hh

You've configured a VPN server for remote users to connect to the company's network. Which of the following encryption types will Linux use?

3DES

How many steps are defined in the risk management strategy?

6

SOX requires that signing officers evaluate the effectiveness of the issuer's internal controls within how many days prior to the report?

90 days

Which of the following will be the most effective in ensuring employees follow security policy and procedures?

A good match between assignment of roles and responsibilities and proficiencies

Which of the following recovery strategies is most suitable for a business having multiple office centers within a certain region and a limited recovery budget cost?

A reciprocal arrangement between its office center

You are the network administrator for a company that frequently exchanges confidential emails without outside parties (clients, vendors, etc.). You want those emails to be encrypted; however, you want the least difficulty in the encryption process. Which of the following should you choose?

Asymmetric encryption

You are the network administrator for a company that frequently exchanges confidential emails without outside parties (clients, vendors, etc.). You want those emails to be encrypted; however, you want the least overhead/difficulty in the encryption process. Which of the following should you choose?

Asymmetric key encryption

Which of the following is the process of verifying the identity of a person, network host, or system process?

Authentication

Which of the following is the major concern of an information security manager while documenting a formal data retention policy?

Business requirement

Information security governance is mainly motivated by which of the following?

Business strategy

How do KPIs add value to information security?

By monitoring changes in business performance in relation to specific business objectives

Which of the following options is used by the information security department to justify its ongoing security budget?

Cost-benefit analysis

Computer networks and Internet are the prime mode of information transfer today. Which of the following is a technique used for modifying messages, providing information and cyber security, and reducing the risk of hacking attacks during communications and message passing over the Internet?

Cryptography

Which of the following options would be best supported by an information security manager in managing and handling a security breach?

Cyber incident response plan

Which of the following types of incident response teams (IRT) is responsible for a logical or physical segment of the infrastructure, usually of a large organization?

Distributed IRT

Which of the following attacks does management frame protection help to mitigate?

DoS attack

the team consist of executives

Emergency management

Which of the following is the most common reason for security failures in an organization?

Employee awareness around information security

Which of the following is the main objective of a security steering group?

Ensure information security aligns with business goal strategies.

Which of the following options should be adopted by an effective risk management program to address changes in risk?

Ensure that continuous monitoring processes are in place.

Which of the following factors is essential when collecting evidence for forensic analysis?

Ensure the assignment of qualified personnel.

Which of the following would be the most important objective of an information security governance program?

Ensuring trust in data

Which of the following sub phases in life cycle model is performed in the request control phase?

Establishing priorities of requests

All vulnerabilities discovered during an assessment should be handled as a risk. True or False?

False

Intrusion detection systems must be on the network. True or False?

False

From the perspective of technical control, what is an organization's first perimeter of defense?

Firewall

In which of the following tests are the operations shut down at the primary site and shifted to the recovery site in accordance with the recovery plan?

Full interruption test

Which of the following assesses risks, determines costs to alleviate those risks, and prioritizes the recovery plan developed through risk assessment?

IT service continuity management

Which of the following documentations provides information about people who are responsible for handling security incidents and how they can be contacted, and instructions to deal with documenting and disseminating incident-related information?

Incident response policy

Your company has asked you to give new employees a presentation on data protection and confidentiality to ensure a secure wireless communication between the employees. What types of information does not require confidentiality?

Information that is public

Which of the following statements is important while achieving effective strategic alignment of security initiatives?

Inputs should be obtained and consensus achieved between the main organizational divisions.

Which of the following defenses support policies and procedures for detection and notification?

Intrusion and virus detection

Which of the following statements describes the main purpose of a regulatory policy?

It ensures that an organization is following the standard procedures or base practices of operation in its specific industry.

Which of the following statements about the authentication concept of information security management is true?

It establishes the users' identity and ensures that the users are who they say they are.

You work as a CRO for BlueWell Inc. You have successfully carried out the risk management plan. A new member has joined your risk management team and wants to know the impact of the successful risk management plan on the business. What will be your response?

It optimizes risk reduction efforts against cost.

A company's security policy must be primarily based upon:

Its threat profile

John works as a website administrator for ABC Inc. The company has to set a privacy policy on all computers. The policy requires that John restrict only third party cookies that do not have a compact private policy or that use personally identifiable information without a user's implicit consent. He reports to the technical support executive that he wants to set the policy. The technical support executive asks him to configure the settings in the Privacy tab page. Which of the following privacy settings will John use to accomplish the task?

Low

Which of the following is the main objective of risk management?

Maintain residual risk at an acceptable level.

What is the primary purpose of risk management?

Managing risk to defined acceptable levels

Which of the following types of IT coverage offers coverage for potential loss or damage to media while transferring to off-site premises?

