Certified Information Security Manager CISM Study Guides

dumps2022-02-21T02:31:08+08:00

Certified Information Security Manager CISM exam study guides are available, which are good material for you to study the test. There are 150 questions in real ISACA certification CISM exam, and you have 4 hours to write the test. The available languages are Chinese simplified, English, Japanese and Spanish. Free ISACA certification CISM exam study guides are below.

Page 1 of 40

1. Which of the following should be the FIRST step in developing an information security plan?

Perform a technical vulnerabilities assessment

Analyze the current business strategy

Perform a business impact analysis

Assess the current levels of security awareness

2. Senior management commitment and support for information security can BEST be obtained through presentations that:

use illustrative examples of successful attacks.

explain the technical risks to the organization.

evaluate the organization against best security practices.

tie security risks to key business objectives.

3. The MOST appropriate role for senior management in supporting information security is the:

evaluation of vendors offering security products.

assessment of risks to the organization.

approval of policy statements and funding.

monitoring adherence to regulatory requirements.

4. Which of the following would BEST ensure the success of information security governance within an organization?

Steering committees approve security projects

Security policy training provided to all managers

Security training available to all employees on the intranet

Steering committees enforce compliance with laws and regulations

5. Information security governance is PRIMARILY driven by:

technology constraints.

regulatory requirements.

litigation potential.

business strategy.

6. Which of the following represents the MAJOR focus of privacy regulations?

Unrestricted data mining

Identity theft

Human rights protection

Identifiable personal data

7. Investments in information security technologies should be based on:

vulnerability assessments.

value analysis.

business climate.

audit recommendations.

8. Retention of business records should PRIMARILY be based on:

business strategy and direction.

regulatory and legal requirements.

storage capacity and longevity.

business ease and value analysis.

9. Which of the following is characteristic of centralized information security management?

More expensive to administer

Better adherence to policies

More aligned with business unit needs

Faster turnaround of requests

10. Successful implementation of information security governance will FIRST require:

security awareness training.

updated security policies.

a computer incident management team.

a security architecture.

Page 2 of 40

11. Which of the following individuals would be in the BEST position to sponsor the creation of an information security steering group?

Information security manager

Chief operating officer (COO)

Internal auditor

Legal counsel

12. The MOST important component of a privacy policy is:

notifications.

warranties.

liabilities.

geographic coverage.

13. The cost of implementing a security control should not exceed the:

annualized loss expectancy.

cost of an incident.

asset value.

implementation opportunity costs.

14. When a security standard conflicts with a business objective, the situation should be resolved by:

changing the security standard.

changing the business objective.

performing a risk analysis.

authorizing a risk acceptance.

15. Minimum standards for securing the technical infrastructure should be defined in a security:

strategy.

guidelines.

model.

architecture.

16. Which of the following is MOST appropriate for inclusion in an information security strategy?

Business controls designated as key controls

Security processes, methods, tools and techniques

Firewall rule sets, network defaults and intrusion detection system (IDS) settings

Budget estimates to acquire specific security tools

17. Senior management commitment and support for information security will BEST be attained by an information security manager by emphasizing:

organizational risk.

organization wide metrics.

security needs.

the responsibilities of organizational units.

18. Which of the following roles would represent a conflict of interest for an information security manager?

Evaluation of third parties requesting connectivity

Assessment of the adequacy of disaster recovery plans

Final approval of information security policies

Monitoring adherence to physical security controls

19. Which of the following situations must be corrected FIRST to ensure successful information security governance within an organization?

The information security department has difficulty filling vacancies.

The chief information officer (CIO) approves security policy changes.

The information security oversight committee only meets quarterly.

The data center manager has final signoff on all security projects.

20. Which of the following requirements would have the lowest level of priority in information security?

Technical

Regulatory

Privacy

Business

Page 3 of 40

21. When an organization hires a new information security manager, which of the following goals should this individual pursue FIRST?

Develop a security architecture

Establish good communication with steering committee members

Assemble an experienced staff

Benchmark peer organizations

22. It is MOST important that information security architecture be aligned with which of the following?

Industry best practices

Information technology plans

Information security best practices

Business objectives and goals

23. Which of the following is MOST likely to be discretionary?

Policies

Procedures

Guidelines

Standards

24. Security technologies should be selected PRIMARILY on the basis of their:

ability to mitigate business risks.

evaluations in trade publications.

use of new and emerging technologies.

benefits in comparison to their costs.

25. Which of the following are seldom changed in response to technological changes?

Standards

Procedures

Policies

Guidelines

26. The MOST important factor in planning for the long-term retention of electronically stored business records is to take into account potential changes in:

storage capacity and shelf life.

regulatory and legal requirements.

business strategy and direction.

application systems and media.

27. Which of the following is characteristic of decentralized information security management across a geographically dispersed organization?

More uniformity in quality of service

Better adherence to policies

Better alignment to business unit needs

More savings in total operating costs

28. Which of the following is the MOST appropriate position to sponsor the design and implementation of a new security infrastructure in a large global enterprise?

Chief security officer (CSO)

Chief operating officer (COO)

Chief privacy officer (CPO)

Chief legal counsel (CLC)

29. Which of the following would be the MOST important goal of an information security governance program?

Review of internal control mechanisms

Effective involvement in business decision making

Total elimination of risk factors

Ensuring trust in data

30. Relationships among security technologies are BEST defined through which of the following?

Security metrics

Network topology

Security architecture

Process improvement models

Page 4 of 40

31. A business unit intends to deploy a new technology in a manner that places it in violation of existing information security standards.

What immediate action should an information security manager take?

Enforce the existing security standard

Change the standard to permit the deployment

Perform a risk analysis to quantify the risk

Perform research to propose use of a better technology

32. Acceptable levels of information security risk should be determined by:

legal counsel.

security management.

external auditors.

die steering committee.

33. The PRIMARY goal in developing an information security strategy is to:

establish security metrics and performance monitoring.

educate business process owners regarding their duties.

ensure that legal and regulatory requirements are met

support the business objectives of the organization.

34. Senior management commitment and support for information security can BEST be enhanced through:

a formal security policy sponsored by the chief executive officer (CEO).

regular security awareness training for employees.

periodic review of alignment with business management goals.

senior management signoff on the information security strategy.

35. When identifying legal and regulatory issues affecting information security, which of the following would represent the BEST approach to developing information security policies?

Create separate policies to address each regulation

Develop policies that meet all mandated requirements

Incorporate policy statements provided by regulators

Develop a compliance risk assessment

36. Which of the following MOST commonly falls within the scope of an information security governance steering committee?

Interviewing candidates for information security specialist positions

Developing content for security awareness programs

Prioritizing information security initiatives

Approving access to critical financial systems

37. Which of the following is the MOST important factor when designing information security architecture?

Technical platform interfaces

Scalability of the network

Development methodologies

Stakeholder requirements

38. Which of the following characteristics is MOST important when looking at prospective candidates for the role of chief information security officer (CISO)?

Knowledge of information technology platforms, networks and development methodologies

Ability to understand and map organizational needs to security technologies

Knowledge of the regulatory environment and project management techniques

Ability to manage a diverse group of individuals and resources across an organization

39. Which of the following are likely to be updated MOST frequently?

Procedures for hardening database servers

Standards for password length and complexity

Policies addressing information security governance

Standards for document retention and destruction

40. Who should be responsible for enforcing access rights to application data?

Data owners

Business process owners

The security steering committee

Security administrators

Page 5 of 40

41. The chief information security officer (CISO) should ideally have a direct reporting relationship to the:

head of internal audit.

chief operations officer (COO).

chief technology officer (CTO).

legal counsel.

42. Which of the following is the MOST essential task for a chief information security officer (CISO) to perform?

Update platform-level security settings

Conduct disaster recovery test exercises

Approve access to critical financial systems

Develop an information security strategy paper

43. Developing a successful business case for the acquisition of information security software products can BEST be assisted by:

assessing the frequency of incidents.

quantifying the cost of control failures.

calculating return on investment (ROD projections.

comparing spending against similar organizations.

44. When an information security manager is developing a strategic plan for information security, the timeline for the plan should be:

aligned with the IT strategic plan.

based on the current rate of technological change.

three-to-five years for both hardware and software.

aligned with the business strategy.

45. Which of the following is the MOST important information to include in a strategic plan for information security?

Information security staffing requirements

Current state and desired future state

IT capital investment requirements

information security mission statement

46. Information security projects should be prioritized on the basis of:

time required for implementation.

impact on the organization.

total cost for implementation.

mix of resources required.

47. Which of the following is the MOST important information to include in an information security standard?

Creation date

Author name

Initial draft approval date

Last review date

48. Which of the following would BEST prepare an information security manager for regulatory reviews?

Assign an information security administrator as regulatory liaison

Perform self-assessments using regulatory guidelines and reports

Assess previous regulatory reports with process owners input

Ensure all regulatory inquiries are sanctioned by the legal department

49. An information security manager at a global organization that is subject to regulation by multiple governmental jurisdictions with differing requirements should:

bring all locations into conformity with the aggregate requirements of all governmental jurisdictions.

establish baseline standards for all locations and add supplemental standards as required.

bring all locations into conformity with a generally accepted set of industry best practices.

establish a baseline standard incorporating those requirements that all jurisdictions have in common.

50. Which of the following BEST describes an information security manager's role in a multidisciplinary team that will address a new regulatory requirement regarding operational risk?

Ensure that all IT risks are identified

Evaluate the impact of information security risks

Demonstrate that IT mitigating controls are in place

Suggest new IT controls to mitigate operational risk

Page 6 of 40

51. From an information security manager perspective, what is the immediate benefit of clearly-defined roles and responsibilities?

Enhanced policy compliance

Improved procedure flows

Segregation of duties

Better accountability

52. An internal audit has identified major weaknesses over IT processing.

Which of the following should an information security manager use to BEST convey a sense of urgency to management?

Security metrics reports

Risk assessment reports

Business impact analysis (BIA)

Return on security investment report

53. Reviewing which of the following would BEST ensure that security controls are effective?

Risk assessment policies

Return on security investment

Security metrics

User access rights

54. Which of the following is responsible for legal and regulatory liability?

Chief security officer (CSO)

Chief legal counsel (CLC)

Board and senior management

Information security steering group

55. While implementing information security governance an organization should FIRST:

adopt security standards.

determine security baselines.

define the security strategy.

establish security policies.

