Procedures are used to provide instructions, not configuration details. Technical guides provide support, but not necessarily the requirements. What is the BEST tool to define minimum requirements for database security settings? Select an answer: A. Procedures B. Guidelines C. Baselines D. Policies>>> You are correct, the answer is C. Baselines set the minimum requirements. Procedures determine the steps, not the configuration requirements. Guidelines are not enforceable. Policies determine direction, but not detailed configurations.Which of the following is the MOST cost-effective approach to achieve strategic alignment? Select an answer: A. Periodically survey management B. Implement a governance framework C. Ensure that controls meet objectives D. Develop an enterprise architecture>>> You are correct, the answer is A. A. Achieving and maintaining strategic alignment means that business process owners and managers believe that information security is effectively supporting their organizational activities. This can most easily and inexpensively be determined by periodic surveys which will also indicate improvement or degradation over time. B. Implementing an appropriate governance framework may improve strategic alignment in addition to a number of other benefits, but is far more complex, time consuming and expensive. C. While important, controls meeting objectives may not be perceived by managers as helpful to the business and may in fact be seen as an impediment to their activities. D. An enterprise architecture should consider business objectives during design and development, but in an effort to balance many other requirements such as security and functionality, may or may not be perceived as supporting business activities. An information security manager has been notified that a server that is utilized within the entire organization has been breached. What is the FIRST step to take? Select an answer: A. Inform management. B. Notify users. C. Isolate the server. D. Verify the information.>>> You are correct, the answer is D. A. The information security manager should inform management, but not before verifying the information. B. Users should be notified after the information security manager has verified the information and informed management. C. Isolating the server is not the first step that the information security manager should take. D. Before any action is taken, the information security manager should verify that there has been a breach. The MOST important reason for aligning information security governance with corporate governance is to: Select an answer: A. maximize the cost-effectiveness of controls. B. demonstrate that information security understands the requirements. C. provide operational consistency. D. minimize the number of regulations required.>>> You are correct, the answer is A. Corporate governance is a structure of management practices and policies that, in most cases, are related to managing various types of risk. A lack of alignment between security governance and corporate governance will result in potentially duplicate,unnecessary or contradictory procedural controls which negatively impacts costeffectiveness. While it is essential that information security understands corporate requirements, that will not by itself ensure alignment. Operational consistency is just one element of achieving cost-effectiveness. Minimizing the number of regulations is outside the scope of information security, and could only be achieved by altering the business activities of the enterprise. What is the BEST method for detecting and monitoring a hacker's activities without exposing information assets to unnecessary risk? Select an answer: A. Firewalls B. Bastion hosts C. Decoy files D. Screened subnets>>> You are correct, the answer is C. Decoy files, often referred to as honeypots, are the best choice for diverting a hacker away from critical files and alerting security of the hacker's presence. Firewalls and bastion hosts attempt to keep the hacker out, while screened subnets or demilitarized zones (DMZs) provide a middle ground between the trusted internal network and the external untrusted Internet. The PRIMARY concern of an information security manager documenting a formal data retention policy is: Select an answer: A. generally accepted industry best practices. B. business requirements. C. legislative and regulatory requirements. D. storage availability.>>> You are correct, the answer is B. The primary concern will be to comply with legislation and regulation but only if this is a genuine business requirement. Best practices may be a useful guide but not a primary concern. Legislative and regulatory requirements are only relevant if compliance is a business need. Storage is irrelevant because whatever is needed must be provided. The MOST effective way to ensure that outsourced service providers comply with the organization's information security policy would be: Select an answer: A. service level monitoring. B. penetration testing. C. periodically auditing. D. security awareness training.>>> You are correct, the answer is C. Regular audit exercise can spot any gap in the information security compliance. Service level monitoring can only pinpoint operational issues in the organization's operational environment. Penetration testing can identify security vulnerability but cannot ensure information compliance. Training can increase users' awareness on the information security policy, but is not more effective than auditing. Which of the following devices should be placed within a DMZ?Select an answer: A. Router B. Firewall C. Mail relay D. Authentication server>>> You are correct, the answer is C. A mail relay should normally be placed within a demilitarized zone (DMZ) to shield the internal network. An authentication server, due to its sensitivity, should always be placed on the internal network, never on a DMZ that is subject to compromise. Both routers and firewalls may