<< Prev Question Next Question >>

Question 71/138

Scenario: You are the newly hired Chief Information Security Officer for a company that has not previously had a senior level security practitioner. The company lacks a defined security policy and framework for their Information Security Program. Your new boss, the Chief Financial Officer, has asked you to draft an outline of a security policy and recommend an industry/sector neutral information security control framework for implementation.
Your Corporate Information Security Policy should include which of the following?

LEAVE A REPLY

Your email address will not be published. Required fields are marked *

Question List (138q)
Question 1: What is the SECOND step to creating a risk management method...
Question 2: A new CISO just started with a company and on the CISO's des...
Question 3: Assigning the role and responsibility of Information Assuran...
Question 4: Which of the following is MOST important when dealing with a...
Question 5: SCENARIO: A Chief Information Security Officer (CISO) recent...
Question 6: A newly-hired CISO needs to understand the organization's fi...
Question 7: The ultimate goal of an IT security projects is:...
Question 8: Which International Organization for Standardization (ISO) b...
Question 9: What two methods are used to assess risk impact?...
Question 10: When managing the critical path of an IT security project, w...
Question 11: Scenario: You are the CISO and are required to brief the C-l...
Question 12: A digital signature addresses which of the following concern...
Question 13: Which of the following is the MOST important reason to measu...
Question 14: At which point should the identity access management team be...
Question 15: You are the Chief Information Security Officer of a large, m...
Question 16: What is the definition of Risk in Information Security?...
Question 17: Your organization provides open guest wireless access with n...
Question 18: How often should an environment be monitored for cyber threa...
Question 19: The effectiveness of social engineering penetration testing ...
Question 20: The Information Security Management program MUST protect:...
Question 21: The FIRST step in establishing a security governance program...
Question 22: Which of the following is used to lure attackers into false ...
Question 23: Which of the following functions evaluates risk present in I...
Question 24: A method to transfer risk is to:...
Question 25: A customer of a bank has placed a dispute on a payment for a...
Question 26: An employee successfully avoids becoming a victim of a sophi...
Question 27: Which of the following is critical in creating a security pr...
Question 28: A global retail company is creating a new compliance managem...
Question 29: A CISO has recently joined an organization with a poorly imp...
Question 30: An audit was conducted and many critical applications were f...
Question 31: SCENARIO: A Chief Information Security Officer (CISO) recent...
Question 32: Which of the following is the MOST important component of an...
Question 33: Which technology can provide a computing environment without...
Question 34: When entering into a third party vendor agreement for securi...
Question 35: Which of the following represents the BEST method for obtain...
Question 36: According to the National Institute of Standards and Technol...
Question 37: If your organization operates under a model of "assumption o...
Question 38: As the new CISO at the company you are reviewing the audit r...
Question 39: The PRIMARY objective of security awareness is to:...
Question 40: The PRIMARY objective for information security program devel...
Question 41: Scenario: Your organization employs single sign-on (user nam...
Question 42: In effort to save your company money which of the following ...
Question 43: Your incident response plan should include which of the foll...
Question 44: The single most important consideration to make when develop...
Question 45: Which of the following is the MOST important goal of risk ma...
Question 46: Risk appetite is typically determined by which of the follow...
Question 47: The security team has investigated the theft/loss of several...
Question 48: The framework that helps to define a minimum standard of pro...
Question 49: What is the MAIN reason for conflicts between Information Te...
Question 50: Which of the following is the MOST important benefit of an e...
Question 51: The CIO of an organization has decided to assign the respons...
Question 52: An organization is required to implement background checks o...
Question 53: Information security policies should be reviewed:...
Question 54: Scenario: Your corporate systems have been under constant pr...
Question 55: As the Chief Information Security Officer, you want to ensur...
Question 56: Which of the following is the MOST effective way to measure ...
Question 57: When creating a vulnerability scan schedule, who is the MOST...
Question 58: What type of attack requires the least amount of technical e...
Question 59: IT control objectives are useful to IT auditors as they prov...
Question 60: A system is designed to dynamically block offending Internet...
Question 61: An organization has a stated requirement to block certain tr...
Question 62: The process of creating a system which divides documents bas...
Question 63: Credit card information, medical data, and government record...
Question 64: What are the three hierarchically related aspects of strateg...
Question 65: What are the three stages of an identity and access manageme...