56. The MOST basic requirement for an information security governance program is to:

be aligned with the corporate business strategy.

be based on a sound risk management approach.

provide adequate regulatory compliance.

provide best practices for security- initiatives.

57. Information security policy enforcement is the responsibility of the:

security steering committee.

chief information officer (CIO).

chief information security officer (CISO).

chief compliance officer (CCO).

58. A good privacy statement should include:

notification of liability on accuracy of information.

notification that information will be encrypted.

what the company will do with information it collects.

a description of the information classification process.

59. Which of the following would be MOST effective in successfully implementing restrictive password policies?

Regular password audits

Single sign-on system

Security awareness program

Penalties for noncompliance

60. When designing an information security quarterly report to management, the MOST important element to be considered should be the:

information security metrics.

knowledge required to analyze each issue.

linkage to business area objectives.

baseline against which metrics are evaluated.

Page 7 of 40

61. An information security manager at a global organization has to ensure that the local information security program will initially ensure compliance with the:

corporate data privacy policy.

data privacy policy where data are collected.

data privacy policy of the headquarters' country.

data privacy directive applicable globally.

62. A new regulation for safeguarding information processed by a specific type of transaction has come to the attention of an information security officer. The officer should FIRST:

meet with stakeholders to decide how to comply.

analyze key risks in the compliance process.

assess whether existing controls meet the regulation.

update the existing security/privacy policy.

63. The PRIMARY objective of a security steering group is to:

ensure information security covers all business functions.

ensure information security aligns with business goals.

raise information security awareness across the organization.

implement all decisions on security management across the organization.

64. Data owners must provide a safe and secure environment to ensure confidentiality, integrity and availability of the transaction. This is an example of an information security:

baseline.

strategy.

procedure.

policy.

65. At what stage of the applications development process should the security department initially become involved?

When requested

At testing

At programming

At detail requirements

66. A security manager is preparing a report to obtain the commitment of executive management to a security program. Inclusion of which of the following would be of MOST value?

Examples of genuine incidents at similar organizations

Statement of generally accepted best practices

Associating realistic threats to corporate objectives

Analysis of current technological exposures

67. The PRIMARY concern of an information security manager documenting a formal data retention policy would be:

generally accepted industry best practices.

business requirements.

legislative and regulatory requirements.

storage availability.

68. When personal information is transmitted across networks, there MUST be adequate controls over:

change management.

privacy protection.

consent to data transfer.

encryption devices.

69. An organization's information security processes are currently defined as ad hoc. In seeking to improve their performance level, the next step for the organization should be to:

ensure that security processes are consistent across the organization.

enforce baseline security levels across the organization.

ensure that security processes are fully documented.

implement monitoring of key performance indicators for security processes.

70. Who in an organization has the responsibility for classifying information?

Data custodian

Database administrator

Information security officer

Data owner

Page 8 of 40

71. What is the PRIMARY role of the information security manager in the process of information classification within an organization?

Defining and ratifying the classification structure of information assets

Deciding the classification levels applied to the organization's information assets

Securing information assets in accordance with their classification

Checking if information assets have been classified properly

72. Logging is an example of which type of defense against systems compromise?

Containment

Detection

Reaction

Recovery

73. Which of the following is MOST important in developing a security strategy?

Creating a positive business security environment

Understanding key business objectives

Having a reporting line to senior management

Allocating sufficient resources to information security

74. Who is ultimately responsible for the organization's information?

Data custodian

Chief information security officer (CISO)

Board of directors

Chief information officer (CIO)

75. Which of the following factors is a PRIMARY driver for information security governance that does not require any further justification?

Alignment with industry best practices

Business continuity investment

Business benefits

Regulatory compliance

76. A security manager meeting the requirements for the international flow of personal data will need to ensure:

a data processing agreement.

a data protection registration.

the agreement of the data subjects.

subject access procedures.

77. An information security manager mapping a job description to types of data access is MOST likely to adhere to which of the following information security principles?

Ethics

Proportionality

Integration

Accountability

78. Which of the following is the MOST important prerequisite for establishing information security management within an organization?

Senior management commitment

Information security framework

Information security organizational structure

Information security policy

79. What will have the HIGHEST impact on standard information security governance models?

Number of employees

Distance between physical locations

Complexity of organizational structure

Organizational budget

80. In order to highlight to management, the importance of integrating information security in the business processes, a newly hired information security officer should FIRST:

prepare a security budget.

conduct a risk assessment.

develop an information security policy.

obtain benchmarking information.

Page 9 of 40

81. Temporarily deactivating some monitoring processes, even if supported by an acceptance of operational risk, may not be acceptable to the information security manager if:

it implies compliance risks.

short-term impact cannot be determined.

it violates industry security practices.

changes in the roles matrix cannot be detected.

82. An outcome of effective security governance is:

business dependency assessment

strategic alignment.

risk assessment.

planning.

83. How would an information security manager balance the potentially conflicting requirements of an international organization's security standards and local regulation?

Give organization standards preference over local regulations

Follow local regulations only

Make the organization aware of those standards where local regulations causes conflicts

Negotiate a local version of the organization standards

84. Who should drive the risk analysis for an organization?

Senior management

Security manager

Quality manager

Legal department

85. The FIRST step in developing an information security management program is to:

identify business risks that affect the organization.

clarify organizational purpose for creating the program.

assign responsibility for the program.

assess adequacy of controls to mitigate business risks.

86. Which of the following is the MOST important to keep in mind when assessing the value of information?

The potential financial loss

The cost of recreating the information

The cost of insurance coverage

Regulatory requirement

87. What would a security manager PRIMARILY utilize when proposing the implementation of a security solution?

Risk assessment report

Technical evaluation report

Business case

Budgetary requirements

88. To justify its ongoing security budget, which of the following would be of MOST use to the information security' department?

Security breach frequency

Annualized loss expectancy (ALE)

Cost-benefit analysis

Peer group comparison

89. Which of the following situations would MOST inhibit the effective implementation of security governance?

The complexity of technology

Budgetary constraints

Conflicting business priorities

High-level sponsorship

90. To achieve effective strategic alignment of security initiatives, it is important that:

Steering committee leadership be selected by rotation.

Inputs be obtained and consensus achieved between the major organizational units.

The business strategy be updated periodically.

Procedures and standards be approved by all departmental heads.

Page 10 of 40

91. What would be the MOST significant security risks when using wireless local area network (LAN) technology?

Man-in-the-middle attack

Spoofing of data packets

Rogue access point

Session hijacking

92. When developing incident response procedures involving servers hosting critical applications, which of the following should be the FIRST to be notified?

Business management

Operations manager

Information security manager

System users

93. In implementing information security governance, the information security manager is PRIMARILY responsible for:

developing the security strategy.

reviewing the security strategy.

communicating the security strategy.

approving the security strategy

94. An information security strategy document that includes specific links to an organization's business activities is PRIMARILY an indicator of:

performance measurement.

integration.

alignment.

value delivery.

95. When an organization is setting up a relationship with a third-party IT service provider, which of the following is one of the MOST important topics to include in the contract from a security standpoint?

Compliance with international security standards.

Use of a two-factor authentication system.

Existence of an alternate hot site in case of business disruption.

Compliance with the organization's information security requirements.

96. To justify the need to invest in a forensic analysis tool, an information security manager should FIRST:

review the functionalities and implementation requirements of the solution.

review comparison reports of tool implementation in peer companies.

provide examples of situations where such a tool would be useful.

substantiate the investment in meeting organizational needs.

97. The MOST useful way to describe the objectives in the information security strategy is through:

attributes and characteristics of the 'desired state."

overall control objectives of the security program.

mapping the IT systems to key business processes.

calculation of annual loss expectations.

98. In order to highlight to management, the importance of network security, the security manager should FIRST:

develop a security architecture.

install a network intrusion detection system (NIDS) and prepare a list of attacks.

develop a network security policy.

conduct a risk assessment.

99. When developing an information security program, what is the MOST useful source of information for determining available resources?

Proficiency test

Job descriptions

Organization chart

Skills inventory

100. The MOST important characteristic of good security policies is that they:

state expectations of IT management.

state only one general security mandate.

are aligned with organizational goals.

govern the creation of procedures and guidelines.

Page 11 of 40

101. An information security manager must understand the relationship between information security and business operations in order to:

support organizational objectives.

determine likely areas of noncompliance.

assess the possible impacts of compromise.

understand the threats to the business.

102. The MOST effective approach to address issues that arise between IT management, business units and security management when implementing a new security strategy is for the information security manager to:

escalate issues to an external third party for resolution.

ensure that senior management provides authority for security to address the issues.

insist that managers or units not in agreement with the security solution accept the risk.

refer the issues to senior management along with any security recommendations.

103. Obtaining senior management support for establishing a warm site can BEST be accomplished by:

establishing a periodic risk assessment.

promoting regulatory requirements.

developing a business case.

developing effective metrics.

104. Which of the following would be the BEST option to improve accountability for a system administrator who has security functions?

Include security responsibilities in the job description

Require the administrator to obtain security certification

Train the system administrator on penetration testing and vulnerability assessment

Train the system administrator on risk assessment

105. Which of the following is the MOST important element of an information security strategy?

Defined objectives

Time frames for delivery

Adoption of a control framework

Complete policies

106. A multinational organization operating in fifteen countries is considering implementing an information security program.

Which factor will MOST influence the design of the Information security program?

Representation by regional business leaders

Composition of the board

Cultures of the different countries

IT security skills

107. Which of the following is the BEST justification to convince management to invest in an information security program?

Cost reduction

Compliance with company policies

Protection of business assets

Increased business value

108. On a company's e-commerce web site, a good legal statement regarding data privacy should include:

a statement regarding what the company will do with the information it collects.

a disclaimer regarding the accuracy of information on its web site.

technical information regarding how information is protected.

a statement regarding where the information is being hosted.

