Podcast
Questions and Answers
When deciding the level of protection for an information asset, which factor provides the MOST guidance?
When deciding the level of protection for an information asset, which factor provides the MOST guidance?
- Impact on information security program
- Cost of controls
- Cost to replace
- Impact to business function (correct)
What is the BEST indication of information security strategy alignment with the business?
What is the BEST indication of information security strategy alignment with the business?
- Percentage of information security incidents resolved within defined service level agreements (SLAs)
- Percentage of corporate budget allocated to information security initiatives
- Number of business objectives directly supported by information security initiatives (correct)
- Number of business executives who have attended information security awareness sessions
Which analysis will BEST identify the external influences to an organization's information security?
Which analysis will BEST identify the external influences to an organization's information security?
- Gap analysis
- Threat analysis (correct)
- Vulnerability analysis
- Business impact analysis (BIA)
What is the MOST important detail to capture in an organization's risk register?
What is the MOST important detail to capture in an organization's risk register?
Who is the most appropriate role to determine access rights for specific users of an application?
Who is the most appropriate role to determine access rights for specific users of an application?
What is the best evidence to senior management that security control performance has improved?
What is the best evidence to senior management that security control performance has improved?
What is the best course of action when an online company discovers a network attack in progress?
What is the best course of action when an online company discovers a network attack in progress?
What is the best tool to monitor the effectiveness of information security governance?
What is the best tool to monitor the effectiveness of information security governance?
Who is most appropriate to own the risk associated with the failure of a privileged access control?
Who is most appropriate to own the risk associated with the failure of a privileged access control?
During the initiation phase of the system development life cycle (SDLC) for a software project, what should information security activities address?
During the initiation phase of the system development life cycle (SDLC) for a software project, what should information security activities address?
What is the most important element in achieving executive commitment to an information security governance program?
What is the most important element in achieving executive commitment to an information security governance program?
To minimize the risk of data exposure from a stolen personal mobile device, what is the best course of action?
To minimize the risk of data exposure from a stolen personal mobile device, what is the best course of action?
For aligning security operations with the IT governance framework, what is most helpful?
For aligning security operations with the IT governance framework, what is most helpful?
What are the recovery time objectives (RTOs) an output of?
What are the recovery time objectives (RTOs) an output of?
What is the primary objective of performing a post-incident review?
What is the primary objective of performing a post-incident review?
What is the best approach for managing user access permissions to ensure alignment with data classification?
What is the best approach for managing user access permissions to ensure alignment with data classification?
What is the primary reason to monitor key risk indicators (KRIs) related to information security?
What is the primary reason to monitor key risk indicators (KRIs) related to information security?
What enhances the likelihood of secure handling of information?
What enhances the likelihood of secure handling of information?
What should the information security manager first determine when updating about a security incident?
What should the information security manager first determine when updating about a security incident?
What is the best method to evaluate the effectiveness of an alternate processing site when continuous uptime is required?
What is the best method to evaluate the effectiveness of an alternate processing site when continuous uptime is required?
What is the most common legal issue associated with a transborder flow of technology-related items?
What is the most common legal issue associated with a transborder flow of technology-related items?
What should be the first step in establishing a new data protection program that must comply with applicable data privacy regulations?
What should be the first step in establishing a new data protection program that must comply with applicable data privacy regulations?
What should the content of the most effective information security training program be based on?
What should the content of the most effective information security training program be based on?
What should information security controls primarily be based on?
What should information security controls primarily be based on?
What should effective management decisions concerning information security investments be based on?
What should effective management decisions concerning information security investments be based on?
What is indicated by the information security steering committee being composed of business leaders?
What is indicated by the information security steering committee being composed of business leaders?
What did regular vulnerability scanning identify on user workstations?
What did regular vulnerability scanning identify on user workstations?
When should the security manager update details in the risk register?
When should the security manager update details in the risk register?
What is the strongest justification for granting an exception to the policy of disabling access to USB storage devices?
What is the strongest justification for granting an exception to the policy of disabling access to USB storage devices?
What is the primary goal of the eradication phase in an incident response process?
What is the primary goal of the eradication phase in an incident response process?
What should the information security manager primarily focus on when developing an RFP for a new outsourced service?
What should the information security manager primarily focus on when developing an RFP for a new outsourced service?