bridge a DMZ to another network, but do not technically reside within the DMZ network segment. Which of the following design options is the lowest cost approach to achieve authentication and data integrity? Select an answer: A. Biometrics coupled with strong encryption B. Challenge response authentication and a secure hash C. Link encryption and hardware tokens D. A public key infrastructure (PKI)>>> You answered D. The correct answer is B. A. Biometrics are generally among the most expensive mechanisms for authentication. B. Challenge response properly implemented provides authentication, and a secure hash provides integrity and both are inherent in most current operating systems (OSs) with no additional cost. C. Hardware tokens are an additional cost beyond what is supported in most current operating systems (OSs). There may be ongoing expenses as well as the one-time cost. D. Public key infrastructure (PKI) is complicated to establish, requiring multiple dedicated servers and significant technical expertise. What is the MOST appropriate IT incident response management approach for an organization that has outsourced its IT and incident management function? Select an answer: A. A tested plan and a team to provide oversight B. An individual to serve as the liaison between the parties C. Clear notification and reporting channels D. A periodic audit of the provider's capabilities>>> You answered D. The correct answer is A. A. An approved and tested plan will provide assurance of the provider's ability to address incidents within an acceptable recovery time and an internal team to provide oversight and liaison functions to ensure that the response is according to plan. B. Identifying a liaison is not sufficient by itself to provide assurance of adequate incident response performance. C. Notification and reporting is not a sufficient assurance of suitable response activities and provides no capability for input, participation or addressing related issues in a timely manner.D. Audits provide a periodic snapshot of the sufficiency of the provider's plans and capabilities, but are not adequate to manage collateral and consequential issues in the event of a significant incident. Serious security incidents typically lead to renewed focus by management on information security that then usually fades over time. What opportunity should the information security manager seize to BEST utilize this renewed focus? Select an answer: A. To improve the integration of business and information security processes B. To increase information security budgets and staffing levels C. To develop tighter controls and stronger compliance efforts D. To acquire better supplemental technical security controls>>> You answered C. The correct answer is A. A. Close integration of information security governance with overall enterprise governance is likely to provide better long-term information security by institutionalizing activities and increasing visibility in all organizational activities. B. Increased budgets and staff may improve information security, but will not have the same beneficial impact as incorporating security into the strategic levels of the organization's operations. C. Control strength and compliance efforts must be balanced against business requirements, culture and other organizational factors and are best accomplished at the governance level. D. While technical security controls may improve some aspects of security, they will not address management issues nor provide the enduring organizational changes needed for improved maturity levels. A company recently developed a breakthrough technology. Since this technology could give this company a significant competitive edge, which of the following would FIRST govern how this information is to be protected? Select an answer: A. Access control policy B. Data classification policy C. Encryption standards D. Acceptable use policy>>> You answered D. The correct answer is B. Data classification policies define the level of protection to be provided for each category of data. Without this mandated ranking of degree of protection, it is difficult to determine what access controls or levels of encryption should be in place. An acceptable use policy is oriented more toward the end user and, therefore, would not specifically address what controls should be in place to adequately protect information. Which of the following would be a MAJOR consideration for an organization defining its business continuity plan (BCP) or disaster recovery program (DRP)? Select an answer: A. Setting up a backup site B. Maintaining redundant systems C. Aligning with recovery time objectives (RTOs)D. Data backup frequency>>> You are correct, the answer is C. BCP/DRP should align with business RTOs. The RTO represents the amount of time allowed for the recovery of a business function or resource after a disaster occurs. The RTO must be taken into consideration when prioritizing systems for recovery efforts to ensure that those systems that the business requires first are the ones that are recovered first. The typical requirement for security incidents to be resolved quickly and service restored is: Select an answer: A. always the best option for an enterprise. B. often in conflict with effective problem management. C. the basis for enterprise risk management (ERM) activities. D. a component of forensics training.