109. The MOST important factor in ensuring the success of an information security program is effective:

communication of information security requirements to all users in the organization.

formulation of policies and procedures for information security.

alignment with organizational goals and objectives.

monitoring compliance with information security policies and procedures.

110. Which of the following would be MOST helpful to achieve alignment between information security and organization objectives?

Key control monitoring

A robust security awareness program

A security program that enables business activities

An effective security architecture

Page 12 of 40

111. Which of the following BEST contributes to the development of a security governance framework that supports the maturity model concept?

Continuous analysis, monitoring and feedback

Continuous monitoring of the return on security investment (ROSD

Continuous risk reduction

Key risk indicator (KRD setup to security management processes

112. The MOST complete business case for security solutions is one that.

includes appropriate justification.

explains the current risk profile.

details regulatory requirements.

identifies incidents and losses.

113. Which of the following is MOST important to understand when developing a meaningful information security strategy?

Regulatory environment

International security standards

Organizational risks

Organizational goals

114. Which of the following is an advantage of a centralized information security organizational structure?

It is easier to promote security awareness.

It is easier to manage and control.

It is more responsive to business unit needs.

It provides a faster turnaround for security requests.

115. Which of the following would help to change an organization's security culture?

Develop procedures to enforce the information security policy

Obtain strong management support

Implement strict technical security controls

Periodically audit compliance with the information security policy

116. The BEST way to justify the implementation of a single sign-on (SSO) product is to use:

return on investment (RO

a vulnerability assessment.

annual loss expectancy (ALE).

a business case.

117. The FIRST step in establishing a security governance program is to:

conduct a risk assessment.

conduct a workshop for all end users.

prepare a security budget.

obtain high-level sponsorship.

118. An IS manager has decided to implement a security system to monitor access to the Internet and prevent access to numerous sites. Immediately upon installation, employees Hood the IT helpdesk with complaints of being unable to perform business functions on Internet sites. This is an example of:

conflicting security controls with organizational needs.

strong protection of information resources.

implementing appropriate controls to reduce risk.

proving information security's protective abilities.

119. An organization's information security strategy should be based on:

managing risk relative to business objectives.

managing risk to a zero level and minimizing insurance premiums.

avoiding occurrence of risks so that insurance is not required.

transferring most risks to insurers and saving on control costs.

120. Which of the following should be included in an annual information security budget that is submitted for management approval?

A cost-benefit analysis of budgeted resources

All of the resources that are recommended by the business

Total cost of ownership (TCO)

Baseline comparisons

Page 13 of 40

121. Which of the following is a benefit of information security governance?

Reduction of the potential for civil or legal liability

Questioning trust in vendor relationships

Increasing the risk of decisions based on incomplete management information

Direct involvement of senior management in developing control processes

122. Investment in security technology and processes should be based on:

clear alignment with the goals and objectives of the organization.

success cases that have been experienced in previous projects.

best business practices.

safeguards that are inherent in existing technology.

123. The data access requirements for an application should be determined by the:

legal department.

compliance officer.

information security manager.

business owner.

124. From an information security perspective, information that no longer supports the main purpose of the business should be:

analyzed under the retention policy.

protected under the information classification policy.

analyzed under the backup policy.

protected under the business impact analysis (BIA).

125. The organization has decided to outsource the majority of the IT department with a vendor that is hosting servers in a foreign country. Of the following, which is the MOST critical security consideration?

Laws and regulations of the country of origin may not be enforceable in the foreign country.

A security breach notification might get delayed due to the time difference.

Additional network intrusion detection sensors should be installed, resulting in an additional cost.

The company could lose physical control over the server and be unable to monitor the physical security posture of the servers.

126. Effective IT governance is BEST ensured by:

utilizing a bottom-up approach.

management by the IT department.

referring the matter to the organization's legal department.

utilizing a top-down approach.

127. The FIRST step to create an internal culture that focuses on information security is to:

implement stronger controls.

conduct periodic awareness training.

actively monitor operations.

gain the endorsement of executive management.

128. Which of the following is the BEST method or technique to ensure the effective implementation of an information security program?

Obtain the support of the board of directors.

Improve the content of the information security awareness program.

Improve the employees' knowledge of security policies.

Implement logical access controls to the information systems.

129. When an organization is implementing an information security governance program, its board of directors should be responsible for:

drafting information security policies.

reviewing training and awareness programs.

setting the strategic direction of the program.

auditing for compliance.

130. A risk assessment and business impact analysis (BIA) have been completed for a major proposed purchase and new process for an organization. There is disagreement between the information security manager and the business department manager who will own the process regarding the results and the assigned risk.

Which of the following would be the BEST approach of the information security manager?

Acceptance of the business manager's decision on the risk to the corporation

Acceptance of the information security manager's decision on the risk to the corporation

Review of the assessment with executive management for final input

A new risk assessment and BIA are needed to resolve the disagreement

Page 14 of 40

131. Who is responsible for ensuring that information is categorized and that specific protective measures are taken?

The security officer

Senior management

The end user

The custodian

132. An organization's board of directors has learned of recent legislation requiring organizations within the industry to enact specific safeguards to protect confidential customer information.

What actions should the board take next?

Direct information security on what they need to do

Research solutions to determine the proper solutions

Require management to report on compliance

Nothing; information security does not report to the board

133. Information security should be:

focused on eliminating all risks.

a balance between technical and business requirements.

driven by regulatory requirements.

defined by the board of directors.

134. What is the MOST important factor in the successful implementation of an enterprise wide information security program?

Realistic budget estimates

Security awareness

Support of senior management

Recalculation of the work factor

135. What is the MAIN risk when there is no user management representation on the Information Security Steering Committee?

Functional requirements are not adequately considered.

User training programs may be inadequate.

Budgets allocated to business units are not appropriate.

Information security plans are not aligned with business requirements

136. The MAIN reason for having the Information Security Steering Committee review a new security controls implementation plan is to ensure that:

the plan aligns with the organization's business plan.

departmental budgets are allocated appropriately to pay for the plan.

regulatory oversight requirements are met.

the impact of the plan on the business units is reduced.

137. Which of the following should be determined while defining risk management strategies?

Risk assessment criteria

Organizational objectives and risk appetite

IT architecture complexity

Enterprise disaster recovery plans

138. When implementing effective security governance within the requirements of the company's security strategy, which of the following is the MOST important factor to consider?

Preserving the confidentiality of sensitive data

Establishing international security standards for data sharing

Adhering to corporate privacy standards

Establishing system manager responsibility for information security

139. Which of the following is the BEST reason to perform a business impact analysis (BIA)?

To help determine the current state of risk

To budget appropriately for needed controls

To satisfy regulatory requirements

To analyze the effect on the business

140. Which of the following BEST enables the deployment of consistent security throughout international branches within a multinational organization?

Maturity of security processes

Remediation of audit findings

Decentralization of security governance

Establishment of security governance

Page 15 of 40

141. Which of the following is the BEST way to determine if an information security program aligns with corporate governance?

Evaluate funding for security initiatives

Survey end users about corporate governance

Review information security policies

Review the balanced scorecard

142. Security governance is MOST associated with which of the following IT infrastructure components?

Network

Application

Platform

Process

143. Which of the following is the PRIMARY advantage of having an established information security governance framework in place when an organization is adopting emerging technologies?

An emerging technologies strategy is in place

An effective security risk management process is established

End user acceptance of emerging technologies is established

A cost-benefit analysis process is easier to perform

144. Which of the following is the MOST appropriate board-level activity for information security governance?

Establish security and continuity ownership

Develop “what-if” scenarios on incidents

Establish measures for security baselines

Include security in job-performance appraisals

145. Business units within an organization are resistant to proposed changes to the information security program.

Which of the following is the BEST way to address this issue?

Implementing additional security awareness training

Communicating critical risk assessment results to business unit managers

Including business unit representation on the security steering committee

Publishing updated information security policies

146. In addition to business alignment and security ownership, which of the following is MOST critical for information security governance?

Auditability of systems

Compliance with policies

Reporting of security metrics

Executive sponsorship

147. Senior management has allocated funding to each of the organization’s divisions to address information security vulnerabilities. The funding is based on each division’s technology budget from the previous fiscal year.

Which of the following should be of GREATEST concern to the information security manager?

Areas of highest risk may not be adequately prioritized for treatment

Redundant controls may be implemented across divisions

Information security governance could be decentralized by division

Return on investment may be inconsistently reported to senior management

148. The effectiveness of an information security governance framework will BEST be enhanced if:

IS auditors are empowered to evaluate governance activities

risk management is built into operational and strategic activities

a culture of legal and regulatory compliance is promoted by management

consultants review the information security governance framework

149. When developing an information security governance framework, which of the following would be the MAIN impact when lacking senior management involvement?

Accountability for risk treatment is not clearly defined.

Information security responsibilities are not communicated effectively.

Resource requirements are not adequately considered.

Information security plans do not support business requirements.

150. Which of the following is the BEST way to facilitate the alignment between an organization’s information security program and business objectives?

Information security is considered at the feasibility stage of all IT projects.

The information security governance committee includes representation from key business areas.

The chief executive officer reviews and approves the information security program.

The information security program is audited by the internal audit department.

Page 16 of 40

151. The effectiveness of the information security process is reduced when an outsourcing organization:

is responsible for information security governance activities

receives additional revenue when security service levels are met

incurs penalties for failure to meet security service-level agreements

standardizes on a single access-control software product

152. What should be an information security manager’s FIRST course of action when an organization is subject to a new regulatory requirement?

Perform a gap analysis

Complete a control assessment

Submit a business case to support compliance

Update the risk register

153. Internal audit has reported a number of information security issues which are not in compliance with regulatory requirements.

What should the information security manager do FIRST?

Create a security exception

Perform a vulnerability assessment

Perform a gap analysis to determine needed resources

Assess the risk to business operations

154. Which of the following is the MOST important reason for an organization to develop an information security governance program?

Establishment of accountability

Compliance with audit requirements

Monitoring of security incidents

Creation of tactical solutions

155. The PRIMARY purpose of aligning information security with corporate governance objectives is to:

build capabilities to improve security processes.

consistently manage significant areas of risk.

identify an organization’s tolerance for risk.

re-align roles and responsibilities.