What has the greatest influence on the successful implementation of information security strategy goals?
What has the greatest influence on the successful implementation of information security strategy goals?
What is the best action to mitigate the risk of theft of tablets containing critical business data?
What is the best action to mitigate the risk of theft of tablets containing critical business data?
How should the security awareness program be aligned with the organization's business strategy?
How should the security awareness program be aligned with the organization's business strategy?
What should the primary basis for information security strategy be?
What should the primary basis for information security strategy be?
What is the most effective way to demonstrate alignment of information security strategy with business objectives?
What is the most effective way to demonstrate alignment of information security strategy with business objectives?
What should the incident response team document during the eradication phase?
What should the incident response team document during the eradication phase?
What should the organization's information security be aligned with to optimize security risk management?
What should the organization's information security be aligned with to optimize security risk management?
What should the organization's plans to use social networks for promotion prompt the security manager to do?
What should the organization's plans to use social networks for promotion prompt the security manager to do?
What is the main purpose of senior management review and approval of an information security strategic plan?
What is the main purpose of senior management review and approval of an information security strategic plan?
What is the most important consideration when confirming a third-party provider's compliance with an organization's information security requirements?
What is the most important consideration when confirming a third-party provider's compliance with an organization's information security requirements?
How can an organization best communicate the effectiveness of an information security governance framework to stakeholders?
How can an organization best communicate the effectiveness of an information security governance framework to stakeholders?
What is the most effective way to help ensure procurement decisions consider information security concerns when an organization increasingly uses Software as a Service (SaaS)?
What is the most effective way to help ensure procurement decisions consider information security concerns when an organization increasingly uses Software as a Service (SaaS)?
What provides the most comprehensive insight into ongoing threats facing an organization?
What provides the most comprehensive insight into ongoing threats facing an organization?
What is essential when developing a categorization method for security incidents?
What is essential when developing a categorization method for security incidents?
Who would find key performance indicators (KPIs) most useful to understand the status of information security compliance?
Who would find key performance indicators (KPIs) most useful to understand the status of information security compliance?
What is the contribution of recovery point objective (RPO) to disaster recovery?
What is the contribution of recovery point objective (RPO) to disaster recovery?
What are cybersecurity policies considered to be for an organization's management of emerging cyber risk?
What are cybersecurity policies considered to be for an organization's management of emerging cyber risk?
What represents a risk treatment option to limit the risk exposure to the business when a legacy application cannot be patched?
What represents a risk treatment option to limit the risk exposure to the business when a legacy application cannot be patched?
What should be the first action when notified of a new vulnerability affecting key data processing systems?
What should be the first action when notified of a new vulnerability affecting key data processing systems?
What is the best way to ensure the capability to restore clean data after a ransomware attack?
What is the best way to ensure the capability to restore clean data after a ransomware attack?
What should the security manager do if the organization plans to use social networks for promotion?
What should the security manager do if the organization plans to use social networks for promotion?
What should be the primary basis for the information security strategy?
What should be the primary basis for the information security strategy?
When should the information security manager update details in the risk register?
When should the information security manager update details in the risk register?
What is the most important consideration to align a security awareness program with the organization's business strategy?
What is the most important consideration to align a security awareness program with the organization's business strategy?
What is the best action to mitigate the risk of theft of tablets containing critical business data?
What is the best action to mitigate the risk of theft of tablets containing critical business data?
What should information security be aligned with to optimize security risk management?
What should information security be aligned with to optimize security risk management?
How can the alignment of information security strategy with business objectives be effectively demonstrated?
How can the alignment of information security strategy with business objectives be effectively demonstrated?
What is the strongest justification for granting an exception to the policy of disabling access to USB storage devices?
What is the strongest justification for granting an exception to the policy of disabling access to USB storage devices?
What should the incident response team document during the eradication phase?
What should the incident response team document during the eradication phase?
What is the primary goal of the eradication phase in an incident response process?
What is the primary goal of the eradication phase in an incident response process?
What should the information security manager primarily focus on when developing an RFP for a new outsourced service?
What should the information security manager primarily focus on when developing an RFP for a new outsourced service?
What has the greatest influence on the successful implementation of information security strategy goals?
What has the greatest influence on the successful implementation of information security strategy goals?
What is the main purpose of senior management review and approval of an information security strategic plan?