>>> You are correct, the answer is B. Problem management is focused on investigating and uncovering the root cause of incidents, which will often be a problem when restoring service compromises the evidence needed. Quickly restoring service will not always be the best option such as in cases of criminal activity, which requires preservation of evidence precluding use of the systems involved. Managing risk goes beyond the quick restoration of services, e.g., if doing so increased some other risk disproportionately. Forensics is concerned with legally adequate collection and preservation of evidence, not with service continuity. Isolation and containment measures for a compromised computer have been taken and information security management is now investigating. What is the MOST appropriate next step? Select an answer: A. Run a forensics tool on the machine to gather evidence B. Reboot the machine to break remote connections C. Make a copy of the whole system's memory D. Document current connections and open Transmission Control Protocol/User Datagram Protocol (TCP/UDP) ports>>> You are correct, the answer is C. When investigating a security breach, it is important to preserve all traces of evidence left by the invader. For this reason, it is imperative to preserve the memory contents of the machine in order to analyze them later. The correct answer is choice C because a copy of the whole system's memory is obtained for future analysis by running the appropriate tools. This is also important from a legal perspective since an attorney may suggest that the system was changed during the conduct of the investigation. Running a computer forensics tool in the compromised machine will cause the creation of at least one process that may overwrite evidence. Rebooting the machine will delete the contents of the memory, erasing potential evidence. Collecting information about current connections and open Transmission Control Protocol/User Datagram Protocol (TCP/UDP) ports is correct, but doing so by using tools may also erase memory contents. Which of the following components is established during the INITIAL steps of developing a risk management program?Select an answer: A. Management acceptance and support B. Information security policies and standards C. A management committee to provide oversight for the program D. The context and purpose of the program>>> You answered A. The correct answer is D. A. Although an important component in the development of any managed program, obtaining management acceptance and support ideally occurs well before the development of the program, in the plan and organize phase according to the COBIT framework. B. Information security policies and standards are a component of the risk management program, but do not belong to the initial stages of its development. Information security policies and standards are formed by the decisions made in the planning phase of the program and are developed based on the outcomes and business objectives established by the business. C. Management and oversight of the risk management program is a monitoring control that is developed to ensure that the program is satisfying the outcomes and business objectives established by the business. This process is designed at the latter stages of development once the purpose of the program and the mechanics of its deployment have been established. This oversight process could be integrated with internal audit activities or other compliance program processes. D. An initial requirement is to determine the organization's purpose for creating an information security risk management program, determine the desired outcomes and define objectives. The PRIMARY objective of continuous monitoring is to: Select an answer: A. minimize the magnitude of impact. B. align the security program with IT goals. C. identify critical information assets. D. reduce the number of policy exceptions.>>> You are correct, the answer is A. A. Continuous monitoring helps an organization identify adverse events in a timely manner. The reduced lag time to take steps to contain damage results in minimizing the impact. B. Aligning the security program with IT goals is a derived benefit of continuous monitoring rather than the primary objective. C. Identifying critical information assets is a prerequisite for implementing continuous monitoring. D. Reduction of policy exceptions is not a direct benefit of continuous monitoring. Which of the following is the MOST effective way to measure strategic alignment of an information security program? Select an answer: A. Survey business stakeholders B. Track audits over time C. Evaluate incident lossesD. Analyze business cases>>> You are correct, the answer is A. The best indicator of strategic alignment is the opinion of the business stakeholders— and the best way to obtain this information is to ask them. The other choices do not have a direct correlation with the effectiveness of the information security program to support business goals and objectives. What is a reasonable approach to determine control effectiveness? Select an answer: A. Determine whether the control is preventive, detective or corrective. B. Review the control's capability of providing notification of failure. C. Confirm the control's ability to meet intended objectives. D. Assess and quantify the control's reliability.>>> You are correct, the answer is C. Control effectiveness requires a process to verify that the control process worked as intended. Examples such as dual-control or dual-entry bookkeeping provide verification and assurance that the process operated as intended. The type of control is not relevant, and notification of failure is not determinative of control strength. Reliability is not an indication of control strength; weak controls can be highly reliable, even if they are ineffective controls. An appropriate risk treatment method is: Select an answer: A. the method that minimizes risk to the greatest extent. B. based on the organization's risk tolerance. C. an efficient approach to achieve control objectives. D. the method that maximizes risk mitigation.