156. Which of the following is the MOST important consideration for designing an effective information security governance framework?

Defined metrics

Continuous audit cycle

Security policy provisions

Security controls automation

157. The PRIMARY goal of information security governance to an organization is to:

align with business processes

align with business objectives

establish a security strategy

manage security costs

158. Which of the following is the BEST way to integrate information security into corporate governance?

Engage external security consultants in security initiatives.

Conduct comprehensive information security management training for key stakeholders.

Ensure information security processes are part of the existing management processes.

Require periodic security risk assessments be performed.

159. Which of the following is the MOST effective way of ensuring that business units comply with an information security governance framework?

Integrating security requirements with processes

Performing security assessments and gap analysis

Conducting a business impact analysis (BIA)

Conducting information security awareness training

160. Which of the following BEST demonstrates alignment between information security governance and corporate governance?

Average number of security incidents across business units

Security project justifications provided in terms of business value

Number of vulnerabilities identified for high-risk information assets

Mean time to resolution for enterprise-wide security incidents

Page 17 of 40

161. The MOST important element in achieving executive commitment to an information security governance program is:

a defined security framework

identified business drivers

established security strategies

a process improvement model

162. After implementing an information security governance framework, which of the following would provide the

BEST information to develop an information security project plan?

Risk heat map

Recent audit results

Balanced scorecard

Gap analysis

163. An information security manager’s PRIMARY objective for presenting key risks to the board of directors is to:

meet information security compliance requirements.

ensure appropriate information security governance.

quantity reputational risks.

re-evaluate the risk appetite.

164. Which of the following is MOST helpful in integrating information security governance with corporate governance?

Assigning the implementation of information security governance to the steering committee.

Including information security processes within operational and management processes.

Providing independent reports of information security efficiency and effectiveness to the board.

Aligning the information security governance to a globally accepted framework.

165. Which of the following is the BEST way to align security and business strategies?

Include security risk as part of corporate risk management.

Develop a balanced scorecard for security.

Establish key performance indicators (KPIs) for business through security processes.

Integrate information security governance into corporate governance.

166. When developing an information security governance framework, which of the following should be the FIRST activity?

Integrate security within the system’s development life-cycle process.

Align the information security program with the organization’s other risk and control activities.

Develop policies and procedures to support the framework.

Develop response measures to detect and ensure the closure of security breaches.

167. Which of the following is the MOST effective way for senior management to support the integration of information security governance into corporate governance?

Develop the information security strategy based on the enterprise strategy.

Appoint a business manager as heard of information security.

Promote organization-wide information security awareness campaigns.

Establish a steering committee with representation from across the organization.

168. Which of the following would BEST help to ensure the alignment between information security and business functions?

Developing information security polices

Establishing an information security governance committee

Establishing a security awareness program

Providing funding for information security efforts

169. When establishing an information security governance framework, it is MOST important for an information security manager to understand:

the regulatory environment.

information security best practices.

the corporate culture.

risk management techniques.

170. Which of the following is a PRIMARY responsibility of the information security governance function?

Defining security strategies to support organizational programs

Ensuring adequate support for solutions using emerging technologies

Fostering a risk-aware culture to strengthen the information security program

Advising senior management on optimal levels of risk appetite and tolerance

Page 18 of 40

171. Which of the following is the MOST important requirement for the successful implementation of security governance?

Implementing a security balanced scorecard

Performing an enterprise-wide risk assessment

Mapping to organizational strategies

Aligning to an international security framework

172. A large organization is in the process of developing its information security program that involves working with several complex organizational functions.

Which of the following will BEST enable the successful implementation of this program?

Security governance

Security policy

Security metrics

Security guidelines

173. Which of the following is a PRIMARY responsibility of an information security governance committee?

Analyzing information security policy compliance reviews

Approving the purchase of information security technologies

Reviewing the information security strategy

Approving the information security awareness training strategy

174. An information security manager discovers that the organization’s new information security policy is not being followed across all departments.

Which of the following should be of GREATEST concern to the information security manager?

Different communication methods may be required for each business unit.

Business unit management has not emphasized the importance of the new policy.

The corresponding controls are viewed as prohibitive to business operations.

The wording of the policy is not tailored to the audience.

175. An organization has detected potential risk emerging from noncompliance with new regulations in its industry.

Which of the following is the MOST important reason to report this situation to senior management?

The risk profile needs to be updated.

An external review of the risk needs to be conducted.

Specific monitoring controls need to be implemented.

A benchmark analysis needs to be performed.

176. Which of the following is the BEST way for information security manager to identify compliance with information security policies within an organization?

Analyze system logs.

Conduct security awareness testing.

Perform vulnerability assessments.

Conduct periodic audits.

177. The BEST way to encourage good security practices is to:

schedule periodic compliance audits.

discipline those who fail to comply with the security policy.

recognize appropriate security behavior by individuals.

publish the information security policy.

178. Which of the following enables compliance with a nonrepudiation policy requirement for electronic transactions?

Digital certificates

Digital signatures

Encrypted passwords

One-time passwords

179. Which of the following is the BEST approach to identify noncompliance issues with legal, regulatory, and contractual requirements?

Risk assessment

Business impact analysis (BIA)

Vulnerability assessment

Gap analysis

180. A new version of an information security regulation is published that requires an organization’s compliance. The information security manager should FIRST:

perform an audit based on the new version of the regulation.

conduct a risk assessment to determine the risk of noncompliance.

conduct benchmarking against similar organizations.

perform a gap analysis against the new regulation.

Page 19 of 40

181. When an organization and its IT-hosting service provider are establishing a contract with each other, it is MOST important that the contract includes:

details of expected security metrics.

each party’s security responsibilities.

penalties for noncompliance with security policy.

recovery time objectives (RTOs).

182. Which of the following would be MOST useful to help senior management understand the status of information security compliance?

Industry benchmarks

Risk assessment results

Business impact analysis (BIA) results

Key performance indicators (KPIs)

183. Which of the following is MOST likely to be included in an enterprise information security policy?

Security monitoring strategy

Audit trail review requirements

Password composition requirements

Consequences of noncompliance

184. Which of the following BEST demonstrates that an organization supports information security governance?

Employees attend annual organization-wide security training.

Information security policies are readily available to employees.

The incident response plan is documented and tested regularly.

Information security steering committee meetings are held regularly.

185. Which of the following should be the PRIMARY expectation of management when an organization introduces an information security governance framework?

Optimized information security resources

Consistent execution of information security strategy

Improved accountability to shareholders

Increased influence of security management

186. Which of the following is the BEST approach for an information security manager when developing new information security policies?

Create a stakeholder map.

Reference an industry standard.

Establish an information security governance committee.

Download a policy template.

187. When supporting a large corporation’s board of directors in the development of governance, which of the following is the PRIMARY function of the information security manager?

Gaining commitment of senior management

Preparing the security budget

Providing advice and guidance

Developing a balanced scorecard

188. When making an outsourcing decision, which of the following functions is MOST important to retain within the organization?

Security management

Incident response

Risk assessment

Security governance

189. Which of the following would be MOST important to consider when implementing security settings for a new system?

Results from internal and external audits

Government regulations and related penalties

Business objectives and related IT risk

Industry best practices applicable to the business

190. The MOST important outcome of information security governance is:

business risk avoidance.

informed decision making.

alignment with business goals.

alignment with compliance requirements.

Page 20 of 40

191. Senior management commitment and support will MOST likely be offered when the value of information security governance is presented from a:

threat perspective.

compliance perspective.

risk perspective.

policy perspective.

192. Within a security governance framework, which of the following is the MOST important characteristic of the information security committee? The committee:

conducts frequent reviews of the security policy

has established relationships with external professionals

has a clearly defined charter and meeting protocols

includes a mix of members from all levels of management

193. Which of the following is MOST important to the successful implementation of an information security governance framework across the organization?

Organizational security controls deployed in line with regulations

Security management processes aligned with security objectives

The existing organizational security culture

Security policies that adhere to industry best practices

194. Which of the following is the MOST effective way to achieve the integration of information security governance into corporate governance?

Align information security budget requests to organizational goals

Ensure information security efforts support business goals

Provide periodic IT balanced scorecards to senior management

Ensure information security aligns with IT strategy

195. To gain a clear understanding of the impact that a new regulatory requirement will have on an organization’s information security controls, an information security manager should FIRST:

interview senior management

conduct a risk assessment

conduct a cost-benefit analysis

perform a gap analysis

196. The MOST effective way to incorporate risk management practices into existing production systems is through:

policy development.

change management.

awareness training.

regular monitoring.

197. Which of the following would be MOST useful in developing a series of recovery time objectives (RTOs)?

Gap analysis

Regression analysis

Risk analysis

Business impact analysis

198. The recovery time objective (RTO) is reached at which of the following milestones?

Disaster declaration

Recovery of the backups

Restoration of the system

Return to business as usual processing

199. Which of the following results from the risk assessment process would BEST assist risk management decision making?

Control risk

Inherent risk

Risk exposure

Residual risk

200. The decision on whether new risks should fall under periodic or event-driven reporting should be based on which of the following?

Mitigating controls

Visibility of impact

Likelihood of occurrence

Incident frequency

Page 21 of 40

201. Risk acceptance is a component of which of the following?

Assessment

Mitigation

Evaluation

Monitoring

202. Risk management programs are designed to reduce risk to:

a level that is too small to be measurable.

the point at which the benefit exceeds the expense.

a level that the organization is willing to accept.

a rate of return that equals the current cost of capital.

203. A risk assessment should be conducted:

once a year for each business process and subprocess.

every three to six months for critical business processes.

by external parties to maintain objectivity.

annually or whenever there is a significant change.

204. The MOST important function of a risk management program is to:

quantify overall risk.

minimize residual risk.

eliminate inherent risk.

maximize the sum of all annualized loss expectancies (ALEs).

205. Which of the following risks would BEST be assessed using qualitative risk assessment techniques?

Theft of purchased software

Power outage lasting 24 hours

Permanent decline in customer confidence

Temporary loss of e-mail due to a virus attack

206. Which of the following will BEST prevent external security attacks?

Static IP addressing

Network address translation

Background checks for temporary employees

Securing and analyzing system access logs

207. In performing a risk assessment on the impact of losing a server, the value of the server should be calculated using the:

original cost to acquire.

cost of the software stored.

annualized loss expectancy (ALE).

cost to obtain a replacement.

