What should be the information security manager s MOST important consideration when planning a disaster recovery test?
An information security manager learns that a departmental system is out of compliance with the information security policy's authentication requirements. Which of the following should be the information security manager's FIRST course of action?
Which of the following is the MOST important outcome of testing incident response plans?
Which of the following is the BEST strategy to implement an effective operational security posture?
Which of the following is MOST helpful when justifying the funding required for a compensating control?
A third-party service provider is developing a mobile app for an organization's customers. Which of the following issues should be of GREATEST concern to the information security management.
A security team is conducting its annual disaster recovery test. Post-restoration testing shows the system response time is significantly slower due to insufficient bandwidth for Internet connectivity at the recovery center. Which of the following is the security manager's BEST course of action?
Which of the following BEST helps to identify vulnerabilities introduced by changes to an organization's technical infrastructure?
When developing a protection strategy for outsourcing applications, the information se
When facilitating the alignment of corporate governance and information security governance, which of the following is the MOST important role of an organizations security steering committee?
Which of the following would be an information security manager's PRIMARY challenge when deploying a bring your own device (BYOD) mobile program in an enterprise?
BEST way to isolate corporate data stored on employee-owned mobile devices would be to implement:
After undertaking a security assessment of a production system, the information security manager is MOST likely to:
Which of the following stakeholders would provide the BEST guidance in aligning the information security strategy with organizational goals?
An organization has established information security policies, but the information security the MOST likely reason for this situation?
Which of the following is the MOST important reason for logging firewall activity?
Which of the following should be an information security manager's PRIMARY focus during the development of a critical system storing highly confidential data?
Which of the following is BEST to include in a business case when the return on investment (RIO) for an information security initiative is difficult to calculate?
The PRIMARY purpose of a security information and event management (SIEM) system is to:
Which of the following is MOST important to building an effective information security program?
Management is questioning the need for several items in the information security budget proposal. Which of the following would have been MOST helpful prior to budget submission?
Which of the following BEST demonstrates alignment between information security governance and corporate governance?
An organization has an approved bring your own device (BYOD) program. Which of the following is the MOST effective method to enforce application control on personal devices?
Which of the following provides the BEST evidence that the information security program is aligned to the business strategy?
Which of the following is MOST important when prioritizing an information security incident?
What is the PRIMARY benefit of effective configuration management?
A CEO requires that information security risk management is practiced at the organizational level through a central risk register. Which of the following is the MOST important reason to report a summary of this risk register to the board?
Which of the following is MOST likely to be included in an enterprise security policy?
Which of the following would be MOST useful to help senior management understand the status of information security compliance?
Which of the following is MOST important to include in a contract with a critical service provider to help ensure alignment with the organization's information security program?
Which of the following is MOST important to the effectiveness of an information security steering committee?
Audit trails of changes to source code and object code are BEST tracked through:
An organization is going through a digital transformation process, which places the IT organization in an
unfamiliar risk landscape. The information security manager has been tasked with leading the IT risk
management process. Which of the following should be given the HIGHEST priority?
Which of the following is the MAIN benefit of performing an assessment of existing incident response processes?
Which of the following is MOST important to have in place to help ensure an organization's cybersecurity program meets the needs of the business?
Which of the following is MOST important to implement when using a service account for infrastructure administration?
Which of the following BEST supports the incident management process for attacks on an organization's supply chain?
A senior executive asks the information security manager to bypass the organization's Internet traffic filters due to a business need.
Which of the following should be the information security manager's NEXT course of action?
Which of the following provides the MOST relevant information to determine the overall effectiveness of an information security program and underlying business processes?
Senior management is concerned that the incident response team took unapproved actions during incident response that put business objectives at risk. Which of the following is the BEST way (or the information security manager to respond to this situation?
During a security assessment, an information security manager finds a number of security patches were not installed on a server hosting a
critical business application. The application owner did not approve the patch installation to avoid interrupting the application. Which of the
following should be the information security manager's FIRST course of action?
Which of the following is the MOST important factor to be considered when reviewing an information security strategy?
Which of the following will BEST enhance the privacy of data in transit for an online transaction system?
A security policy exception is leading to an unexpected increase in the number of alerts about suspicious Internet traffic on an organization's network Which of the following is the BEST course of action?
Senior management has just accepted the risk of noncompliance with a new regulation What should the information security manager do NEXT''
An incident response team recently encountered an unfamiliar type of cyber event. Though the team was able to resalve the issue, it took a significant
amount of time to identify, What is the BEST way to help ensure similar incidents are identified more quickly in the future?
An employee has just reported the loss of a personal mobile device containing corporate information. Which of the following should the
information security manager do FIRST?
