Quiz
ilaria 008
Create a free account to finish this quiz
Save your progress and see your final score.
Already have an account? Sign in
Questions in this quiz (34)
1The BEST strategy for risk management is to:
- Aachieve a balance between risk and organizational goals.
- Breduce risk to an acceptable level
- Censure that policy development properly considers organizational risks.
- Densure that all unmitigated risks are accepted by management
2Which of the following would be the MOST important factor to be considered in the loss of mobile
equipment with unencrypted data?- ADisclosure of personal information
- BSufficient coverage of the insurance policy for accidental losses
- CIntrinsic value of the data stored on the equipment
- DReplacement cost of the equipment
3An organization has to comply with recently published industry regulatory
requirements—compliance that potentially has high implementation costs. What should the
information security manager do FIRST?- AImplement a security committee
- BPerform a gap analysis.
- CImplement compensating controls
- DDemand immediate compliance.
4Which of the following would be MOST relevant to include in a cost-benefit analysis of a two-factor
authentication system?- AAnnual loss expectancy (ALE) of incidents
- BFrequency of incidents
- CTotal cost of ownership (TCO)
- DApproved budget for the project
5One way to determine control effectiveness is by determining:
- Awhether it is preventive, detective or compensatory
- Bthe capability of providing notification of failure.
- Cthe test results of intended objectives
- Dthe evaluation and analysis of reliability
6What does a network vulnerability assessment intend to identify?
- A0-day vulnerabilities
- BMalicious software and spyware
- CSecurity design flaws
- DMisconfiguration and missing updates
7Who is responsible for ensuring that information is classified?
- ASenior management
- BSecurity manager
- CData owner
- DCustodian
8After a risk assessment, it is determined that the cost to mitigate the risk is much greater than the
benefit to be derived. The information security manager should recommend to business
management that the risk be:- Atransferred.
- Btreated.
- Caccepted.
- Dterminated.
9When a significant security breach occurs, what should be reported FIRST to senior
management?- AA summary of the security logs that illustrates the sequence of events
- BAn explanation of the incident and corrective action taken
- CAn analysis of the impact of similar attacks at other organizations
- DA business case for implementing stronger logical access controls
10The PRIMARY reason for initiating a policy exception process is when:
- Aoperations are too busy to comply
- Bthe risk is justified by the benefit
- Cpolicy compliance would be difficult to enforce
- Dusers may initially be inconvenienced
11Which of (lie following would be the MOST relevant factor when defining the information
classification policy?- AQuantity of information
- BAvailable IT infrastructure
- CBenchmarking
- DRequirements of data owners
12To determine the selection of controls required to meet business objectives, an information
security manager should:- Aprioritize the use of role-based access controls
- Bfocus on key controls
- Crestrict controls to only critical applications
- Dfocus on automated controls.
13The MOST appropriate owner of customer data stored in a central database, used only by an
organization's sales department, would be the:- Asales department
- Bdatabase administrator
- Cchief information officer (CIO).
- Dhead of the sales department.
14In assessing the degree to which an organization may be affected by new privacy legislation,
information security management should FIRST:- Adevelop an operational plan for achieving compliance with the legislation
- Bidentify systems and processes that contain privacy components
- Crestrict the collection of personal information until compliant
- Didentify privacy legislation in other countries that may contain similar requirements
15Risk assessment is MOST effective when performed:
- Aat the beginning of security program development
- Bon a continuous basis
- Cwhile developing the business case for the security program
- Dduring the business change process
16Which of the following is the MAIN reason for performing risk assessment on a continuous basis'?
- AJustification of the security budget must be continually made
- BNew vulnerabilities are discovered every day
- CThe risk environment is constantly changing
- DManagement needs to be continually informed about emerging risks
17There is a time lag between the time when a security vulnerability is first published, and the time
when a patch is delivered. Which of the following should be carried out FIRST to mitigate the risk
during this time period?- AIdentify the vulnerable systems and apply compensating controls
- BMinimize the use of vulnerable systems
- CCommunicate the vulnerability to system users
- DUpdate the signatures database of the intrusion detection system (IDS)
18Which of the following security activities should be implemented in the change management
process to identify key vulnerabilities introduced by changes?- ABusiness impact analysis (BIA)
- BPenetration testing
- CAudit and review
- DThreat analysis
19Which of the following techniques MOST clearly indicates whether specific risk-reduction controls
should be implemented?- ACountermeasure cost-benefit analysis
- BPenetration testing
- CFrequent risk assessment programs
- DAnnual loss expectancy (ALE) calculation
20An organization has decided to implement additional security controls to treat the risks of a new
process. This is an example of:- Aeliminating the risk
- Btransferring the risk
- Cmitigating the risk.