208. A business impact analysis (BIA) is the BEST tool for calculating:

total cost of ownership.

priority of restoration.

annualized loss expectancy (ALE).

residual risk.

209. When residual risk is minimized:

acceptable risk is probable.

transferred risk is acceptable.

control risk is reduced.

risk is transferable.

210. Quantitative risk analysis is MOST appropriate when assessment data:

include customer perceptions.

contain percentage estimates.

do not contain specific details.

contain subjective information.

Page 22 of 40

211. Which of the following is the MOST appropriate use of gap analysis?

Evaluating a business impact analysis (BIA)

Developing a balanced business scorecard

Demonstrating the relationship between controls

Measuring current state vs. desired future state

212. Identification and prioritization of business risk enables project managers to:

establish implementation milestones.

reduce the overall amount of slack time.

address areas with most significance.

accelerate completion of critical paths.

213. A risk analysis should:

include a benchmark of similar companies in its scope.

assume an equal degree of protection for all assets.

address the potential size and likelihood of loss.

give more weight to the likelihood vs. the size of the loss.

214. The recovery point objective (RPO) requires which of the following?

Disaster declaration

Before-image restoration

System restoration

After-image processing

215. Based on the information provided, which of the following situations presents the GREATEST information security risk for an organization with multiple, but small, domestic processing locations?

Systems operation procedures are not enforced

Change management procedures are poor

Systems development is outsourced

Systems capacity management is not performed

216. Which of the following BEST describes the scope of risk analysis?

Key financial systems

Organizational activities

Key systems and infrastructure

Systems subject to regulatory compliance

217. The decision as to whether a risk has been reduced to an acceptable level should be determined by:

organizational requirements.

information systems requirements.

information security requirements.

international standards.

218. Which of the following is the PRIMARY reason for implementing a risk management program?

Allows the organization to eliminate risk

Is a necessary part of management's due diligence

Satisfies audit and regulatory requirements

Assists in incrementing the return on investment (ROD

219. Which of the following groups would be in the BEST position to perform a risk analysis for a business?

External auditors

A peer group within a similar business

Process owners

A specialized management consultant

220. A successful risk management program should lead to:

optimization of risk reduction efforts against cost.

containment of losses to an annual budgeted amount.

identification and removal of all man-made threats.

elimination or transference of all organizational risks.

Page 23 of 40

221. Which of the following risks would BEST be assessed using quantitative risk assessment techniques?

Customer data stolen

An electrical power outage

A web site defaced by hackers

Loss of the software development team

222. The impact of losing frame relay network connectivity for 18-24 hours should be calculated using the: A. hourly billing rate charged by the carrier.

B. value of the data transmitted over the network.

C. aggregate compensation of all affected business users.

D. financial losses incurred by affected business units.

223. Which of the following is the MOST usable deliverable of an information security risk analysis?

Business impact analysis (BIA) report

List of action items to mitigate risk

Assignment of risks to process owners

Quantification of organizational risk

224. Ongoing tracking of remediation efforts to mitigate identified risks can BEST be accomplished through the use of which of the following?

Tree diagrams

Venn diagrams

Heat charts

Bar charts

225. Who would be in the BEST position to determine the recovery point objective (RPO) for business applications?

Business continuity coordinator

Chief operations officer (COO)

Information security manager

Internal audit

226. Which two components PRIMARILY must be assessed in an effective risk analysis?

Visibility and duration

Likelihood and impact

Probability and frequency

Financial impact and duration

227. Information security managers should use risk assessment techniques to:

justify selection of risk mitigation strategies.

maximize the return on investment (RO

provide documentation for auditors and regulators.

quantify risks that would otherwise be subjective.

228. In assessing risk, it is MOST essential to:

provide equal coverage for all asset types.

use benchmarking data from similar organizations.

consider both monetary value and likelihood of loss.

focus primarily on threats and recent business losses.

229. When the computer incident response team (CIRT) finds clear evidence that a hacker has penetrated the corporate network and modified customer information, an information security manager should FIRST notify:

the information security steering committee.

customers who may be impacted.

data owners who may be impacted.

regulatory- agencies overseeing privacy.

230. Data owners are PRIMARILY responsible for establishing risk mitigation methods to address which of the following areas?

Platform security

Entitlement changes

Intrusion detection

Antivirus controls

Page 24 of 40

231. The PRIMARY goal of a corporate risk management program is to ensure that an organization's:

IT assets in key business functions are protected.

business risks are addressed by preventive controls.

stated objectives are achievable.

IT facilities and systems are always available.

232. It is important to classify and determine relative sensitivity of assets to ensure that:

cost of protection is in proportion to sensitivity.

highly sensitive assets are protected.

cost of controls is minimized.

countermeasures are proportional to risk.

233. The service level agreement (SLA) for an outsourced IT function does not reflect an adequate level of protection. In this situation an information security manager should:

ensure the provider is made liable for losses.

recommend not renewing the contract upon expiration.

recommend the immediate termination of the contract.

determine the current level of security.

234. An information security manager has been assigned to implement more restrictive preventive controls. By doing so, the net effect will be to PRIMARILY reduce the:

threat.

loss.

vulnerability.

probability.

235. When performing a quantitative risk analysis, which of the following is MOST important to estimate the potential loss?

Evaluate productivity losses

Assess the impact of confidential data disclosure

Calculate the value of the information or asset

Measure the probability of occurrence of each threat

236. Before conducting a formal risk assessment of an organization's information resources, an information security manager should FIRST:

map the major threats to business objectives.

review available sources of risk information.

identify the value of the critical assets.

determine the financial impact if threats materialize.

237. The valuation of IT assets should be performed by:

an IT security manager.

an independent security consultant.

the chief financial officer (CFO).

the information owner.

238. The PRIMARY objective of a risk management program is to:

minimize inherent risk.

eliminate business risk.

implement effective controls.

minimize residual risk.

239. After completing a full IT risk assessment, who can BEST decide which mitigating controls should be implemented?

Senior management

Business manager

IT audit manager

Information security officer (ISO)

240. When performing an information risk analysis, an information security manager should FIRST:

establish the ownership of assets.

evaluate the risks to the assets.

take an asset inventory.

categorize the assets.

Page 25 of 40

241. The PRIMARY benefit of performing an information asset classification is to:

link security requirements to business objectives.

identify controls commensurate to risk.

define access rights.

establish ownership.

242. Which of the following is MOST essential for a risk management program to be effective?

Flexible security budget

Sound risk baseline

New risks detection

Accurate risk reporting

243. Which of the following attacks is BEST mitigated by utilizing strong passwords?

Man-in-the-middle attack

Brute force attack

Remote buffer overflow

Root kit

244. Phishing is BEST mitigated by which of the following?

Security monitoring software

Encryption

Two-factor authentication

User awareness

245. The security responsibility of data custodians in an organization will include:

assuming overall protection of information assets.

determining data classification levels.

implementing security controls in products they install.

ensuring security measures are consistent with policy.

246. A security risk assessment exercise should be repeated at regular intervals because:

business threats are constantly changing.

omissions in earlier assessments can be addressed.

repetitive assessments allow various methodologies.

they help raise awareness on security in the business.

247. Which of the following steps in conducting a risk assessment should be performed FIRST?

Identity business assets

Identify business risks

Assess vulnerabilities

Evaluate key controls

248. The systems administrator did not immediately notify the security officer about a malicious attack. An information security manager could prevent this situation by:

periodically testing the incident response plans.

regularly testing the intrusion detection system (IDS).

establishing mandatory training of all personnel.

periodically reviewing incident response procedures.

249. Which of the following risks is represented in the risk appetite of an organization?

Control

Inherent

Residual

Audit

250. Which of the following would a security manager establish to determine the target for restoration of normal processing?

Recover time objective (RTO)

Maximum tolerable outage (MTO)

Recovery point objectives (RPOs)

Services delivery objectives (SDOs)

Page 26 of 40

251. A risk management program would be expected to:

remove all inherent risk.

maintain residual risk at an acceptable level.

implement preventive controls for every threat.

reduce control risk to zero.

252. Risk assessment should be built into which of the following systems development phases to ensure that risks are addressed in a development project?

Programming

Specification

User testing

Feasibility

253. Which of the following would help management determine the resources needed to mitigate a risk to the organization?

Risk analysis process

Business impact analysis (BIA)

Risk management balanced scorecard

Risk-based audit program

254. A global financial institution has decided not to take any further action on a denial of service (DoS) risk found by the risk assessment team. The MOST likely reason they made this decision is that:

there are sufficient safeguards in place to prevent this risk from happening.

the needed countermeasure is too complicated to deploy.

the cost of countermeasure outweighs the value of the asset and potential loss.

The likelihood of the risk occurring is unknown.

255. Which would be one of the BEST metrics an information security manager can employ to effectively evaluate the results of a security program?

Number of controls implemented

Percent of control objectives accomplished

Percent of compliance with the security policy

Reduction in the number of reported security incidents

256. Which of the following types of information would the information security manager expect to have the LOWEST level of security protection in a large, multinational enterprise?

Strategic business plan

Upcoming financial results

Customer personal information

Previous financial results

257. The PRIMARY purpose of using risk analysis within a security program is to:

justify the security expenditure.

help businesses prioritize the assets to be protected.

inform executive management of residual risk value.

assess exposures and plan remediation.

258. Which of the following is the PRIMARY prerequisite to implementing data classification within an organization?

Defining job roles

Performing a risk assessment

Identifying data owners

Establishing data retention policies

259. An online banking institution is concerned that the breach of customer personal information will have a significant financial impact due to the need to notify and compensate customers whose personal information may have been compromised. The institution determines that residual risk will always be too high and decides to:

mitigate the impact by purchasing insurance.

implement a circuit-level firewall to protect the network.

increase the resiliency of security measures in place.

implement a real-time intrusion detection system.

260. What mechanisms are used to identify deficiencies that would provide attackers with an opportunity to compromise a computer system?

