QUESTION 207
The newly appointed CISO of an organization is reviewing the IT security strategic plan. Which of the following is the MOST important component of the strategic plan?

QUESTION 208
Which of the following is critical in creating a security program aligned with an organization’s goals?

QUESTION 209
Who in the organization determines access to information?

QUESTION 210
Which of the following reports should you as an IT auditor use to check on compliance with a service level agreement’s requirement for uptime?

QUESTION 211
An organization information security policy serves to

QUESTION 212
Which of the following is the MOST important reason to measure the effectiveness of an Information Security Management System (ISMS)?

QUESTION 213
When managing the security architecture for your company you must consider:

QUESTION 214
Which represents PROPER separation of duties in the corporate environment?

QUESTION 215
Your company has limited resources to spend on security initiatives. The Chief Financial Officer asks you to prioritize the protection of information resources based on their value to the company. It is essential that you be able to communicate in language that your fellow executives will understand. You should:

QUESTION 216
A newly appointed security officer finds data leakage software licenses that had never been used. The officer decides to implement a project to ensure it gets installed, but the project gets a great deal of resistance across the organization.
Which of the following represents the MOST likely reason for this situation?

QUESTION 217
Scenario: An organization has recently appointed a CISO. This is a new role in the organization and it signals the increasing need to address security consistently at the enterprise level. This new CISO, while confident with skills and experience, is constantly on the defensive and is unable to advance the IT security centric agenda.
The CISO has been able to implement a number of technical controls and is able to influence the Information Technology teams but has not been able to influence the rest of the organization.
From an organizational perspective, which of the following is the LIKELY reason for this?

QUESTION 218
Which of the following is a strong post designed to stop a car?

QUESTION 219
A company wants to fill a Chief Information Security Officer position in the organization. They need to define and implement a more holistic security program. Which of the following qualifications and experience would be MOST desirable to find in a candidate?

QUESTION 220
Your penetration testing team installs an in-line hardware key logger onto one of your network machines.
Which of the following is of major concern to the security organization?

QUESTION 221
An organization’s firewall technology needs replaced. A specific technology has been selected that is less costly than others and lacking in some important capabilities. The security officer has voiced concerns about sensitive data breaches but the decision is made to purchase.
What does this selection indicate?

QUESTION 222
The executive board has requested that the CISO of an organization define and Key Performance Indicators (KPI) to measure the effectiveness of the security awareness program provided to call center employees.
Which of the following can be used as a KPI?

QUESTION 223
SCENARIO: Critical servers show signs of erratic behavior within your organization’s intranet. Initial information indicates the systems are under attack from an outside entity. As the Chief Information Security Officer (CISO), you decide to deploy the Incident Response Team (IRT) to determine the details of this incident and take action according to the information available to the team.
In what phase of the response will the team extract information from the affected systems without altering original data?

QUESTION 224
When managing the critical path of an IT security project, which of the following is MOST important?

QUESTION 225
A new CISO just started with a company and on the CISO’s desk is the last complete Information Security Management audit report. The audit report is over two years old. After reading it, what should be the CISO’s FIRST priority?

QUESTION 226
As the CISO, you have been tasked with the execution of the company’s key management program. You MUST ensure the integrity of encryption keys at the point of generation. Which principal of encryption key control will ensure no single individual can constitute or re-constitute a key?

QUESTION 227
As the CISO for your company you are accountable for the protection of information resources commensurate with:

QUESTION 228
Which of the following is the MAIN security concern for public cloud computing?