>>> You answered B. The correct answer is C. A. While minimizing risk is generally preferable, doing so beyond what is acceptable is likely too costly and counterproductive. B. The risk tolerance triggers the risk response; however, it does not define the actual treatment method. C. Control objectives will have been determined based on acceptable risk and the least costly or most efficient approach to do so will be the most appropriate. D. Mitigation is just one treatment option and may not be the most appropriate. Which one of the following measures will BEST indicate the effectiveness of an incident response process? Select an answer: A. Number of open incidents B. Reduction of the number of security incidents C. Reduction of the average response time to an incident D. Number of incidents handled per month>>> You are correct, the answer is C. Of the list provided, the best measure of incident response effectiveness is the reduction of average response time to an incident. Reduction of response time helps minimize the impact of the incident. The total number of open incidents is not an indicator of incident response effectiveness because the team does not have direct control over the number of incidents it must handle at any given time. Reduction of thenumber of security incidents generally cannot be attributed to the effectiveness of the response team, but rather to improved controls. The number of incidents handled per month would not be a direct indicator of team effectiveness. A database was compromised by guessing the password for a shared administrative account and confidential customer information was stolen. The information security manager was able to detect this breach by analyzing which of the following? Select an answer: A. Invalid logon attempts B. Write access violations C. Concurrent logons D. Firewall logs>>> You are correct, the answer is A. Since the password for the shared administrative account was obtained through guessing, it is probable that there were multiple unsuccessful logon attempts before the correct password was deduced. Searching the logs for invalid logon attempts could, therefore, lead to the discovery of this unauthorized activity. Because the account is shared, reviewing the logs for concurrent logons would not reveal unauthorized activity since concurrent usage is common in this situation. Write access violations would not necessarily be observed since the information was merely copied and not altered. Firewall logs would not necessarily contain information regarding logon attempts. What is the MAIN reason for deploying a public key infrastructure (PKI) when implementing an information security program? Select an answer: A. To ensure the confidentiality of sensitive material B. To provide a high assurance of identity C. To allow deployment of the active directory D. To implement secure sockets layer (SSL) encryption>>> You are correct, the answer is B. The primary purpose of a public key infrastructure (PKI) is to provide strong authentication. Confidentiality is a function of the session keys distributed by the PKI. An active directory can use PKI for authentication as well as using other means. Even though secure sockets layer (SSL) encryption requires keys to authenticate, it is not the main reason for deploying PKI. After a significant security breach has occurred, what is the MOST important item to report to the chief information officer (CIO)? Select an answer: A. A summary of the security logs that illustrates the sequence of events B. An analysis of the impact of similar attacks at other organizations C. A business case for implementing stronger logical access controls D. The impact of the incident and corrective actions taken>>> You are correct, the answer is D. The actual impact to the organization and corrective actions taken would be the most important item to share with the CIO. A summary of security logs would be too technical to report to the CIO. An analysis of the impact of similar attacks would be helpful, but isnot the most important item to report. A business case for implementing stronger controls would be helpful to report to management, but is not the most important item to report, and would be subsequent to reporting impact and corrective actions. What is the BEST method for mitigating against network denial of service (DoS) attacks? Select an answer: A. Ensure all servers are up-to-date on OS patches B. Employ packet filtering to drop suspect packets C. Implement network address translation to make internal addresses nonroutable D. Implement load balancing for Internet facing devices>>> You are correct, the answer is B. Packet filtering techniques are the only ones which reduce network congestion caused by a network denial of service (DoS) attack. Patching servers, in general, will not affect network traffic. Implementing network address translation and load balancing would not be as effective in mitigating most network DoS attacks. An organization has to comply with recently published industry regulatory requirements—compliance that potentially has high implementation costs. What should the information security manager do FIRST? Select an answer: A. Implement a security committee. B. Perform a gap analysis. C. Implement compensating controls. D. Demand immediate compliance.>>> You are correct, the answer is B. Since they are regulatory requirements, a gap analysis would be the first step to determine the level of compliance already in place. Implementing a security committee or compensating controls would not be the first step. Demanding immediate compliance would not assess the situation. The systems administrator did not immediately notify the security officer about a malicious attack. An information security manager could prevent this situation by: Select an answer: A. periodically testing the incident response plans. B. regularly testing the intrusion detection system (IDS). C. establishing mandatory training of all personnel. D. periodically reviewing incident response procedures.