Which of the following is the BEST way to enhance training for incident response teams?
Which of the following is the PRIMARY objective of an incident response plan?
What is the PRIMARY objective of triage within the incident response process?
From a business perspective the MOST important function of information security is to support:
An organization is considering whether to allow employees to use personal computing devices for business purposes To BEST facilitate senior management's decision, the information security manager should:
Which of the following provides the MOST comprehensive understanding of an organization's information security posture?
Which of the following is the BEST way to demonstrate to senior management that organizational security practices comply with industry standards?
Who is MOST important to include when establishing the response process for a significant security breach that would impact the IT infrastructure and cause customer data toss?
When defining responsibilities with a cloud computing vendor, which of the following should be regarded as a shared responsibility between user and provider?
When evaluating vendors for sensitive data processing, which of the following should be the FIRST step to ensure the correct level of information security is provided?
Which of the following is the BEST way for an organization that outsources many business processes to gain assurance that services provided are adequately secured?
An external security audit has reported multiple instances of control noncompliance. Which of the following is MOST important for the information security manager to communicate to senior managements.
An organization is leveraging tablets to replace desktop computers shared by shift-based staff. These tables contain critical business data and are inherently at increased risk of theft. Which of the following will BEST help to mitigate this risk?
Which of the following is the MOST important action when using a web application that has recognized vulnerabilities?
Which of the following metrics would BEST determine the effectiveness of an application security testing program?
Ensuring that activities performed by outsourcing providers comply with information security policies can BEST be accomplished through the use of:
Which of the following metrics is the BEST measure of the effectiveness of an information security program?
Which of the following has the PRIMARY responsibility of ensuring an organizations information security strategy supports business goals?
Which of the following is the MOST effective way of ensuring that business units comply with an information security governance framework?
Which of the following is the PRIMARY purpose for establishing a bring your own device (BYOD) policy that only permits application downloads from designated online markets.
Which of the following is the PRIMARY reason for performing an analysis of the threat landscape on a regular basis?
An information security manager is preparing a presentation to obtain support for a security initative. Which of the following is the BEST way to obtain management's commitment for the initiative?
Which of the following would be MOST helpful to reduce the amount of time needed by an incident response team to determine appropriate actions?
An organization wants to ensure its confidential data is isolated in a multi-tenanted environment at a well-known cloud service provider. Which of the following is the BEST way to ensure the data is adequately protected?
Which of the following MUST be established before implementing a data loss prevention (DLP) system?
What should an information security team do FIRST when notified by the help desk that an employee's computer has been infected with ma I ware?
Which of the following sites is MOST appropriate in the case of a very short recovery time objective (RTO)?
Which of the following would BEST help to ensure an organization's information security strategy is aligned with business objectives?
Which of the following is the information security manager's PRIMARY role in the information assets classification process?
An organization establishes an internal document collaboration site. To ensure data confidently of each project group, it is MOST important to:
Which of the following BEST protects against phishing attacks?
Which of the following is the MOST effective approach to ensure IT processes are performed in compliance with the information security policies?
Which of the following is MOST important when developing a security strategy?
When establishing an information security strategy, which of the following activities Is MOST helpful in Identifying critical areas to be protected?
A global organization has developed a strategy to share a customer information database between offices in two countries. In this situation, it is MOST important to ensure:
System logs and audit logs for sensitive systems should be stored
Which of the following is the MOST effective way for an information security manager to protect the organization from misuse of social media?
Which of the following BEST supports effective information security governance"*
Which of the following is the MOST important security consideration when planning to use a cloud service provider in a different country?
Which of the following methods BEST ensures that a comprehensive approach is used to direct information security activities?
An online trading company discovers that a network attack has penetrated the firewall What should be the information security manager's FIRST response?
Which of the following is MOST effective in the strategic alignment of security initiatives?
Which of the following provides the MOST essential input for the development of an information security strategy?
Which of the following is the MOST effective way for an organization to ensure its third-party service providers are aware of information security requirements and expectations?
An organization has decided to store production data in a cloud environment. What should be the FIRST consideration?
The BEST way to avoid session hijacking is to use:
The MOST important objective of security awareness training for business staff is to:
Which of the following should be done FIRST when establishing security measures for personal data stored and processed on a human resources….system?
An organization is considering moving to a cloud service provider for the storage of sensitive data. Which of the following should be considered FIRST?
Which of the following is the MOST effective method of preventing deliberate internal security breaches?
The PRIMARY goal of conducting a business impact analysis (BIA) as part of an overall continuity planning process is to:
The responsibility for approving access to data according to the organization's data classification policy belongs to the:
Which of the following is MOST effective against system intrusions?
