Which of the following most commonly falls within the scope of an information security governance steering committee?

Vetting information security policies

Approving access to critical financial systems

Developing content for security awareness programs

Interviewing candidates for information security specialist positions

Vetting information security policies

A security professional has been promoted to be the CISO of an organization. The first task is to create a security policy for this organization. The CISO creates and publishes the security policy. This policy however, is ignored and not enforced consistently. Which of the following is the MOST likely reason for the policy shortcomings?

Lack of a formal security policy governance process

Lack of a formal security awareness program

Lack of a formal security policy governance process

Lack of formal definition of roles and responsibilities

Lack of a formal risk management policy

Which of the following is the MAIN reason to follow a formal risk management process in an organization that hosts and uses privately identifiable information (PII) as part of their business models and processes?

Need to better understand the risk associated with using PII data

Need to comply with breach disclosure laws

Need to transfer the risk associated with hosting PII data

Need to better understand the risk associated with using PII data

Fiduciary responsibility to safeguard credit card information

Credit card information, medical data, and government records are all examples of:

Confidential/Protected Information

The establishment of a formal risk management framework and system authorization program is essential. The LAST step of the system authorization process is:

Getting authority to operate the system from executive management

Contacting the Internet Service Provider for an IP scope

Getting authority to operate the system from executive management

Conducting a final scan of the live system and mitigating all high and medium level vulnerabilities

The single most important consideration to make when developing your security program, policies, and processes is:

Budgeting for unforeseen data compromises

Establishing your authority as the Security Executive

An organization's Information Security Policy is of MOST importance because

it communicates management's commitment to protecting information resources

it is formally acknowledged by all employees and vendors

it defines a process to meet compliance requirements

it establishes a framework to protect confidential information

Developing effective security controls is a balance between:

Corporate Culture and Job Expectations

Technology and Vendor Management

The PRIMARY objective for information security program development should be:

Reducing the impact of the risk to the business.

Establishing strategic alignment with bunsiness continuity requirements

Establishing incident response programs.

Identifying and implementing the best security solutions.

Which of the following should be determined while defining risk management strategies?

Organizational objectives and risk tolerance

Enterprise disaster recovery plans

Which of the following is a benefit of information security governance?

Reduction of the potential for civil and legal liability

Questioning the trust in vendor relationships.

Increasing the risk of decisions based on incomplete management information.

Direct involvement of senior management in developing control processes

Reduction of the potential for civil and legal liability

Which of the following is the MOST important benefit of an effective security governance process?

Reduction of liability and overall risk to the organization

Senior management participation in the incident response process

The FIRST step in establishing a security governance program is to?

Obtain senior level sponsorship.

Conduct a workshop for all end users.

Which of the following has the GREATEST impact on the implementation of an information security governance model?

Complexity of organizational structure

Distance between physical locations

Complexity of organizational structure

From an information security perspective, information that no longer supports the main purpose of the business should be:

analyzed under the retention policy

assessed by a business impact analysis.

protected under the information classification policy.

analyzed under the data ownership policy.

analyzed under the retention policy

The alerting, monitoring and life-cycle management of security related events is typically handled by the

security threat and vulnerability management process

governance, risk, and compliance tools

One of the MAIN goals of a Business Continuity Plan is to

Provide step by step plans to recover business processes in the event of a disaster

Ensure all infrastructure and applications are available in the event of a disaster

Allow all technical first-responders to understand their roles in the event of a disaster

Provide step by step plans to recover business processes in the event of a disaster

Assign responsibilities to the technical teams responsible for the recovery of all data.

When managing an Information Security Program, which of the following is of MOST importance in order to influence the culture of an organization?

Alignment of security goals with business goals

An independent Governance, Risk and Compliance organization

Alignment of security goals with business goals

Compliance with local privacy regulations

Support from Legal and HR teams

Which of the following is considered the MOST effective tool against social engineering?

Effective Security awareness program

Effective Security Vulnerability Management Program

Effective Security awareness program

Which of the following is of MOST importance when security leaders of an organization are required to align security to influence the culture of an organization?

Understand the business goals of the organization

Poses a strong technical background

Understand all regulations affecting the organization

Understand the business goals of the organization

Poses a strong auditing background

In accordance with best practices and international standards, how often is security awareness training provided to employees of an organization?

High risk environments 6 months, low risk environments 12 months

Which of the following is a MAJOR consideration when an organization retains sensitive customer data and uses this data to better target the organization's products and services?

Strong authentication technologies

Financial reporting regulations

Credit card compliance and regulations

When an organization claims it is secure because it is PCI-DSS certified, what is a good first question to ask towards assessing the effectiveness of their security program?

What is the scope of the certification?

How many credit card records are stored?

What is the scope of the certification?

What is the value of the assets at risk?

What is a difference from the list below between quantitative and qualitative Risk Assessment?

Quantitative risk assessments result in an exact number (in monetary terms)

Qualitative risk assessments result in a quantitative assessment (high, medium, low, red, yellow, green)

Qualitative risk assessments map to business objectives

Quantitative risk assessments result in a quantitative assessment (high, medium, low, red, yellow, green)

What is the definition of Risk in Information Security?

Risk = Financial Impact x Probability

Quantitative Risk Assessments have the following advantages over qualitative risk assessments:

They are objective and can express risk / cost in real numbers

They are subjective and can be completed more quickly

They are objective and express risk / cost in approximates

They are subjective and can express risk /cost in real numbers

Which of the following is MOST important when dealing with an Information Security Steering committee:

Review all past audit and compliance reports.

Include a mix of members from different departments and staff levels.

Ensure that security policies and procedures have been vetted and approved.

Review all past audit and compliance reports.

Be briefed about new trends and products at each meeting by a vendor.

A business unit within your organization intends to deploy a new technology in a manner that places it in violation of existing information security standards. What immediate action should the information security manager take?

If the risks associated with that technology are not already identified, perform a risk analysis to quantify the risk, and allow the business unit to proceed based on the identified risk level.

Enforce the existing security standards and do not allow the deployment of the new technology.

Amend the standard to permit the deployment.

If the risks associated with that technology are not already identified, perform a risk analysis to quantify the risk, and allow the business unit to proceed based on the identified risk level.