Question 1

Which of the following should an organization do FIRST upon learning that a subsidiary is located in a country where civil unrest has just begun? 

A. Assess changes in the risk profile. 
B. Activate the disaster recovery plan (DRP). 
C. Invoke the incident response plan. 
D. Conduct security awareness training. 

Show Answer

Question 2

An organization finds it necessary to quickly shift to a work-fromhome model with an increased need for remote access security. Which of the following should be given immediate focus? 

A. Moving to a zero trust access model 
B. Enabling network-level authentication 
C. Enhancing cyber response capability 
D. Strengthening endpoint security 

Show Answer

Question 3

An organization plans to implement a new e-commerce operation in a highly regulated market. Which of the following is MOST important to consider when updating the risk management strategy? 

A. Strategy of industry peers 
B. Outsourcing needs 
C. Business culture
 D. Compliance requirements 

Show Answer

Question 4

Which of the following should include contact information for representatives of equipment and software vendors? 

A. Information security program charter 
B. Business impact analysis (BIA) 
C. Service level agreements (SLAs) 
D. Business continuity plan (BCP) 

Show Answer

Question 5

Which of the following activities is designed to handle a control failure that leads to a breach? 

A. Risk assessment
 B. Incident management 
C. Root cause analysis 
D. Vulnerability management 

Show Answer

Question 6

Which of the following is the MOST appropriate metric to demonstrate the effectiveness of information security controls to senior management? 

A. Downtime due to malware infections 
B. Number of security vulnerabilities uncovered with network scans 
C. Percentage of servers patched
 D. Annualized loss resulting from security incidents

Show Answer

Question 7

Which of the following is MOST important to ensuring that incident management plans are executed effectively? 

A. Management support and approval has been obtained. 
B. The incident response team has the appropriate training. 
C. An incident response maturity assessment has been conducted. 
D. A reputable managed security services provider has been engaged. 

Show Answer

Question 8

Which of the following is the MOST effective way to detect security incidents? 

A. Analyze recent security risk assessments. 
B. Analyze security anomalies. 
C. Analyze penetration test results. 
D. Analyze vulnerability assessments. 

Show Answer

Question 9

An organization is experiencing a sharp increase in incidents related to phishing messages. The root cause is an outdated email filtering system that is no longer supported by the vendor. Which of the following should be the information security manager's FIRST course of action? 

A. Reinforce security awareness practices for end users. 
B. Temporarily outsource the email system to a cloud provider. 
C. Develop a business case to replace the system. 
D. Monitor outgoing traffic on the firewall. 

Show Answer

Question 10

For which of the following is it MOST important that system administrators be restricted to read-only access? 

A. User access log files 
B. Administrator user profiles
 C. Administrator log files 
D. System logging options 

Show Answer