An organization enacted several information security policies to satisfy regulatory requirements. Which of the following situations would MOST likely increase the probability of noncompliance to these requirements?
An information security manager has observed multiple exceptions for a number of different security controls. Which of the following should be the information security manager's FIRST course of action?
An organization plans to leverage popular social network platforms to promote its products and services. Which of the following is the BEST course of action for the information security manager to support this initiative?
Which of the following is MOST important for an information security manager to ensure is included in a business case for a new security system?
Which of the following would be the MOST important information to include in a business case for an information security project in a highly regulated industry?
Which of the following is the MOST effective approach to communicate general information security responsibilities across an organization?
Which of the following is the MOST important outcome of a well-implemented awareness program?
Which of the following is the MOST important component of a risk profile?
The integration of information security risk management processes within corporate risk management processes will MOST likely result in:
When using a newly implemented security information and event management (SIEM) infrastructure, which of the following should be considered FIRST?
After implementing an information security governance framework, which of the following would provide the BEST information to develop an information security project plan?
An organization has implemented an enhanced password policy for business applications which requires significantly more business resource to support clients. The BEST approach to obtain the support of business management would be to:
As part of an international expansion plan, an organization has acquired a company located in another jurisdiction. Which of the following would be the BEST way to maintain an effective information security program?
The PRIMARY purpose of asset valuation for the management of information security is to:
A new program has been implemented to standardize security configurations across a multinational organization Following implementation, the configuration standards should:
Which of the following would BEST assist an information security manager in gaining strategic support from executive management?
Which of the following is the BEST way to demonstrate to senior management that organizational security practices comply with industry standards?
Which of the following BEST reduces the likelihood of leakage of private information via email?
When information security management is receiving an increased number of false positive incident reports, which of the following is MOST important to review?
Which of the following is the BEST resource for evaluating the strengths and weaknesses of an incident response plan?
Which of the following BEST enables an effective escalation process within an incident response program?
Which of the following is the MOST important consideration when determining the approach for gaining organization-wide acceptance of an information security plan?
The PRIMARY reason an organization would require that users sign an acknowledgment of their system access responsibilities is to:
An organization's security policy is to disable access to USB storage devices on laptops and desktops. Which of the following is the STRONGEST justification foi granting an exception to the policy?
The MOST important factors in determining the scope and timing for testing a business continuity plan are:
The MOST effective way to continuously monitor an organization's cybersecurity posture is to evaluate its
Which of the following is the MOST important reason to develop an organizational threat profile?
Which of the following should be the FIRST course of action when it becomes apparent that the recovery time objective (RTO) will not be met during incident response
Which of the following BEST facilitates the development of a comprehensive information security policy?
An information security manager has identified numerous violations of security policy which prohibits text messaging from personal devices to conduct official business following is the MOST effective way to reduce the number of violations?
Which of the following would be an information security manager's BEST course of action upon learning a third-party cloud provider is not meeting information security with regard to data encryption?
Which of the following is an information security manager's MOST important consideration during the investigative process of analyzing the hard drive of 3 compromises..
Which of the following is the MOST effective way for senior management to support the integration of information security governance into corporate governance?
Which of the following is the BEST evidence that proper security monitoring controls are in place?
Which of the following is the BEST method to protect against emerging advanced persistent threat (APT) actors?
The MOST important reason that security risk assessments should be conducted frequently throughout an organization is because:
After assessing risk, the decision to treat the risk should be based PRIMARILY on:
A review of a number of recent XT system rollouts identified a failure to incorporate security within planning, development and implementation. Which of the following is the MOST effective way to prevent a recurrence for future systems?
Following a recent acquisition, an information security manager has been requested to address the outstanding risk reported early in the acquisition process. Which of the following is the manager s BEST course of action?
Which of the following is the MOST important consideration when developing an incident management program?
Internal audit has reported a number of information security issues which are not in compliance with regulatory requirements. What should the information security manager do FIRST?
In an organization that has undergone an expansion through an acquisition, which of the following would BEST secure the enterprise network?
Which of the following is the MOST important element of a response plan for IT security incidents?
Which of the following provides the BEST evidence that a recently established information security program is effective?
An IT department has given a vendor remote access to the internal network for troubleshooting network performance problems. After discovering the remote activity during a firewall log review, which of the following is the FIRST course of action for an information security manager?
Which of the following is the MOST useful input for an information security manager when refreshing the organizations security strategy?
An organization's operations have been significantly impacted by a cyber attack resulting in data loss. Once the attack has been contained, what should the security team.
Reviewing security objectives and ensuring the integration of security across business units is PRIMARILY the focus of the:
Human resources is evaluating potential Software as a Service (SaaS) cloud services, Which of the following should the information security manager do FIRST to support..
