152 free EC-Council 712-50 CCISO practice questions from the CertStash pack of 606, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 152 free here, all 606 in the pack, and each step includes the one before it.
Get all 606 questions (US$39) · Download the first 10 as a PDF
Question 1
When briefing senior management on the creation of a governance process, the MOST important aspect should be:
Show answer and explanation
Correct answer: C. linkage to business area objectives
Senior management evaluates every initiative by how it advances the goals of the business, so a briefing on a new governance process must show its linkage to business area objectives. When executives see that governance supports strategy, protects revenue and enables business units, they provide the sponsorship, funding and authority the process needs. Metrics, baselines and analytical skills are details of execution that only become meaningful once the process is anchored to business objectives, which is why alignment is the first message to deliver to leadership.
Why the other options are wrong
- A. The knowledge needed to analyze each issue is an operational staffing matter, not what persuades executives to support a governance process.
- B. Security metrics measure the process after it exists and do not explain to executives why the process serves the business.
- D. A baseline for evaluating metrics is a measurement detail that has no meaning to leadership until business linkage is established.
Question 2
Which of the following should be determined while defining risk management strategies?
Show answer and explanation
Correct answer: A. Organizational objectives and risk tolerance
A risk management strategy sets the direction for how the organization will frame, assess, respond to and monitor risk, and it must start from what the business is trying to achieve and how much risk it is willing to bear. Organizational objectives identify which risks matter, while risk tolerance defines the acceptable variation around those objectives and guides every later treatment decision. Frameworks such as NIST SP 800-39 and ISO 31000 place this context setting at the start of the process, before assessment criteria, recovery plans or technical considerations are addressed.
Why the other options are wrong
- B. Enterprise disaster recovery plans are operational outputs developed after the strategy and the business impact analysis, not inputs to the strategy.
- C. Risk assessment criteria are derived from the objectives and risk tolerance already set by the strategy.
- D. IT architecture complexity is a technical factor considered during assessment, not a strategic determinant of how the business manages risk.
Question 3
Which of the following is the MOST important benefit of an effective security governance process?
Show answer and explanation
Correct answer: D. Reduction of liability and overall risk to the organization
Security governance exists so that the board and senior management can direct and oversee information risk in line with business objectives and legal duties. Its most important benefit is therefore the reduction of liability and overall risk to the organization, which demonstrates due care and protects the enterprise as a whole. Fewer breaches, better vendor oversight and executive involvement in incidents are narrower results that contribute to this broader outcome, but the governing body measures success by overall risk exposure and legal liability.
Why the other options are wrong
- A. Senior management participation in incident response is an operational activity, not the primary benefit governance delivers.
- B. Better vendor management is a narrow functional improvement that does not represent the overall value of governance.
- C. Reduction of security breaches is a single operational outcome that is narrower than the reduction of overall risk and liability.
Question 4
A global retail organization is looking to implement a consistent Disaster Recovery and Business Continuity Process across all of its business units.
Which of the following standards and guidelines can BEST address this organization's need?
Show answer and explanation
Correct answer: A. International Organization for Standardization 22301 (ISO-22301)
ISO 22301 specifies the requirements for a business continuity management system, covering the business impact analysis, continuity strategies, plans, exercising and continual improvement. Because it is an international management system standard, a global retail organization can apply it uniformly across every business unit and country, producing a consistent and auditable approach to continuity and disaster recovery. It is the only option whose entire purpose is organizational resilience and recovery from disruption, which is exactly the need described.
Why the other options are wrong
- B. ITIL is an IT service management framework whose continuity practice covers IT services, not an enterprise business continuity management system.
- C. PCI DSS protects payment cardholder data and does not define business continuity or disaster recovery processes.
- D. ISO 27005 provides guidance on information security risk management, not on business continuity management.
Question 5
A security manager regularly checks work areas after business hours for security violations, such as unsecured files or unattended computers with active sessions.
This activity BEST demonstrates what part of a security program?
Show answer and explanation
Correct answer: A. Compliance management
Walking work areas after hours to find unsecured files and unattended computers with active sessions is a routine check that employees are following clean desk and workstation locking policies. Verifying ongoing adherence to established security rules, and acting on the violations found, is the essence of compliance management. The activity is performed regularly by the security manager as part of day-to-day program operation rather than as a formal, independent audit or a test of a specific physical safeguard.
Why the other options are wrong
- B. Audit validation is a formal, planned and independent evaluation, not a routine walkthrough by the security manager.
- C. Physical control testing evaluates whether physical safeguards such as locks and badges work, not whether staff follow desk and session policies.
- D. Security awareness training educates employees, whereas this activity monitors their actual behavior against policy.
Question 6
Which of the following is the MAIN reason to follow a formal risk management process in an organization that hosts and uses personally identifiable information (PII) as part of their business models and processes?
Show answer and explanation
Correct answer: D. Need to better understand the risk associated with using PII data
A formal risk management process exists to identify, analyze and evaluate risk so that the organization understands its exposure and can make informed treatment decisions. For a business whose model depends on hosting and using personally identifiable information, the main reason to follow such a process is to better understand the risks that come with that data. Once those risks are understood, the organization can choose appropriate responses, including controls, insurance or compliance measures, in proportion to the actual exposure.
Why the other options are wrong
- A. Compliance with breach disclosure laws is one obligation that a risk process informs, not the main reason for having the process.
- B. Credit information is only one type of PII, so a duty to safeguard it does not explain the purpose of the overall process.
- C. Risk transfer is one possible treatment chosen after risk is understood, not the reason for performing risk management.