Media transportation

You work as a security manager for uCertify, Inc. You want to review the access control lists and observe that privileged access is granted to the entire department. Which of the following steps should you use first to accomplish the task?

Meet with data owners to understand business needs.

Which of the following events causes a major impact on an information security management function?

Merging with another organization

John works as a system administrator for uCertify Inc. The company has a wireless LAN network and multiple computers. He wants to allow multiple computers to share one or more IP addresses. Which of the following tools will John use to accomplish the task?

NAT

With which of the following actions will an information security manager balance the potentially conflicting needs of an international organization's security standards, laws, and local regulations?

Negotiate a local version of the organization standards, laws, and local regulations.

You work as a security manager for BlueWell Inc. You are using the signature-based IDS technique to examine network traffic for preconfigured and predetermined attack patterns known as signatures. Which of the following limitations will you discover in using the signature-based intrusion detection system technique?

New attack methods will not be detected.

Which of the following ensures that a party to a dispute cannot deny the authenticity of their signature on a document or the sending of a message that they originated?

Non-repudiation

Incident management is a part of which component of a security framework?

Operational

Who is responsible for ascertaining that needed organizational functions, resources, and supporting infrastructure are available and properly utilized to fulfill the information-security related directives of the board, regulatory compliance, and other demands?

Organization's executive management team

Which of the following is a remote access protocol that supports encryption?

PPP

Which of the following are enablers for security governance as defined by the COBIT 5 framework?

People, skills, and competencies

Which of the following would be the appropriate metric for the IT risk management process?

Percentage of critical assets with budgeted remedial

Mark, an information security officer for BlueWell, Inc, wants to draw the attention of management towards the significance of integrating information security in the business processes. Which of the following tasks should he perform first to accomplish the task?

Perform a risk assessment.

Which of the following are high-level documents signed by a person of high authority with the power to force cooperation?

Policies

Which of the following is a major factor to keep in mind when assessing the value of information?

Potential financial loss

Which of the following steps is the first step in an incident response plan?

Preparation

Which of the following goals is defined by confidentiality in the CIA triad of information security systems?

Prevent the intentional or unintentional unauthorized disclosure of a message's contents.

Which of the following steps is followed after the creating baselines step of vulnerability management?

Prioritizing vulnerabilities

A Web-based credit card company had collected financial and personal details of Mark before issuing him a credit card. The company has now provided Mark's financial and personal details to another company. Which of the following Internet laws has the credit card issuing company violated?

Privacy law

Which of the following encryption methods ensures authentication, confidentiality, and nonrepudiation of a message?

Private and public keys

Which of the following elements consists of formal and informal methods to get things done and provides a vital link to all of the dynamic interconnections?

Process

Tom works as the project manager for BlueWell Inc. He is working with his project to ensure timely and appropriate generation, retrieval, distribution, collection, storage, and ultimate disposition of project information. What is the process in which Tom is working?

Project communication management

Which of the following is an example of the asymmetric encryption algorithm?

RSA algorithm

Which of the following is the main necessity to implement data classification within an organization?

Recognizing data owners

You work as a CRO for BlueWell Inc. You have to work on risk reduction through the various risk management programs as defined by your team. Which of the following is the mission of risk management programs set by your team while reducing risks?

Reduce the risk to a level that the organization is willing to accept.

Which of the following processes is responsible for low risk and frequently occurring low cost changes?

Request fulfillment

You work as a security manager for uCertify Inc. Your organization keeps backup tapes of its servers at a warm site. You want to ensure that the tapes are properly maintained and usable during a system crash. Which of the following methods will you use to accomplish the task efficiently?

Retrieve the tapes from the warm site and test them.

Which of the following is a performance measure used to evaluate the efficiency of an investment or to compare the efficiency of a number of different investments?

Return on investment (ROI)

You and your project team want to perform some qualitative analysis on the risks you have identified and documented in your project web access. You would like to create a table that captures the likelihood and effect of project risk. What type of a chart or table would you like to create for the project risks?

Risk probability and impact matrix

Which internal factor will impact the risk management process?

Risk tolerance

Which of the following access control models is used to ensure that temporary employees do not receive excessive access rights?

Role-based access control

Which of the following types of attacks is the art of convincing people to disclose useful information?

SE

Which of the following is the greatest risk to information security?

Security access logs are investigated within five business days.

Which of the following roles is responsible for implementing, administering, and enforcing access rights to application data?

Security administrator

Who will be responsible for enforcing access rights to an application data and recommend the data to be hidden and protected?

Security administrator

Which of the following would be effective in successfully implementing restrictive password policies?

Security awareness program, training, and education

The number of incident reports is a good measure of the effectiveness of which of the following?

Security awareness training

Which of the following are most suitable for inclusion in an information security strategy?