What is the main purpose of senior management review and approval of an information security strategic plan?
What is the most effective way to help ensure procurement decisions consider information security concerns when an organization increasingly uses Software as a Service (SaaS)?
What is the most effective way to help ensure procurement decisions consider information security concerns when an organization increasingly uses Software as a Service (SaaS)?
What is the best way to ensure the capability to restore clean data after a ransomware attack?
What is the best way to ensure the capability to restore clean data after a ransomware attack?
What is the main contribution of recovery point objective (RPO) to disaster recovery?
What is the main contribution of recovery point objective (RPO) to disaster recovery?
What is essential when developing a categorization method for security incidents?
What is essential when developing a categorization method for security incidents?
What would be most useful to help senior management understand the status of information security compliance?
What would be most useful to help senior management understand the status of information security compliance?
What represents a risk treatment option to limit the risk exposure to the business when a legacy application cannot be patched?
What represents a risk treatment option to limit the risk exposure to the business when a legacy application cannot be patched?
When notified of a new vulnerability affecting key data processing systems, what should be the first action?
When notified of a new vulnerability affecting key data processing systems, what should be the first action?
What is the best enabler for an organization to effectively manage emerging cyber risk?
What is the best enabler for an organization to effectively manage emerging cyber risk?
What is the most comprehensive insight into ongoing threats facing an organization?
What is the most comprehensive insight into ongoing threats facing an organization?
What is the most important element to communicate the effectiveness of an information security governance framework to stakeholders?
What is the most important element to communicate the effectiveness of an information security governance framework to stakeholders?
What is the best action to take to confirm a third-party provider's compliance with an organization's information security requirements?
What is the best action to take to confirm a third-party provider's compliance with an organization's information security requirements?
Flashcards are hidden until you start studying
Study Notes
Information Security Management Summary
- Organization plans to use social networks for promotion, security manager's best course of action is to assess security risks.
- Primary basis for information security strategy should be the organization's vision and mission.
- When senior management accepts risk of noncompliance, the information security manager should update details in the risk register.
- To align a security awareness program with the organization's business strategy, the most important consideration is people and culture.
- To mitigate the risk of theft of tablets containing critical business data, the best action is to conduct a mobile device risk assessment.
- Information security should be aligned with the organization's strategy to optimize security risk management.
- To demonstrate alignment of information security strategy with business objectives, the most effective way is to use a balanced scorecard.
- Strongest justification for granting an exception to the policy of disabling access to USB storage devices is that the benefit is greater than the potential risk.
- Incident response team should document actions required to remove the threat during the eradication phase.
- The primary goal of the eradication phase in an incident response process is to remove the threat and restore affected systems.
- Information security manager developing an RFP for a new outsourced service should focus primarily on defining security requirements for the process being outsourced.
- Management support has the greatest influence on the successful implementation of information security strategy goals.
Information Security Management Questions and Answers Summary
- Senior management review and approval of an information security strategic plan is mainly to ensure the plan aligns with corporate governance.
- To confirm a third-party provider's compliance with an organization's information security requirements, it is most important to ensure the right to audit is included in the service level agreement (SLA).
- To communicate the effectiveness of an information security governance framework to stakeholders, it is most important to establish metrics for each milestone.
- When an organization increasingly uses Software as a Service (SaaS), integrating information security risk assessments into the procurement process is the most effective way to help ensure procurement decisions consider information security concerns.
- The most comprehensive insight into ongoing threats facing an organization is provided by the risk register.
- When developing a categorization method for security incidents, the categories must have agreed-upon definitions.
- Key performance indicators (KPIs) would be most useful to help senior management understand the status of information security compliance.
- The contribution of recovery point objective (RPO) to disaster recovery is to define backup strategy.
- Cybersecurity policies are the best enablers for an organization to effectively manage emerging cyber risk.
- To limit the risk exposure to the business when a legacy application cannot be patched, a firewall is implemented in front of the legacy application, representing a risk treatment option of mitigate.
- When notified of a new vulnerability affecting key data processing systems, re-evaluating the risk should be the first action.
- The best way to ensure the capability to restore clean data after a ransomware attack is to maintain multiple offline backups.
Studying That Suits You
Use AI to generate personalized quizzes and flashcards to suit your learning preferences.