- Daccepting the risk
21Which of the following roles is PRIMARILY responsible for determining the information
classification levels for a given information asset?- AManager
- BCustodian
- CUser
- DOwner
22The PRIMARY reason for assigning classes of sensitivity and criticality to information resources is
to provide a basis for:- Adetermining the scope for inclusion in an information security program
- Bdefining the level of access controls
- Cjustifying costs for information resources
- Ddetermining the overall budget of an information security program.
23An organization is already certified to an international security standard. Which mechanism would
BEST help to further align the organization with other data security regulatory requirements as per
new business needs?- AKey performance indicators (KPIs)
- BBusiness impact analysis (BIA)
- CGap analysis
- DTechnical vulnerability assessment
24When performing a qualitative risk analysis, which of the following will BEST produce reliable
results?- AEstimated productivity losses
- BPossible scenarios with threats and impacts
- CValue of information assets
- DVulnerability assessment
25Which of the following is the BEST method to ensure the overall effectiveness of a risk
management program?- AUser assessments of changes
- BComparison of the program results with industry standards
- CAssignment of risk within the organization
- DParticipation by all members of the organization
26The MOST effective use of a risk register is to:
- Aidentify risks and assign roles and responsibilities for mitigation.
- Bidentify threats and probabilities
- Cfacilitate a thorough review of all IT-related risks on a periodic basis
- Drecord the annualized financial amount of expected losses due to risks
27After obtaining commitment from senior management, which of the following should be completed
NEXT when establishing an information security program?- ADefine security metrics
- BConduct a risk assessment
- CPerform a gap analysis
- DProcure security tools
28Which of the following are the essential ingredients of a business impact analysis (B1A)?
- ADowntime tolerance, resources and criticality
- BCost of business outages in a year as a factor of the security budget
- CBusiness continuity testing methodology being deployed
- DStructure of the crisis management team
29A risk management approach to information protection is:
- Amanaging risks to an acceptable level, commensurate with goals and objectives.
- Baccepting the security posture provided by commercial security products
- Cimplementing a training program to educate individuals on information protection and risks
- Dmanaging risk tools to ensure that they assess all information protection vulnerabilities
30Which of the following is the MOST effective way to treat a risk such as a natural disaster that has
a low probability and a high impact level?- AImplement countermeasures
- BEliminate the risk
- CTransfer the risk
- DAccept the risk.
31To ensure that payroll systems continue on in an event of a hurricane hitting a data center, what
would be the FIRS T crucial step an information security manager would take in ensuring business
continuity planning?- AConducting a qualitative and quantitative risk analysis
- BAssigning value to the assets
- CWeighing the cost of implementing the plan vs. financial loss.
- DConducting a business impact analysis (BIA).
32An information security organization should PRIMARILY:
- Asupport the business objectives of the company by providing security-related support services
- Bbe responsible for setting up and documenting the information security responsibilities of the
information security team members. - Censure that the information security policies of the company are in line with global best
practices and standards. - Densure that the information security expectations are conveyed to employees.
33When implementing security controls, an information security manager must PRIMARILY focus
on:- Aminimizing operational impacts.
- Beliminating all vulnerabilities.
- Cusage by similar organizations
- Dcertification from a third party
34All risk management activities are PRIMARILY designed to reduce impacts to:
- Aa level defined by the security manager
- Ban acceptable level based on organizational risk tolerance
- Ca minimum level consistent with regulatory requirements
- Dthe minimum level possible
Information
- Description
- Quiz on ilaria 008, created by Luis EZ on 13/06/2017.
- Author
- Luis EZ
- Language
- English
- Views
- 2
- History
- Created on 13 Jun 2017 · updated on 13 Jun 2017
- Tags
- Rating
- No ratings yet Rate this quiz