>>> You are correct, the answer is A. Security incident response plans should be tested to find any deficiencies and improve existing processes. Testing the intrusion detection system (IDS) is a good practice but would not have prevented this situation. All personnel need to go through formal training to ensure that they understand the process, tools and methodology involved in handling security incidents. However, testing of the actual plans is more effective in ensuring the process works as intended. Reviewing the response procedures is not enough; the security response plan needs to be tested on a regular basis.In controlling information leakage, management should FIRST establish: Select an answer: A. a data leak prevention program. B. user awareness training. C. an information classification process. D. a network intrusion detection system (IDS).>>> You are correct, the answer is C. Information classification must be conducted first. Only after data are determined critical to the organization can a data leak prevention program be properly implemented. User awareness training can be helpful, but only after data have been classified. Network intrusion detection is a technology that can support the data leak prevention program, but it is not a primary consideration. The IT function has declared that it is not necessary to update the business impact analysis (BIA) when putting a new application into production because it does not produce modifications in the business processes. The information security manager should: Select an answer: A. verify the decision with the business units. B. check the system's risk analysis. C. recommend update after postimplementation review. D. request an audit review.>>> You are correct, the answer is A. Verifying the decision with the business units is the correct answer because it is not the IT function's responsibility to decide whether a new application modifies business processes. Choice B does not consider the change in the applications. Choices C and D delay the update. The data access requirements for an application should be determined by the: Select an answer: A. legal department. B. compliance officer. C. information security manager. D. business owner.>>> You are correct, the answer is D. Business owners are ultimately responsible for their applications. The legal department, compliance officer and information security manager all can advise, but do not have final responsibility. A business unit intends to deploy a new technology in a manner that places it in violation of existing information security standards. What immediate action should an information security manager take? Select an answer: A. Enforce the existing security standard B. Change the standard to permit the deployment C. Perform a risk analysis to quantify the risk D. Perform research to propose use of a better technology>>> You are correct, the answer is C.Resolving conflicts of this type should be based on a sound risk analysis of the costs and benefits of allowing or disallowing an exception to the standard. A blanket decision should never be given without conducting such an analysis. Enforcing existing standards is a good practice; however, standards need to be continuously examined in light of new technologies and the risks they present. Standards should not be changed without an appropriate risk assessment. Which of the following is the MOST appropriate use of gap analysis? Select an answer: A. Evaluating a business impact analysis (BIA) B. Developing a balanced business scorecard C. Demonstrating the relationship between controls D. Measuring current state vs. desired future state>>> You answered A. The correct answer is D. A gap analysis is most useful in addressing the differences between the current state and an ideal future state. It is not as appropriate for evaluating a business impact analysis (BIA), developing a balanced business scorecard or demonstrating the relationship between variables. From an information security perspective, which of the following poses the MOST important impact concern in a homogenous network? Select an answer: A. Increased uncertainty B. Single points of failure C. Cascading risk D. Aggregated risk>>> You answered A. The correct answer is D. A. The level of uncertainty is not directly related to the degree of homogeneity. Without proper consideration of a possible collective impact, actual consequences of compromise may not be apparent. B. Single points of failure are always a consideration, but are not related to the degree of homogeneity. C. Cascading risk is not a function of homogeneity, but of how closely systems are coupled. D. A homogenous network of the same devices is subject to compromise from a common threat vector that, while possibly acceptable in a single device, can create an unacceptable or catastrophic impact in the aggregate (collectively). The BEST process for assessing an existing risk level is a(n): Select an answer: A. impact analysis. B. security review. C. vulnerability assessment. D. threat analysis.>>> You answered A. The correct answer is B. A. An impact analysis is used to determine potential impact in the event of the loss of a resource.B. A security review is used to determine the current state of security for various program components. C. While vulnerability assessments help identify and classify weakness in the design, implementation, operation or internal control of a process, they are only one aspect of a security review. D. A threat analysis is not normally a part of a security review. Threat assessments evaluate the type, scope and nature of events or actions that can result in adverse consequences; identification is made of the threats that exist against organization assets. Which of the following will MOST likely reduce the chances of an unauthorized individual gaining access to computing resources by pretending to be an authorized individual needing to have his/her password reset? Select an answer: A. Performing reviews of password resets B. Conducting security awareness programs C. Increasing the frequency of password changes D. Implementing automatic password syntax checking>>> You answered A. The correct answer is B. Social engineering can be mitigated best through periodic security awareness training for staff members who may be the target of such an attempt. Changing the frequency of password changes, strengthening passwords and checking the number of password resets may be desirable, but they will not be as effective in reducing the likelihood of a social engineering attack. Serious security incidents typically lead to renewed focus on information security by management. To BEST utilize this attention, the information security manager should make the case for: Select an answer: A. improving integration of business and information security processes. B. increasing information security budgets and staffing levels. C. developing tighter controls and stronger compliance efforts. D. acquiring better supplemental technical security controls.