Business impact analyses

Security gap analyses

System performance metrics

Incident response processes

Page 27 of 40

261. A common concern with poorly written web applications is that they can allow an attacker to:

gain control through a buffer overflow.

conduct a distributed denial of service (DoS) attack.

abuse a race condition.

inject structured query language (SQL) statements.

262. Which of the following would be of GREATEST importance to the security manager in determining whether to accept residual risk?

Historical cost of the asset

Acceptable level of potential business impacts

Cost versus benefit of additional mitigating controls

Annualized loss expectancy (ALE)

263. A project manager is developing a developer portal and requests that the security manager assign a public IP address so that it can be accessed by in-house staff and by external consultants outside the organization's local area network (LAN).

What should the security manager do FIRST?

Understand the business requirements of the developer portal

Perform a vulnerability assessment of the developer portal

Install an intrusion detection system (IDS)

Obtain a signed nondisclosure agreement (NDA) from the external consultants before allowing external access to the server

264. A mission-critical system has been identified as having an administrative system account with attributes that prevent locking and change of privileges and name.

Which would be the BEST approach to prevent successful brute forcing of the account?

Prevent the system from being accessed remotely

Create a strong random password

Ask for a vendor patch

Track usage of the account by audit trails

265. Attackers who exploit cross-site scripting vulnerabilities take advantage of:

a lack of proper input validation controls.

weak authentication controls in the web application layer.

flawed cryptographic secure sockets layer (SSL) implementations and short key lengths.

implicit web application trust relationships.

266. Which of the following would BEST address the risk of data leakage?

File backup procedures

Database integrity checks

Acceptable use policies

Incident response procedures

267. A company recently developed a breakthrough technology. Since this technology could give this company a significant competitive edge, which of the following would FIRST govern how this information is to be protected?

Access control policy

Data classification policy

Encryption standards

Acceptable use policy

268. What is the BEST technique to determine which security controls to implement with a limited budget?

Risk analysis

Annualized loss expectancy (ALE) calculations

Cost-benefit analysis

Impact analysis

269. A company's mail server allows anonymous file transfer protocol (FTP) access which could be exploited.

What process should the information security manager deploy to determine the necessity for remedial action?

A penetration test

A security baseline review

A risk assessment

A business impact analysis (BIA)

270. Which of the following measures would be MOST effective against insider threats to confidential information?

Role-based access control

Audit trail monitoring

Defense-in-depth

Page 28 of 40

271. Because of its importance to the business, an organization wants to quickly implement a technical solution which deviates from the company's policies. An information security manager should:

conduct a risk assessment and allow or disallow based on the outcome.

recommend a risk assessment and implementation only if the residual risks are accepted.

recommend against implementation because it violates the company's policies.

recommend revision of current policy.

272. After a risk assessment study, a bank with global operations decided to continue doing business in certain regions of the world where identity theft is rampant. The information security manager should encourage the business to:

increase its customer awareness efforts in those regions.

implement monitoring techniques to detect and react to potential fraud.

outsource credit card processing to a third party.

make the customer liable for losses if they fail to follow the bank's advice.

273. The criticality and sensitivity of information assets is determined on the basis of:

threat assessment.

vulnerability assessment.

resource dependency assessment.

impact assessment.

274. Which program element should be implemented FIRST in asset classification and control?

Risk assessment

Classification

Valuation

Risk mitigation

275. When performing a risk assessment, the MOST important consideration is that:

management supports risk mitigation efforts.

annual loss expectations (ALEs) have been calculated for critical assets.

assets have been identified and appropriately valued.

attack motives, means and opportunities be understood.

276. The MAIN reason why asset classification is important to a successful information security program is because classification determines:

the priority and extent of risk mitigation efforts.

the amount of insurance needed in case of loss.

the appropriate level of protection to the asset.

how protection levels compare to peer organizations.

277. The BEST strategy for risk management is to:

achieve a balance between risk and organizational goals.

reduce risk to an acceptable level.

ensure that policy development properly considers organizational risks.

ensure that all unmitigated risks are accepted by management.

278. Which of the following would be the MOST important factor to be considered in the loss of mobile equipment with unencrypted data?

Disclosure of personal information

Sufficient coverage of the insurance policy for accidental losses

Intrinsic value of the data stored on the equipment

Replacement cost of the equipment

279. An organization has to comply with recently published industry regulatory requirements ― compliance that potentially has high implementation costs.

What should the information security manager do FIRST?

Implement a security committee.

Perform a gap analysis.

Implement compensating controls.

Demand immediate compliance.

280. Which of the following would be MOST relevant to include in a cost-benefit analysis of a two-factor authentication system?

Annual loss expectancy (ALE) of incidents

Frequency of incidents

Total cost of ownership (TCO)

Approved budget for the project

Page 29 of 40

281. One way to determine control effectiveness is by determining:

whether it is preventive, detective or compensatory.

the capability of providing notification of failure.

the test results of intended objectives.

the evaluation and analysis of reliability.

282. What does a network vulnerability assessment intend to identify?

0-day vulnerabilities

Malicious software and spyware

Security design flaws

Misconfiguration and missing updates

283. Who is responsible for ensuring that information is classified?

Senior management

Security manager

Data owner

Custodian

284. After a risk assessment, it is determined that the cost to mitigate the risk is much greater than the benefit to be derived.

The information security manager should recommend to business management that the risk be:

transferred.

treated.

accepted.

terminated.

285. When a significant security breach occurs, what should be reported FIRST to senior management?

A summary of the security logs that illustrates the sequence of events

An explanation of the incident and corrective action taken

An analysis of the impact of similar attacks at other organizations

A business case for implementing stronger logical access controls

286. The PRIMARY reason for initiating a policy exception process is when:

operations are too busy to comply.

the risk is justified by the benefit.

policy compliance would be difficult to enforce.

users may initially be inconvenienced.

287. Which of (lie following would be the MOST relevant factor when defining the information classification policy?

Quantity of information

Available IT infrastructure

Benchmarking

Requirements of data owners

288. To determine the selection of controls required to meet business objectives, an information security manager should:

prioritize the use of role-based access controls.

focus on key controls.

restrict controls to only critical applications.

focus on automated controls.

289. The MOST appropriate owner of customer data stored in a central database, used only by an organization's sales department, would be the:

sales department.

database administrator.

chief information officer (CIO).

head of the sales department.

290. In assessing the degree to which an organization may be affected by new privacy legislation, information security management should FIRST:

develop an operational plan for achieving compliance with the legislation.

identify systems and processes that contain privacy components.

restrict the collection of personal information until compliant.

identify privacy legislation in other countries that may contain similar requirements.

Page 30 of 40

291. Risk assessment is MOST effective when performed:

at the beginning of security program development.

on a continuous basis.

while developing the business case for the security program.

during the business change process.

292. Which of the following is the MAIN reason for performing risk assessment on a continuous basis'?

Justification of the security budget must be continually made.

New vulnerabilities are discovered every day.

The risk environment is constantly changing.

Management needs to be continually informed about emerging risks.

293. There is a time lag between the time when a security vulnerability is first published, and the time when a patch is delivered.

Which of the following should be carried out FIRST to mitigate the risk during this time period?

Identify the vulnerable systems and apply compensating controls

Minimize the use of vulnerable systems

Communicate the vulnerability to system users

Update the signatures database of the intrusion detection system (IDS)

294. Which of the following security activities should be implemented in the change management process to identify key vulnerabilities introduced by changes?

Business impact analysis (BIA)

Penetration testing

Audit and review

Threat analysis

295. Which of the following techniques MOST clearly indicates whether specific risk-reduction controls should be implemented?

Countermeasure cost-benefit analysis

Penetration testing

Frequent risk assessment programs

Annual loss expectancy (ALE) calculation

296. An organization has decided to implement additional security controls to treat the risks of a new process.

This is an example of:

eliminating the risk.

transferring the risk.

mitigating the risk.

accepting the risk.

297. Which of the following roles is PRIMARILY responsible for determining the information classification levels for a given information asset?

Manager

Custodian

User

Owner

298. The PRIMARY reason for assigning classes of sensitivity and criticality to information resources is to provide a basis for:

determining the scope for inclusion in an information security program.

defining the level of access controls.

justifying costs for information resources.

determining the overall budget of an information security program.

299. An organization is already certified to an international security standard.

Which mechanism would BEST help to further align the organization with other data security regulatory requirements as per new business needs?

Key performance indicators (KPIs)

Business impact analysis (BIA)

Gap analysis

Technical vulnerability assessment

300. When performing a qualitative risk analysis, which of the following will BEST produce reliable results?

Estimated productivity losses

Possible scenarios with threats and impacts

Value of information assets

Vulnerability assessment

Page 31 of 40

301. Which of the following is the BEST method to ensure the overall effectiveness of a risk management program?

User assessments of changes

Comparison of the program results with industry standards

Assignment of risk within the organization

Participation by all members of the organization

302. The MOST effective use of a risk register is to:

identify risks and assign roles and responsibilities for mitigation.

identify threats and probabilities.

facilitate a thorough review of all IT-related risks on a periodic basis.

record the annualized financial amount of expected losses due to risks.

303. After obtaining commitment from senior management, which of the following should be completed NEXT when establishing an information security program?

Define security metrics

Conduct a risk assessment

Perform a gap analysis

Procure security tools

304. Which of the following are the essential ingredients of a business impact analysis (B1A)?

Downtime tolerance, resources and criticality

Cost of business outages in a year as a factor of the security budget

Business continuity testing methodology being deployed

Structure of the crisis management team

305. A risk management approach to information protection is:

managing risks to an acceptable level, commensurate with goals and objectives.

accepting the security posture provided by commercial security products.

implementing a training program to educate individuals on information protection and risks.

managing risk tools to ensure that they assess all information protection vulnerabilities.

306. Which of the following is the MOST effective way to treat a risk such as a natural disaster that has a low probability and a high impact level?

Implement countermeasures.

Eliminate the risk.

Transfer the risk.

Accept the risk.

307. To ensure that payroll systems continue on in an event of a hurricane hitting a data center, what would be the FIRS T crucial step an information security manager would take in ensuring business continuity planning?

Conducting a qualitative and quantitative risk analysis.

Assigning value to the assets.