Question 66: You have implemented the new controls. What is the next step...
Question 67: Scenario: An organization has made a decision to address Inf...
Question 68: Which of the following is of MOST importance when security l...
Question 69: The implementation of anti-malware and anti-phishing control...
Question 70: Quantitative Risk Assessments have the following advantages ...
Question 71: Scenario: You are the newly hired Chief Information Security...
Question 72: Which of the following is a primary method of applying consi...
Question 73: When a critical vulnerability has been discovered on product...
Question 74: Which of the following best describes revenue?...
Question 75: This occurs when the quantity or quality of project delivera...
Question 76: The general ledger setup function in an enterprise resource ...
Question 77: At what level of governance are individual projects monitore...
Question 78: Which of the following is considered a project versus a mana...
Question 79: When an organization claims it is secure because it is PCI-D...
Question 80: Step-by-step procedures to regain normalcy in the event of a...
Question 81: A CISO has implemented a risk management capability within t...
Question 82: The establishment of a formal risk management framework and ...
Question 83: You have implemented a new security control. Which of the fo...
Question 84: Which of the following is the MOST important reason for perf...
Question 85: An international organization is planning a project to imple...
Question 86: Scenario: You are the newly hired Chief Information Security...
Question 87: As the CISO for your company you are accountable for the pro...
Question 88: You currently cannot provide for 24/7 coverage of your secur...
Question 89: When working in the Payment Card Industry (PCI), how often s...
Question 90: A CISO sees abnormally high volumes of exceptions to securit...
Question 91: A recommended method to document the respective roles of gro...
Question 92: The Security Operations Center (SOC) just purchased a new in...
Question 93: The regular review of a firewall ruleset is considered a...
Question 94: Which of the following is considered to be an IT governance ...
Question 95: What is the primary reason for performing vendor management?...
Question 96: An information security department is required to remediate ...
Question 97: In order for a CISO to have true situational awareness there...
Question 98: As a CISO you need to understand the steps that are used to ...
Question 99: An organization's Information Security Policy is of MOST imp...
Question 100: When managing the security architecture for your company you...
Question 101: When managing an Information Security Program, which of the ...
Question 102: A CISO decides to analyze the IT infrastructure to ensure se...
Question 103: You are the CISO of a commercial social media organization. ...
Question 104: Which one of the following BEST describes which member of th...
Question 105: SCENARIO: Critical servers show signs of erratic behavior wi...
Question 106: Which of the following will be MOST helpful for getting an I...
Question 107: With respect to the audit management process, management res...
Question 108: Which of the following is the MOST effective method for disc...
Question 109: As the Business Continuity Coordinator of a financial servic...
Question 110: Scenario: Your company has many encrypted telecommunications...
Question 111: The ability to hold intruders accountable in a court of law ...
Question 112: A person in your security team calls you at night and inform...
Question 113: The Annualized Loss Expectancy (Before) minus Annualized Los...
Question 114: A global health insurance company is concerned about protect...
Question 115: The alerting, monitoring and life-cycle management of securi...
Question 116: Which of the following statements about Encapsulating Securi...
Question 117: An organization has a number of Local Area Networks (LANs) l...
Question 118: The total cost of security controls should:...
Question 119: What is the main purpose of the Incident Response Team?...
Question 120: Michael starts a new job and discovers that he has unnecessa...
Question 121: A global retail organization is looking to implement a consi...
Question 122: Scenario: The new CISO was informed of all the Information S...
Question 123: The primary purpose of a risk register is to:...
Question 124: Which of the following are the MOST important factors for pr...
Question 125: An organization has defined a set of standard security contr...
Question 126: When analyzing and forecasting a capital expense budget what...
Question 127: A large number of accounts in a hardened system were suddenl...
Question 128: Which of the following illustrates an operational control pr...
Question 129: The risk found after a control has been fully implemented is...
Question 130: When a CISO considers delaying or not remediating system vul...
Question 131: When briefing senior management on the creation of a governa...
Question 132: After a risk assessment is performed, a particular risk is c...
Question 133: Which of the following provides an audit framework?...
Question 134: File Integrity Monitoring (FIM) is considered a...
Question 135: Scenario: As you begin to develop the program for your organ...
Question 136: As the CISO, you have been tasked with the execution of the ...
Question 137: Which of the following defines the boundaries and scope of a...
Question 138: Scenario: An organization has recently appointed a CISO. Thi...