>>> You are correct, the answer is A. Close integration of information security governance with overall organization governance is likely to provide better long-term security by institutionalizing its activities and increasing visibility in all organization activities. Increased budgets and staff may improve security, but they will not have the same beneficial impact as incorporating security into the strategic levels of the organization's operations. Control strength and compliance efforts must be balanced against business requirements, culture and other organization factors that are best accomplished at governance levels. While technical security controls may improve some aspects of security, they will not address management issues nor provide enduring changes that are needed for an overall improvement of the enterprise security posture.The MOST important factor in ensuring the success of an information security program is effective: Select an answer: A. communication of information security requirements to all users in the organization. B. formulation of policies and procedures for information security. C. alignment with organizational goals and objectives. D. monitoring compliance with information security policies and procedures.>>> You answered A. The correct answer is C. The success of security programs is dependent upon alignment with organizational goals and objectives. Communication is a secondary step. Effective communication and education of users is a critical determinant of success but alignment with organizational goals and objectives is the most important factor for success. Mere formulation of policies without effective communication to users will not ensure success. Monitoring compliance with information security policies and procedures can be, at best, a detective mechanism that will not lead to success in the midst of uninformed users. Which of the following is MOST important in determining whether a disaster recovery test is successful? Select an answer: A. Only business data files from offsite storage are used B. IT staff fully recovers the processing infrastructure C. Critical business processes are duplicated D. All systems are restored within recovery time objectives (RTOs)>>> You answered D. The correct answer is C. To ensure that a disaster recovery test is successful, it is most important to determine whether all critical business functions were successfully recovered and duplicated. Although ensuring that only materials taken from offsite storage are used in the test is important, this is not as critical in determining a test's success. While full recovery of the processing infrastructure is a key recovery milestone, it does not ensure the success of a test. Achieving the RTOs is another important milestone, but does not necessarily prove that the critical business functions can be conducted, due to interdependencies with other applications and key elements such as data, staff, manual processes, materials and accessories, etc. Which of the following is the MOST useful indicator of control effectiveness? Select an answer: A. The extent to which the control provides defense in depth B. Whether the control fails open or closed C. How often the control has failed D. The extent to which control objectives are achieved>>> You are correct, the answer is D. Choice D is the only true indicator of control effectiveness. It is a measurement with a point of reference. Choice A, defense in depth, is an important standard concept, but is a metric only to the extent that it meets control objectives. Choices B and C are only relevant as a metric to the extent identified in defined control objectives.Which of the following would be the MOST important goal of an information security governance program? Select an answer: A. Review of internal control mechanisms B. Effective involvement in business decision making C. Total elimination of risk factors D. Ensuring trust in data>>> You are correct, the answer is D. The development of trust in the integrity of information among stakeholders should be the primary goal of information security governance. Review of internal control mechanisms relates more to auditing, while the total elimination of risk factors is not practical or possible. Proactive involvement in business decision making implies that security needs dictate business needs when, in fact, just the opposite is true. Involvement in decision making is important only to ensure business data integrity so that data can be trusted. An information security manager's MOST effective efforts to manage the inherent risk related to a third-party service provider will be the result of: Select an answer: A. limiting organizational exposure. B. a risk assessment and analysis. C. strong service level agreements (SLAs). D. independent audits of third parties.