Security processes, methods, tools, and techniques

You work as a network administrator for Infonet Inc. The company has 135 Windows XP Professional computers and twenty Windows 2003 Server computers. You want to specify the number of invalid logon attempts allowed before a user account is locked out. What will you do to accomplish the task?

Set the Account Lockout Threshold policy.

You work as a project manager for BlueWell, Inc. You're working with your team members on the risk responses in the project. Which risk response will likely cause a project to use the procurement processes?

Sharing

Which of the following can be used to protect a computer system from malware, viruses, spyware, and various types of keyloggers?

Sheep dip

Which of the following stages of the Forrester's IT Governance Maturity Model describes that the IT governance processes are applied across the enterprise where all business units/entities conform to the same set of IT governance processes, and IT investment decisions are based on the enterprise view?

Stage 3-Consistent

You are the project manager of the NGQQ project for your company. You're creating a stakeholder register which will help you communicate the project status to your stakeholders. All of the following information should be included in the stakeholder register except for which one?

Stakeholder management strategy

Which of the following is the most significant factor when designing enterprise information security architecture?

Stakeholder requirements

Which of the following types of firewall ensures that the packets are a part of the established session?

Stateful inspection

Reviewing the security strategy is primarily the responsibility of which of the following?

Steering committee

Which of the following domains aims to guarantee that the IT enables and supports the achievement of business objectives through the integration of IT strategic plans with business strategic plans and the alignment of IT services with enterprise operations?

Strategic alignment

IT governance is used by management to regulate information systems, to accomplish its objectives. It forms an integral part of corporate governance. Which of the following is concerned with who is making decisions, who will take part in these organizations, and what responsibilities they will assume?

Structure

John works as a security manager for SoftTech Inc. While he's working with his team on the disaster recovery management plan, one of his team members has a doubt related to the most cost effective DRP testing plan. According to you, which of the following disaster recovery testing plans is the most cost-effective and efficient way to identify areas of overlap in the plan before conducting more demanding training exercises?

Structured walk-through test

Which of the following is impacted the most when information security policies are severely enforced?

The aggregate cost of security is increased.

You work as an information security manager for uCertify, Inc. Your organization plans to contract with an outside service provider to host its corporate web site. Which of the following is the chief concern for you in the above scenario?

The contract should mandate that the service provider will comply with security policies.

You work as a CRO for BlueWell Inc. Your organization takes a decision of not acquiring any more action on a denial of service (DoS) risk found by the risk assessment team. What do you think is the most likely reason for this?

The cost of countermeasure overshadows the value of the asset and potential loss.

Jones works as an executive for uCertify Inc. He has been in a steering committee and is responsible for handling all the security projects. He needs to ensure successful information security governance within his company. Which of the following problematic concerns should he correct first?

The data center manager has empowerment of final authentication on all security projects of the company.

Which of the following statements best describes the role of a data custodian?

The data custodian implements the information classification scheme after the initial assignment by the data owner.

Which of the following statements describe the disadvantage of signature-based ID systems?

The statistical anomaly-based IDS is resource-intensive. Its database continually needs maintenance and updating with new vulnerabilities and environments to remain accurate.

What does a firewall check to prevent certain ports and applications from getting the packets into an enterprise?

The transport layer port numbers and the application layer headers

Which of the following is the main characteristic of good information security policies?

They align with organizational goals.

Which of the following is a potential security event?

Threat

Which of the following security architectures acts as an attack to exploit the difference in the time that security controls were applied and the time the authorized service was used?

Time of check to time of use (TOC/TOU)

What is the purpose of a root cause analysis?

To improve the incident response process

What is the primary goal of incident management?

To restore normal operations as soon as possible

Which of the following is the best approach that can be used to build a security program?

Top-down

Which among the following is more significant and is included in a cost-benefit analysis of a two-factor authentication system environment?

Total cost of ownership (TCO)

Which of the following principles is defined as the ability of the common layperson to understand how the system security is supposed to work so that all the stakeholders can easily see what effect their activities have on systems security?

Transparency

Which of the following is a method of encryption by which the positions held by units of plaintext are shifted according to a regular system so that the ciphertext constitutes a permutation of the plaintext?

Transposition cipher

Which of the following is the most important activity for an information security manager when it comes to regulatory issues?

Treat it like any other risk but involve HR, legal, and finance in the process.

Which of the following principles refers to a design strategy that incorporates the existence of a security mechanism whereby the identity of a user is determined by its relationship to an identity provider?

Trust

Which of the following will be required first for successfully implementing information security governance?

Updated security policies

Which of the following is a key reason for employee awareness programs with regards to information security?

Users are on the front line to detect threats.

Which of the following approaches to measure operational risk and security is used to compute the maximum probable loss in a defined period(i.e., day, week, or year)?

VAR

Which of the following is a process used to determine the actual or relative value of information assets?