Weighing the cost of implementing the plan vs. financial loss.

Conducting a business impact analysis (BIA).

308. An information security organization should PRIMARILY:

support the business objectives of the company by providing security-related support services.

be responsible for setting up and documenting the information security responsibilities of the information security team members.

ensure that the information security policies of the company are in line with global best practices and standards.

ensure that the information security expectations are conveyed to employees.

309. When implementing security controls, an information security manager must PRIMARILY focus on:

minimizing operational impacts.

eliminating all vulnerabilities.

usage by similar organizations.

certification from a third party.

310. All risk management activities are PRIMARILY designed to reduce impacts to:

a level defined by the security manager.

an acceptable level based on organizational risk tolerance.

a minimum level consistent with regulatory requirements.

the minimum level possible.

Page 32 of 40

311. After assessing and mitigating the risks of a web application, who should decide on the acceptance of residual application risks?

Information security officer

Chief information officer (CIO)

Business owner

Chief executive officer (CFO)

312. The purpose of a corrective control is to: A. reduce adverse events.

B. indicate compromise.

C. mitigate impact.

D. ensure compliance.

313. Which of the following is the MOST important requirement for setting up an information security infrastructure for a new system?

Performing a business impact analysis (BIA)

Considering personal information devices as pan of the security policy

Initiating IT security training and familiarization

Basing the information security infrastructure on risk assessment

314. Previously accepted risk should be:

re-assessed periodically since the risk can be escalated to an unacceptable level due to revised conditions.

accepted permanently since management has already spent resources (time and labor) to conclude that the risk level is acceptable.

avoided next time since risk avoidance provides the best protection to the company.

removed from the risk log once it is accepted.

315. An information security manager is advised by contacts in law enforcement that there is evidence that his/ her company is being targeted by a skilled gang of hackers known to use a variety of techniques, including social engineering and network penetration. The FIRST step that the security manager should take is to:

perform a comprehensive assessment of the organization's exposure to the hacker's techniques.

initiate awareness training to counter social engineering.

immediately advise senior management of the elevated risk.

increase monitoring activities to provide early detection of intrusion.

316. Which of the following steps should be performed FIRST in the risk assessment process?

Staff interviews

Threat identification

Asset identification and valuation

Determination of the likelihood of identified risks

317. Which of the following authentication methods prevents authentication replay?

Password hash implementation

Challenge/response mechanism

Wired Equivalent Privacy (WEP) encryption usage

HTTP Basic Authentication

318. An organization has a process in place that involves the use of a vendor. A risk assessment was completed during the development of the process. A year after the implementation a monetary decision has been made to use a different vendor.

What, if anything, should occur?

Nothing, since a risk assessment was completed during development.

A vulnerability assessment should be conducted.

A new risk assessment should be performed.

The new vendor's SAS 70 type II report should be reviewed.

319. Which of the following is MOST important to consider when developing a business case to support the investment in an information security program?

Senior management support

Results of a cost-benefit analysis

Results of a risk assessment

Impact on the risk profile

320. It is MOST important for an information security manager to ensure that security risk assessments are performed:

consistently throughout the enterprise

during a root cause analysis

as part of the security business case

in response to the threat landscape

Page 33 of 40

321. An information security manager has been asked to create a strategy to protect the organization’s information from a variety of threat vectors.

Which of the following should be done FIRST?

Perform a threat modeling exercise

Develop a risk profile

Design risk management processes

Select a governance framework

322. Which of the following would BEST ensure that security risk assessment is integrated into the life cycle of major IT projects?

Integrating the risk assessment into the internal audit program

Applying global security standards to the IT projects

Training project managers on risk assessment

Having the information security manager participate on the project setting committees

323. An information security manager has completed a risk assessment and has determined the residual risk.

Which of the following should be the NEXT step?

Conduct an evaluation of controls

Determine if the risk is within the risk appetite

Implement countermeasures to mitigate risk

Classify all identified risks

324. Which of the following would be the BEST indicator that an organization is appropriately managing risk?

The number of security incident events reported by staff has increased

Risk assessment results are within tolerance

A penetration test does not identify any high-risk system vulnerabilities

The number of events reported from the intrusion detection system has declined

325. A large organization is considering a policy that would allow employees to bring their own smartphones into the organizational environment. The MOST important concern to the information security manager should be the:

higher costs in supporting end users

impact on network capacity

decrease in end user productivity

lack of a device management solution

326. Which of the following vulnerabilities presents the GREATEST risk of external hackers gaining access to the corporate network?

Internal hosts running unnecessary services

Inadequate logging

Excessive administrative rights to an internal database

Missing patches on a workstation

327. An information security manager has developed a strategy to address new information security risks resulting from recent changes in the business.

Which of the following would be MOST important to include when presenting the strategy to senior management?

The costs associated with business process changes

Results of benchmarking against industry peers

The impact of organizational changes on the security risk profile

Security controls needed for risk mitigation

328. What is the BEST way to determine the level of risk associated with information assets processed by an IT application?

Evaluate the potential value of information for an attacker

Calculate the business value of the information assets

Review the cost of acquiring the information assets for the business

Research compliance requirements associated with the information

329. When the inherent risk of a business activity is lower than the acceptable risk level, the BEST course of action would be to:

monitor for business changes

review the residual risk level

report compliance to management

implement controls to mitigate the risk

330. Which of the following would be MOST useful in a report to senior management for evaluating changes in the organization’s information security risk position?

Risk register

Trend analysis

Industry benchmarks

Management action plan

Page 34 of 40

331. An information security manager is preparing a presentation to obtain support for a security initiative.

Which of the following would be the BEST way to obtain management’s commitment for the initiative?

Include historical data of reported incidents

Provide the estimated return on investment

Provide an analysis of current risk exposures

Include industry benchmarking comparisons

332. Which of the following is the MOST significant security risk in IT asset management?

IT assets may be used by staff for private purposes

Unregistered IT assets may not be supported

Unregistered IT assets may not be included in security documentation

Unregistered IT assets may not be configured properly

333. Which of the following is the MOST effective method of preventing deliberate internal security breaches?

Screening prospective employees

Well-designed firewall system

Well-designed intrusion detection system (IDS)

Biometric security access control

334. A business previously accepted the risk associated with a zero-day vulnerability. The same vulnerability was recently exploited in a high-profile attack on another organization in the same industry.

Which of the following should be the information security manager’s FIRST course of action?

Reassess the risk in terms of likelihood and impact

Develop best and worst case scenarios

Report the breach of the other organization to senior management

Evaluate the cost of remediating the vulnerability

335. To effectively manage an organization’s information security risk, it is MOST important to:

periodically identify and correct new systems vulnerabilities

assign risk management responsibility to end users

benchmark risk scenarios against peer organizations

establish and communicate risk tolerance

336. Which of the following is the BEST course of action for the information security manager when residual risk is above the acceptable level of risk?

Perform a cost-benefit analysis

Recommend additional controls

Carry out a risk assessment

Defer to business management

337. Which of the following is the BEST reason to initiate a reassessment of current risk?

Follow-up to an audit report

A recent security incident

Certification requirements

Changes to security personnel

338. Before final acceptance of residual risk, what is the BEST way for an information security manager to address risk factors determined to be lower than acceptable risk levels?

Evaluate whether an excessive level of control is being applied.

Ask senior management to increase the acceptable risk levels.

Implement more stringent countermeasures.

Ask senior management to lower the acceptable risk levels.

339. When selecting risk response options to manage risk, an information security manager’s MAIN focus should be on reducing:

exposure to meet risk tolerance levels.

the likelihood of threat.

financial loss by transferring risk.

the number of security vulnerabilities.

340. Which of the following should an information security manager perform FIRST when an organization’s residual risk has increased?

Implement security measures to reduce the risk.

Communicate the information to senior management.

Transfer the risk to third parties.

Assess the business impact.

Page 35 of 40

341. Which of the following approaches is BEST for selecting controls to minimize information security risks?

Cost-benefit analysis

Control-effectiveness

Risk assessment

Industry best practices

342. Which of the following is the MOST appropriate course of action when the risk occurrence rate is low but the impact is high?

Risk transfer

Risk acceptance

Risk mitigation

Risk avoidance

343. Which of the following is the MOST effective way to communicate information security risk to senior management?

Business impact analysis

Balanced scorecard

Key performance indicators (KPIs)

Heat map

344. Security risk assessments should cover only information assets that: A. are classified and labeled.

B. are inside the organization.

C. support business processes.

D. have tangible value.

345. Which of the following is an indicator of improvement in the ability to identify security risks?

Increased number of reported security incidents.

Decreased number of staff requiring information security training.

Decreased number of information security risk assessments.

Increased number of security audit issues resolved.

346. Which of the following is the MOST important step in risk ranking?

Impact assessment

Mitigation cost

Threat assessment

Vulnerability analysis

347. An organization is considering moving one of its critical business applications to a cloud hosting service. The cloud provider may not provide the same level of security for this application as the organization.

Which of the following will provide the BEST information to help maintain the security posture?

Risk assessment

Cloud security strategy

Vulnerability assessment

Risk governance framework

348. Following a significant change to the underlying code of an application, it is MOST important for the information security manager to:

inform senior management

update the risk assessment

validate the user acceptance testing

modify key risk indicators

349. Which of the following would BEST mitigate identified vulnerabilities in a timely manner?

Continuous vulnerability monitoring tool

Categorization of the vulnerabilities based on system’s criticality

Monitoring of key risk indicators (KRIs)

Action plan with responsibilities and deadlines

350. Risk assessment should be conducted on a continuing basis because:

controls change on a continuing basis

the number of hacking incidents is increasing

management should be updated about changes in risk

factors that affect information security change

Page 36 of 40

351. Which of the following BEST illustrates residual risk within an organization?

Risk management framework

Risk register

Business impact analysis

Heat map

352. Following a recent acquisition, an information security manager has been requested to address the outstanding risk reported early in the acquisition process.

Which of the following would be the manager’s BEST course of action?

Add the outstanding risk to the acquiring organization’s risk registry.

Re-assess the outstanding risk of the acquired company.

Re-evaluate the risk treatment plan for the outstanding risk.