>>> You answered D. The correct answer is A. A. It is likely to be more effective to control the organization's vulnerabilities to thirdparty risk than to control the third party's actions. B. Knowing the risk is essential, but does not manage it. C. Defining contractual responsibilities of third parties is important, but will not directly manage risk. D. Audits may indicate the threats posed by third parties, but will not ensure that the risk is managed. Risk acceptance is a component of which of the following? Select an answer: A. Risk assessment B. Risk treatment C. Risk evaluation D. Risk monitoring>>> You answered A. The correct answer is B. Risk acceptance is one of the alternatives to be considered in the risk treatment process; the other alternatives are risk avoidance, risk transfer and risk mitigation. Risk assessment and evaluation are components of the risk analysis process. Risk acceptance is not a component of risk monitoring. Risk monitoring provides timely information on the actual status of the enterprise with regard to risk. What is the PRIMARY objective of conducting information security awareness training for all users? Select an answer: A. To achieve acceptable compliance with the security policyB. To build a common understanding of information security C. To change culture to be more conducive to good security D. To establish communication between management and staff>>> You answered A. The correct answer is C. A. Compliance with security policy is another objective, but not the primary objective of information security awareness training. B. Security awareness training helps in building a common understanding about information security across the organization with the goal of modifying the culture to be more conducive to good security. C. Information security awareness training helps in bringing change to the security culture of the organization. D. Establishing communication between management and staff is a management function rather than a security objective. Why would an organization decide not to take any action on a denial of service (DoS) risk found by the risk assessment team? Select an answer: A. There are sufficient safeguards in place to prevent this risk from happening. B. The needed countermeasures are too complicated to deploy. C. The cost of countermeasures outweighs the value of the asset and potential loss. D. the likelihood of the risk occurring is unknown.>>> You are correct, the answer is C. An organization may decide to live with specific risks because it would cost more to protect themselves than the value of the potential loss. The safeguards need to match the risk level. While countermeasures could be too complicated to deploy, this is not the most compelling reason. It is unlikely that a global financial institution would not be exposed to such attacks and the frequency could not be predicted. What is the MAIN drawback of emailing password-protected zip files across the Internet? Select an answer: A. They all use weak encryption. B. They are decrypted by the firewall. C. They may be quarantined by mail filters. D. They may be corrupted by the receiving mail server.>>> You are correct, the answer is C. Often, mail filters will quarantine zip files that are password-protected since the filter (or the firewall) is unable to determine if the file contains malicious code. Many zip file products are capable of using strong encryption. Such files are not normally corrupted by the sending mail server. What is a PRIMARY advantage of performing a risk assessment on a consistent basis? Select an answer: A. It lowers costs of assessing risk. B. It provides evidence of attestation. C. It is a necessary part of third-party audits. D. It provides trends in the evolving risk profile.>>> You are correct, the answer is D.A. There may be some minor cost benefits to performing risk assessments on a consistent basis, but that is not the main benefit. B. An assessment deals with a review of a process, not a person's claim of the process being in place. An attestation is a claim without the supporting evidence. C. External audits do not require risk assessments, although it is encouraged. D. Tracking trends in evolving risk is of significant benefit to managing risk and ensuring that appropriate controls are in place. While governance, risk and compliance (GRC) can be applied to any area of an organization, it is MOST often focused on which of the following areas? Select an answer: A. Operations and marketing B. IT, finance and legal C. Audit, risk and regulations D. Information security and risk>>> You are correct, the answer is B. A. Governance, risk and compliance (GRC) is generally not used in support of operations and marketing. B. Governance, risk and compliance (GRC) is largely concerned with ensuring that processes in IT, finance and legal are in compliance with regulatory requirements, that proper rules are in place and that risk is appropriately addressed. C. Audit, risk and regulations are support functions to IT, finance and legal. D. Information security and risk can be a part of governance, risk and compliance (GRC), and interrelate to audit, risk and regulations, but are primarily in support of IT, finance and legal. Which of the following is the BEST way to confirm that disaster recovery planning is current? Select an answer: A. Audits of the business process changes B. Maintenance of the latest configurations C. Regular testing of the disaster recovery plan (DRP) D. Maintenance of the personnel contact list>>> You are correct, the answer is C. A. Auditing business process changes will not necessarily enable maintenance of the DRP. B. Maintenance of the latest configuration will not show how current the process is, which is vital for disaster recovery planning. C. When a DRP is properly tested, the results of the tests will reveal shortcomings and opportunities for improvement. D. The maintenance of the personnel contact list is an indication of the personnel to be involved in the DRP. Although indicative of how current the DRP is, the DRP also should include the suppliers, customers and vendors needed for its success. Which of the following BEST supports continuous improvement of the risk management process? Select an answer: A. Regular review of risk treatment optionsB. Classification of assets in order of criticality C. Adoption of a maturity model D. Integration of assurance functions>>> You answered B. The correct answer is