Question 1

How might the effectiveness of a security awareness program be effectively measured? 1)Employees are required to take an online multiple choice exam on security principles.2)Employees are tested with social engineering techniques by an approved penetration tester. 3)Employees practice ethical hacking techniques on organisation systems.4)No security vulnerabilities are reported during an audit. 5)Open source intelligence gathering is undertaken on staff social media profiles.

A. 3, 4 and 5.
B. 2, 4 and 5.
C. 1, 2 and 3.
D. 1, 2 and 5.

Show Answer

Question 2

Which of the following types of organisation could be considered the MOST at risk from the theft of electronic based credit card data?

A. Online retailer.
B. Traditional market trader.
C. Mail delivery business.
D. Agricultural producer.

Show Answer

Question 3

Why might the reporting of security incidents that involve personaldata differ from other types of security incident?

A. Personal data is not highly transient so its 1 investigation rarely involves the preservation of volatile memory and full forensic digitalinvestigation.
B. Personal data is normally handled on both IT and non-IT systems so such incidents need to be managed in two streams.
C. Data Protection legislation normally requires the reporting of incidents involving personal data to a Supervisory Authority.
D. Data Protection legislation is process-oriented and focuses on quality assurance of procedures and governance rather thandata-focused event investigation

Show Answer

Question 4

As well as being permitted to access, create, modify and delete information, what right does an Information Owner NORMALLY have in regardto their information?

A. To assign access privileges to others.
B. To modify associated information that may lead to inappropriate disclosure.
C. To access information held in the same format and file structure.
D. To delete all indexed data in the dataset.

Show Answer

Question 5

Which of the following subjects is UNLIKELY to form part of a cloud service provision laaS contract?

A User security education.
B. Intellectual Property Rights.
C. End-of-service.
D. Liability

Show Answer

Question 6

In a security governance framework, which of the following publications would be at the HIGHEST level?

A. Procedures.
B. Standards
C. Policy.
D. Guidelines

Show Answer

Question 7

What aspect of an employee's contract of employment Is designed to prevent the unauthorised release of confidential data to third parties evenafter an employee has left their employment?

A. Segregation of Duties.
B. Non-disclosure.
C. Acceptable use policy.
D. Security clearance.

Show Answer

Question 8

One traditional use of a SIEM appliance is to monitor for exceptions received via syslog.What system from the following does NOT natively support syslog events?

A. Enterprise Wireless Access Point.
B. Windows Desktop Systems.
C. Linux Web Server Appliances.
D. Enterprise Stateful Firewall.

Show Answer

Question 9

When preserving a crime scene for digital evidence, what actions SHOULD a first responder initially make?

A. Remove power from all digital devices at the scene to stop the data changing.
B. Photograph all evidence and triage to determine whether live data capture is necessary.
C. Remove all digital evidence from the scene to prevent unintentional damage.
D. Don't touch any evidence until a senior digital investigator arrives.

Show Answer

Question 10

Geoff wants to ensure the application of consistent security settings to devices used throughout his organisation whether as part of a mobilecomputing or a BYOD approach.What technology would be MOST beneficial to his organisation?

A. VPN.
B. IDS.
C. MDM.
D. SIEM.

Show Answer