Valuation process

Which of the following can help create backdoors to systems?

Wireless networks

the is descried as a statement

control objective

Which of the following is a significant area of the ISO 27001 framework?

Business continuity management

Which of the following is the most significant feature when looking at prospective applicants for the role of a chief information security officer (CISO)?

Ability to understand and map organizational requirements to security technologies

Which of the following is the best option to address the risk of data leakage?

Acceptable use policy (AUP)

Which of the following goals of Wired Equivalent Privacy (WEP) encryption can be performed in the following ways:

Access control

Which of the following is a suitable role for senior management in supporting information security?

Agreement of policy statements and funding

Which of the following risks would best be assessed using quantitative risk assessment methods?

An electrical power outage

Which of the following steps is an initial step in developing an information security strategy?

Analyze the current business strategy.

Which of the following terms related to risk management represents the estimated frequency at which a threat is expected to occur?

Annualized rate of occurrence (ARO)

Which of the following is the direct immediate advantage of clearly defined roles and responsibilities from an information security manager's perspective?

Better accountability

Which of the following roles is liable for legal and regulatory liability?

Board of directors and senior management

The incident handling process implemented in an enterprise is responsible to deal with all the incidents regarding the enterprise. Which of the following procedures will be involved by the preparation phase of the incident handling process?

Building up an incident response kit

Which of the following is the best method to justify the implementation of a single sign-on (SSO) product?

Business case

focuses on IT controls.

COBIT

You are working as a CRO for BlueWell Inc. You have to perform a quantitative risk analysis. Which of the following is the first step performed by you to estimate the potential loss?

Calculate the value of the information or asset.

You work as a CRO for BlueWell, Inc. Your organization consists of multiple, but small, domestic processing locations. Which of the following circumstances represents the maximum information security risk for your organization?

Change management measures are not sufficient.

You're working as project manager in your organization. You're nearing the final stages of project execution and looking towards the final risk monitoring and controlling activities. For your project archives, which one of the following is an output of the control risks process?

Change request

Which of the following roles should ideally have a direct reporting relationship within an organization?

Chief information security officer (CISO)

Which of the following position holders would be authorized to sponsor the formation of an information security steering group?

Chief operating officer

Which of the following is the most suitable position to sponsor the design and implementation of new security architecture in a large global enterprise?

Chief operating officer (COO)

are the net work devices

Choke routers

Which of the following options facilitates effective business continuity and disaster recovery planning by identifying the most critical and sensitive information assets?

Classification schema

Which of the following is the process that records and monitors policies, procedures, and controls needed to ensure that policies and standards are adequately adhered to?

Compliance

You work as a project manager for BlueWell, Inc. Which of the following tasks will you perform to assist the identification and prioritization of business risk?

Concentrate on the most significant areas.

You send and receive messages on the Internet. A man-in-the-middle attack can be performed to capture and read your message. Which of the following information assurance pillars ensures the security of your message or data against this type of attack?

Confidentiality

Which of the following types of controls helps in the reduction of the effect of an attack?

Corrective

Your project team has identified a project risk that has been recorded in the risk register and your team has been discussing potential risk responses for the risk event. The event is not likely to happen for several months, but its probability is high. Which of the following is a valid response to the identified risk event?

Corrective action

You work as a security manager for BlueWell Inc. You have to decide whether to accept residual risk or not. Which of the following is the most essential element on which you will decide the above task?

Cost against benefit of additional mitigating controls

Which of the following individuals in an organization is liable for the task of executing the approved protection described by the security policy and upper management?

Data custodian

Who is liable for ascertaining that information is classified?

Data owner

Who is responsible for creating risk mitigation strategies regarding entitlement changes?

Data owner

Your project spans the entire organization. You would like to assess the risk of the project, but you are worried that some managers involved in the project could affect the outcome of any risk identification meeting and also some employees would not want to publicly identify risk events that could make their supervisors look bad. You would like to implement a method that will allow participants to anonymously identify risk events. Which risk identification method could you use?

Delphi technique

Which of the following types of defenses includes logging as well as monitoring, measuring, auditing, detecting viruses, and intrusion?

Detection

You work as a security manager for uCertify Inc. Your organization has verified that its customer information was recently exposed. Which of the following steps will you take first in this regard?

Determine the extent of the compromise.

Which of the following is best to obtain senior management support for establishing a warm site?

Developing a business case

With which of the following should acceptable levels of information security risk be determined?

Die steering committee

Mark is implementing security on his e-commerce site. He wants to ensure that a customer sending a message is really the one he claims to be. Which of the following techniques will he use to ensure this?

Digital signature

Which of the following plans is a comprehensive statement of consistent actions to be taken before, during, and after a disruptive event that causes a significant loss of information systems resources?

Disaster recovery plan