C. A. Risk treatment is an element of the risk management process. Other elements such as risk identification, risk communication and acceptance also need to be considered. B. Classification of assets is important, but is an element of the risk management process and is not sufficient to ensure continuous improvement. C. A maturity model such as the capability maturity model (CMM) can be used to classify an organization as initial, repeatable, defined, managed or optimized. As a result, an organization can easily know where it falls and then start working to reach the optimized state. D. There are many benefits from integrating assurance functions. However, this is not a holistic approach because the best of assurance functions will be reactive if risk management does not cascade through the entire organization. Measures must be taken to ensure that the entire staff, rather than only the assurance functions, is risk conscious. Which of the following would be MOST appropriate for collecting and preserving evidence? Select an answer: A. Encrypted hard drives B. Generic audit software C. Proven forensic processes D. Log correlation software>>> You are correct, the answer is C. When collecting evidence about a security incident, it is very important to follow appropriate forensic procedures to handle electronic evidence by a method approved by local jurisdictions. All other options will help when collecting or preserving data about the incident; however these data might not be accepted as evidence in a court of law if they are not collected by a method approved by local jurisdictions. A new regulation for safeguarding information processed by a specific type of transaction has come to the attention of an information security officer. The officer should FIRST: Select an answer: A. meet with stakeholders to decide how to comply. B. analyze key risks in the compliance process. C. assess whether existing controls meet the regulation. D. update the existing security/privacy policy.>>> You answered B. The correct answer is C. If the organization is in compliance through existing controls, the need to perform other work related to the regulation is not a priority. The other choices are appropriate and important; however, they are actions that are subsequent and will depend on whether there is an existing control gap. Which of the following will require the MOST effort when supporting an operational information security program?Select an answer: A. Reviewing and modifying procedures B. Modifying policies to address changing technologies C. Writing additional policies to address new regulations D. Drafting standards to address regional differences>>> You answered B. The correct answer is A. A. When an information security program is operational, few changes to policies or standards will be needed. Procedures, however, are designed at a more granular level and will require reasonably frequent modification. Because procedures are more detailed and can be technology specific, there are generally far more procedures than standards or policies. Consequently, review and modification of procedures will consume the majority of effort. B. While technology does change, it is relatively rare for a technology shift to be so disruptive as to require a modification of policy. Most technological changes can be addressed at lower levels (e.g., in standards or procedures). C. New regulations may require the creation of a new policy, but this does not happen nearly as often or consume as much time in an operational program as the review and modification of procedures. D. Global organizations may need to customize policy through the use of regional standards, but an operational program will already have most of these standards in place. Even where they need to be drafted, the level of effort required to customize policy by region is less than what will be needed to review and modify the vast body of procedures that change more frequently. If an organization has a requirement for continuous operations, which of the following approaches would be BEST to test response and recovery? Select an answer: A. A full interruption test B. A simulation test C. A parallel test D. A structured walk-through>>> You are correct, the answer is C. A. A full interruption test, in which operations are shut down at the primary site and shifted to the recovery site, is the most stringent form of response and recovery testing, but it is potentially disruptive. Even though the organization in this scenario might accept the cost of such a test, the need for continuous operations makes it inappropriate. B. Simulation testing tests people and processes, but does not go so far as to start up recovery-site operations, so it provides a lower level of assurance than what would be provided by a parallel test. C. The organization in this scenario requires continuous operations. A parallel test, in which operations are brought online at the recovery site alongside primary-site operations, is the closest that an organization can come to full testing without risking a business impact, so it is the best fit for the requirement. D. Structured walk-throughs are pen-and-paper activities. A walk-through may help identify constraints, deficiencies and opportunities for enhancement, but the level of assurance that it provides is low relative to a parallel test.When securing wireless access points, which of the following controls would BEST assure confidentiality? Select an answer: A. Implementing wireless intrusion prevention systems B. Not broadcasting the service set IDentifier (SSID) C. Implementing wired equivalent privacy (WEP) authentication D. Enforcing a virtual private network (VPN) over wireless>>> You are correct, the answer is D. Enforcing a VPN over wireless is the best option to enforce strong authentication and encryption of the sessions. Implementing wireless intrusion prevention systems is a detective system and would not prevent wireless sniffing. N