NEW QUESTION 81
Which of the following functions evaluates risk present in IT initiatives and/or systems when implementing an information security program?

NEW QUESTION 82
When working in the Payment Card Industry (PCI), how often should security logs be review to comply with the standards?

NEW QUESTION 83
SCENARIO: A Chief Information Security Officer (CISO) recently had a third party conduct an audit of the security program. Internal policies and international standards were used as audit baselines. The audit report was presented to the CISO and a variety of high, medium and low rated gaps were identified.
Which of the following is the FIRST action the CISO will perform after receiving the audit report?

NEW QUESTION 84
Which of the following is critical in creating a security program aligned with an organization’s goals?

NEW QUESTION 85
Which of the following is the MOST important reason for performing assessments of the security portfolio?

NEW QUESTION 86
When entering into a third party vendor agreement for security services, at what point in the process is it BEST to understand and validate the security posture and compliance level of the vendor?

NEW QUESTION 87
The security team has investigated the theft/loss of several unencrypted laptop computers containing sensitive corporate information. To prevent the loss of any additional corporate data it is unilaterally decided by the CISO that all existing and future laptop computers will be encrypted. Soon, the help desk is flooded with complaints about the slow performance of the laptops and users are upset. What did the CISO do wrong?
(choose the BEST answer):

NEW QUESTION 88
The PRIMARY objective of security awareness is to:

NEW QUESTION 89
An organization information security policy serves to

NEW QUESTION 90
Which represents PROPER separation of duties in the corporate environment?

NEW QUESTION 91
Scenario: Your organization employs single sign-on (user name and password only) as a convenience to your employees to access organizational systems and data. Permission to individual systems and databases is vetted and approved through supervisors and data owners to ensure that only approved personnel can use particular applications or retrieve information. All employees have access to their own human resource information, including the ability to change their bank routing and account information and other personal details through the Employee Self-Service application. All employees have access to the organizational VPN.
What type of control is being implemented by supervisors and data owners?

NEW QUESTION 92
Scenario: An organization has made a decision to address Information Security formally and consistently by adopting established best practices and industry standards. The organization is a small retail merchant but it is expected to grow to a global customer base of many millions of customers in just a few years.
The organization has already been subject to a significant amount of credit card fraud. Which of the following is the MOST likely reason for this fraud?

NEW QUESTION 93
Scenario: You are the newly hired Chief Information Security Officer for a company that has not previously had a senior level security practitioner. The company lacks a defined security policy and framework for their Information Security Program. Your new boss, the Chief Financial Officer, has asked you to draft an outline of a security policy and recommend an industry/sector neutral information security control framework for implementation.
Which of the following industry / sector neutral information security control frameworks should you recommend for implementation?

NEW QUESTION 94
The establishment of a formal risk management framework and system authorization program is essential. The LAST step of the system authorization process is:

NEW QUESTION 95
Which of the following is MOST important when tuning an Intrusion Detection System (IDS)?

NEW QUESTION 96
An organization has defined a set of standard security controls. This organization has also defined the circumstances and conditions in which they must be applied. What is the NEXT logical step in applying the controls in the organization?

NEW QUESTION 97
When should IT security project management be outsourced?

NEW QUESTION 98
Which type of physical security control scan a person’s external features through a digital video camera before granting access to a restricted area?

NEW QUESTION 99
The effectiveness of social engineering penetration testing using phishing can be used as a Key Performance Indicator (KPI) for the effectiveness of an organization’s

NEW QUESTION 100
The Information Security Governance program MUST:

NEW QUESTION 101
A CISO implements smart cards for credential management, and as a result has reduced costs associated with help desk operations supporting password resets. This demonstrates which of the following principles?

NEW QUESTION 102
When a critical vulnerability has been discovered on production systems and needs to be fixed immediately, what is the BEST approach for a CISO to mitigate the vulnerability under tight budget constraints?

NEW QUESTION 103
Which of the following most commonly falls within the scope of an information security governance steering committee?