Which of the following would BEST enable management to be aware of an electronic breach to an externally hosted database?
Which of the following would provide nonrepudiation of electronic transactions?
Relying on which of the following methods when detecting new threats using IDS should be of MOST concern?
Which of the following is the MOST important reason for performing vulnerability assessments periodically?
It is suspected that key emails have been viewed by unauthorized parties. The email administrator conducted an investigation but it has not returned any information relating to the incident, and leaks are continuing. Which of the following is the BEST recommended course of action to senior management?
Which of the following is the- PRIMARY objective of an incident communication plan?
Which of the following is MOST important to enable after completing action plan?
Which of the following is the BKT approach for an information security manager when developing new information security policies?
In an organization with effective IT risk management, the PRIMARY reason to establish key risk indicators (KRIs) is to:
During an emergency security incident, which of the following would MOST likely predict the worst-case scenario?
Senior management commitment and support will MOST likely be offered when the value of information security governance is presented from a:
An organization is MOST at risk from a new worm being introduced through the intranet when:
Senior management has approved employees working off-site by using a virtual private network (VPN) connection. It is MOST important for the information security manager to periodically:
Which of the following will BEST help to ensure security is addressed when developing a custom application?
Which of the following provides the MOST relevant evidence of incident response maturity?
Which of the following BEST indicates senior management support for an information security program?
An information security manager is reviewing the impact of a regulation on the organization’s human resources system. The NEXT course of action should be to:
Which of the following contributes MOST to the effective implementation of an information security strategy?
Following a successful and well-publicized hacking incident, an organization alias plans to improve application security. Which of the following is a security project risk?
Which of the following is the BEST way to increase the visibility of information security within an organization's culture?
Which of the following is MOST important when selecting a third-party security operations center?
The PRIMARY benefit of integrating information security risk into enterprise risk management is to:
Which of the following is MOST likely to drive an update to the information security strategy?
Which of the following is the MOST effective method for assessing the effectiveness of a security awareness program?
For a business operating in a competitive and evolving online market, it is MOST important for a security policy to focus on:
The MOST likely cause of a security information event monitoring (SIEM) solution failing to identify a serious incident is that the system:
During an annual security review of an organizations servers, it was found that the customer service team's file server, which contains sensitive customer data, is accessible to all user IDs in the organization. Which of the following should the information security manager do FIRST?
Which of the following is MOST useful to include in a report to senior management on a regular basis to demonstrate the effectiveness of the information security program?
Which of the following is an example of a deterrent control?
Which of the following is the BEST way to provide management with meaningful information regarding the performance of the information security program against strategic objectives?
In which of the following situations is it MOST important to escalate an incident response to senior management?
Which of the following is MOST important when establishing effective information security metrics?
Which of the following is the PRIMARY purpose of conducting a business impact analysis (BIA)?
An information security manager reads a media report of a new type of malware attack. Who should be notified FIRST"
Which of the following is the BEST approach for determining the maturity level of an information security program?
Which of the following is MOST important for an information security manager to include in a report to senior management following a post-incident review?
Which of the following is MOST important to the successful implementation of an information security governance framework across the organization?
Which of the following BEST supports the risk assessment process to determine criticality of an asset?
An organization s HR department would like to outsource its employee management system to a cloud-hosted solution due to features and cost savings offered. Management has identified this solution as a business need and wants to move forward. What should be the PRIMARY role of information security in this effort?
Which of the following is MOST important to consider when developing a disaster recovery plan?
What should be an information security manager's FIRST step when developing a business case for a new intrusion detection system (IDS) solution?
Which of the following is the BEST way for an information security manager to justify continued investment in the information security program when the organization is facing significant budget cuts?
A recent phishing attack investigation showed that several employees had used their work email addresses to create personal accounts on a shopping site that had been breached. What is the BEST way to prevent this
The GREATEST benefit of using a maturity model when providing security reports to management is that it presents the:
Which of the following is the MOST important part of an incident response plan?
Which of the following should an information security manager do FIRST when an organization plans to migrate all internally hosted applications to the cloud?
Which of the following tools BEST demonstrates the effectiveness of the information security program?
What should an information security manager do NEXT when management does not accept control recommendations resulting from a risk assessment?
Which of the following is the MOST relevant source of information for determining the available internal human resources for executing the information security program?
An investigation of a recent security incident determined that the root cause was negligent handling of incident alerts by system administrators. What is the BEST way for the information security manager to address this issue?
An information security manager has identified the organization is not in compliance with new legislation that will soon be in effect. Which of the following is MOST important to consider when determining additional controls to be implemented?