Perform a vulnerability assessment of the acquired company’s infrastructure.

353. An organization has recently experienced unauthorized device access to its network. To proactively manage the problem and mitigate this risk, the BEST preventive control would be to:

keep an inventory of network and hardware addresses of all systems connected to the network.

install a stateful inspection firewall to prevent unauthorized network traffic.

implement network-level authentication and login to regulate access of devices to the network.

deploy an automated asset inventory discovery tool to identify devices that access the network.

354. A core business unit relies on an effective legacy system that does not meet the current security standards and threatens the enterprise network.

Which of the following is the BEST course of action to address the situation?

Document the deficiencies in the risk register.

Disconnect the legacy system from the rest of the network.

Require that new systems that can meet the standards be implemented.

Develop processes to compensate for the deficiencies.

355. Which of the following is the PRIMARY goal of a risk management program?

Implement preventive controls against threats.

Manage the business impact of inherent risks.

Manage compliance with organizational policies.

Reduce the organization’s risk appetite.

356. A risk management program will be MOST effective when:

risk appetite is sustained for a long period

risk assessments are repeated periodically

risk assessments are conducted by a third party

business units are involved in risk assessments

357. The objective of risk management is to reduce risk to the minimum level that is:

compliant with security policies

practical given industry and regulatory environments.

achievable from technical and financial perspectives.

acceptable given the preference of the organization.

358. The MOST important objective of monitoring key risk indicators (KRIs) related to information security is to:

identify change in security exposures.

reduce risk management costs.

meet regulatory compliance requirements.

minimize the loss from security incidents.

359. Which of the following would be MOST helpful in determining an organization’s current capacity to mitigate risk?

Capability maturity model

Business impact analysis

IT security risk and exposure

Vulnerability assessment

360. Several significant risks have been identified after a centralized risk register was compiled and prioritized. The information security manager’s most important action is to:

provide senior management with risk treatment options.

design and implement controls to reduce the risk.

consult external third parties on how to treat the risk.

ensure that employees are aware of the risk.

Page 37 of 40

361. An organization’s marketing department wants to use an online collaboration service which is not in compliance with the information security policy. A risk assessment is performed, and risk acceptance is being pursued. Approval of risk acceptance should be provided by:

the information security manager

business senior management

the chief risk officer

the compliance officer.

362. The risk of mishandling alerts identified by an intrusion detection system (IDS) would be the GREATEST when:

standard operating procedures are not formalized.

the IT infrastructure is diverse.

IDS sensors are misconfigured.

operations and monitoring are handled by different teams.

363. An information security manager has been informed of a new vulnerability in an online banking application, and patch to resolve this issue is expected to be released in the next 72 hours. The information security manager’s MOST important course of action should be to:

assess the risk and advise senior management.

identify and implement mitigating controls.

run the application system in offline mode.

perform a business impact analysis (BIA).

364. An information security manager has recently been notified of potential security risks associated with a third-party service provider.

What should be done NEXT to address this concern?

Conduct a risk analysis

Escalate to the chief risk officer

Conduct a vulnerability analysis

Determine compensating controls

365. In risk assessment, after the identification of threats to organizational assets, the information security manager would:

evaluate the controls currently in place.

implement controls to achieve target risk levels.

request funding for the security program.

determine threats to be reported to upper management.

366. During a security assessment, an information security manager finds a number of security patches were not installed on a server hosting a critical business application. The application owner did not approve the patch installation to avoid interrupting the application.

Which of the following should be the information security manager’s FIRST course of action?

Escalate the risk to senior management.

Communicate the potential impact to the application owner.

Report the risk to the information security steering committee.

Determine mitigation options with IT management.

367. Risk identification, analysis, and mitigation activities can BEST be integrated into business life cycle processes by linking them to:

compliance testing

configuration management

continuity planning

change management

368. Which of the following is the PRIMARY reason for performing an analysis of the threat landscape on a regular basis?

To determine the basis for proposing an increase in security budgets.

To determine if existing business continuity plans are adequate.

To determine if existing vulnerabilities present a risk.

To determine critical information for executive management.

369. Which of the following would BEST justify spending for a compensating control?

Threat analysis

Risk analysis

Peer benchmarking

Vulnerability analysis

370. After undertaking a security assessment of a production system, the information security manager is MOST likely to:

inform the system owner of any residual risks and propose measures to reduce them.

inform the development team of any residual risks, and together formulate risk reduction measures.

inform the IT manager of the residual risks and propose measures to reduce them.

establish an overall security program that minimizes the residual risks of that production system.

Page 38 of 40

371. Mitigating technology risks to acceptable levels should be based PRIMARILY upon:

business process reengineering.

business process requirement.

legal and regulatory requirements.

information security budget.

372. After assessing risk, the decision to treat the risk should be based PRIMARILY on:

availability of financial resources.

whether the level of risk exceeds risk appetite.

whether the level of risk exceeds inherent risk.

the criticality of the risk.

373. Which of the following is the MOST important prerequisite to performing an information security risk assessment?

Classifying assets

Determining risk tolerance

Reviewing the business impact analysis

Assessing threats and vulnerabilities

374. When preventative controls to appropriately mitigate risk are not feasible, which of the following is the MOST important action for the information security manager to perform?

Assess vulnerabilities.

Manage the impact.

Evaluate potential threats.

Identify unacceptable risk levels.

375. Reevaluation of risk is MOST critical when there is:

a change in security policy.

resistance to the implementation of mitigating controls.

a change in the threat landscape.

a management request for updated security reports.

376. An information security manager finds that a soon-to-be deployed online application will increase risk beyond acceptable levels, and necessary controls have not been included.

Which of the following is the BEST course of action for the information security manager?

Present a business case for additional controls to senior management.

Instruct IT to deploy controls based on urgent business needs.

Solicit bids for compensating control products.

Recommend a different application.

377. Which of the following is the GREATEST risk of single sign-on?

It is a single point of failure for an enterprise access control process.

Password carelessness by one user may render the entire infrastructure vulnerable.

Integration of single sign-on with the rest of the infrastructure is complicated.

One administrator maintains the single sign-on solutions without segregation of duty.

378. Which of the following is the MOST important reason for performing a risk analysis?

Assigning the appropriate level of protection

Identifying critical information assets

Identifying and eliminating threats

Promoting increased security awareness in the organization

379. Deciding the level of protection a particular asset should be given in BEST determined by:

a threat assessment.

a vulnerability assessment.

a risk analysis.

corporate risk appetite.

380. A risk profile supports effective security decisions PRIMARILY because it:

defines how to best mitigate future risks.

identifies priorities for risk reduction.

enables comparison with industry best practices.

describes security threats.

Page 39 of 40

381. Which of the following would be the MOST effective to mitigate the risk of data loss in the event of a stolen laptop?

Providing end-user awareness training focused on travelling with laptops

Deploying end-point data loss prevention software on the laptop

Encrypting the hard drive

Utilizing a strong password

382. Which of the following is the BEST method for determining whether new risks exist in legacy applications?

Regularly scheduled risk assessments

Automated vulnerability scans

Third-party penetration testing

Frequent updates to the risk register

383. Which of the following processes can be used to remediate identified technical vulnerabilities?

Running baseline configurations

Conducting a risk assessment

Performing a business impact analysis (BIA)

Running automated scanners

384. Which of the following would provide senior management with the BEST information to better understand the organization’s information security risk profile?

Scenarios that impact business operations

Scenarios that disrupt client services

Scenarios that impact business goals

Scenarios that have a monetary impact

385. A software vendor has announced a zero-day vulnerability that exposes an organization’s critical business systems, following should be the information security manager’s PRIMARY concern?

Business tolerance of downtime

Adequacy of the incident response plan

Availability of resources to implement controls

Ability to test patches prior to deployment

386. Which of the following is the MOST important action when using a web application that has recognized vulnerabilities?

Deploy an application firewall.

Deploy host-based intrusion detection.

Install anti-spyware software.

Monitor application level logs.

387. Which of the following is the MOST effective mitigation strategy to protect confidential information from insider threats?

Performing an entitlement review process

Implementing authentication mechanism

Defining segregation of duties

Establishing authorization controls

388. Which of the following is the BEST indicator of a successful external intrusion into computer systems?

Unexpected use of protocols within the DM

Unexpected increase of malformed URLs.

Decrease in the number of login failures.

Spikes in the number of login failures.

389. The likelihood of a successful attack is a function of: A. incentive and capability of the intruder

B. opportunity and asset value

C. threat and vulnerability levels

D. value and desirability to the intruder

390. A risk mitigation report would include recommendations for:

assessment.

acceptance.

evaluation.

quantification.

Page 40 of 40

391. A risk management program should reduce risk to:

zero.

an acceptable level.

an acceptable percent of revenue.

an acceptable probability of occurrence.

392. The MOST important reason for conducting periodic risk assessments is because: A. risk assessments are not always precise.

B. security risks are subject to frequent change.

C. reviewers can optimize and reduce the cost of controls.

D. it demonstrates to senior management that the security function can add value.

393. Which of the following BEST indicates a successful risk management practice?

Overall risk is quantified

Inherent risk is eliminated

Residual risk is minimized

Control risk is tied to business units

394. Which of the following would generally have the GREATEST negative impact on an organization?

Theft of computer software

Interruption of utility services

Loss of customer confidence

Internal fraud resulting in monetary loss

395. A successful information security management program should use which of the following to determine the amount of resources devoted to mitigating exposures?

Risk analysis results

Audit report findings

Penetration test results

Amount of IT budget available

396. Which of the following will BEST protect an organization from internal security attacks?

Static IP addressing

Internal address translation

Prospective employee background checks

Employee awareness certification program

397. For risk management purposes, the value of an asset should be based on:

original cost.

net cash flow.

net present value.

replacement cost.

398. In a business impact analysis, the value of an information system should be based on the overall cost:

of recovery.

to recreate.

if unavailable.

of emergency operations.

399. Acceptable risk is achieved when:

residual risk is minimized.

transferred risk is minimized.

control risk is minimized.

inherent risk is minimized.

Certified Information Security Manager CISM Study Guides

Certified Information Security Manager CISM Study Guides

Share this post

Leave a Reply Cancel reply