Question 7
A method to transfer risk is to______________.
Show answer and explanation
Correct answer: D. Purchase breach insurance
Risk transfer shifts the financial consequences of a risk to another party, most commonly through insurance or contractual arrangements. Purchasing breach insurance means the insurer absorbs some or all of the financial loss from a covered security incident, which is the classic example of transfer. Accountability for protecting the data still remains with the organization, but the monetary impact is shared with the insurer. The other options either reduce the likelihood or impact of the risk or are not risk responses at all.
Why the other options are wrong
- A. Implementing redundancy reduces the impact of failures, which is risk mitigation rather than transfer.
- B. Moving operations to another region changes or avoids exposure to a location-specific threat but does not shift the risk to a third party.
- C. Aligning to business operations is a strategic principle, not a risk response option.
Question 8
An organization licenses and uses personal information for business operations, and a server containing that information has been compromised.
What kind of law would require notifying the owner or licensee of this incident?
Show answer and explanation
Correct answer: B. Data breach disclosure
Data breach disclosure laws require an organization that suffers unauthorized access to personal information to notify the affected parties, and when the organization only licenses or maintains the data, to notify the owner or licensee of that data. A compromised server holding licensed personal information is precisely the event these laws address. Such statutes exist in many jurisdictions, including every US state and under regulations such as GDPR, and they define the triggering event, the parties to be notified and the expected timing.
Why the other options are wrong
- A. Consumer right disclosure is not the recognized category of law that mandates notification after personal data is compromised.
- C. Special circumstance disclosure is not a recognized category of breach notification law.
- D. Security incident disclosure is too broad, since notification duties are triggered by compromise of personal data rather than by every security incident.
Question 9
Why is it vitally important that senior management endorse a security policy?
Show answer and explanation
Correct answer: D. So that they will accept ownership for security within the organization.
A security policy is the formal voice of management, and its endorsement by senior leadership signals that executives accept ownership of security for the organization. Ownership at the top drives accountability, resource allocation and enforcement, and it makes clear that protecting information is a business responsibility rather than a purely technical one. Employee compliance, external confidence and clear accountability all follow from this executive ownership, which is why it is the essential reason for endorsement.
Why the other options are wrong
- A. Employee compliance is a downstream effect of management ownership and enforcement, not the fundamental reason for endorsement.
- B. Senior management carries legal duties of care whether or not it signs a policy, so endorsement does not exist to create legal accountability.
- C. External recognition is a side effect, while endorsement matters primarily for internal ownership of security.
Question 10
Which of the following is of MOST importance when security leaders of an organization are required to align security to influence the culture of an organization?
Show answer and explanation
Correct answer: A. Understand the business goals of the organization
Security leaders influence organizational culture by showing how security helps the business succeed, and that requires a clear understanding of the business goals of the organization. When security initiatives are framed in terms of revenue, customer trust and strategic objectives, executives and employees see security as an enabler and adopt it in daily behavior. Technical, audit and regulatory knowledge support the program, but without business understanding a security leader cannot align security with what the organization values and therefore cannot shape its culture.
Why the other options are wrong
- B. A strong technical background does not enable a leader to connect security to the priorities that shape organizational culture.
- C. A strong auditing background centers on verifying controls, not on aligning security with business goals to influence culture.
- D. Regulations are only one input, and understanding them does not by itself align security with the business or shape culture.
What people say about the full 712-50 pack 5.0 from 1
This material was written in simple words, making it easy for anyone to study. It helped me prepare calmly and revise effectively.
Question 11
The Security Operations Center (SOC) just purchased a new intrusion prevention system (IPS) that needs to be deployed in-line for best defense.
The IT group is concerned about putting the new IPS in-line because it might negatively impact network availability.
What would be the BEST approach for the CISO to reassure the IT group?
Show answer and explanation
Correct answer: C. Explain to the IT group that the IPS will fail open once in-line however it will be deployed in monitor mode for a set period of time to ensure that it doesn't block any legitimate traffic
The IT group's concern about availability is legitimate and is best addressed with facts and a controlled rollout. Explaining that the IPS fails open shows that a device failure will not cut off traffic, and running it in monitor mode for a set period lets the team observe what it would block and tune its rules before enforcement begins. This phased approach protects availability, builds trust with IT, and still delivers in-line protection once confidence is established.
Why the other options are wrong
- A. Accepting responsibility for a failure does nothing to prevent the network impact the IT group is worried about.
- B. Promising no network impact without any validation is an unsupported assurance that undermines credibility.
- D. Fail-open behavior covers device failure but not legitimate traffic being blocked by untuned rules.
Question 12
The success of the Chief Information Security Officer is MOST dependent upon:
Show answer and explanation
Correct answer: D. development of relationships with organization executives
The CISO's success depends most on strong relationships with the organization's executives. Executive support provides funding, authority and sponsorship for the security program. It is also how security is tied to business objectives and how risk decisions are made by the people who own the risk. With executive trust, the CISO can influence strategy, get policies enforced and get resources when priorities change. Without it, even a well-designed program has trouble getting adopted.
Why the other options are wrong
- A. Consultants give advice, but the CISO must make judgments that fit the business, and following outside recommendations does not create organizational support.
- B. End-user awareness is one program activity and depends on executive backing to be funded and enforced.
- C. Favorable audit findings are a result of a well-run program, not what the CISO's success mainly depends on.
Question 13
A security manager has created a risk program.
Which of the following is a critical part of ensuring the program is successful?
Show answer and explanation
Correct answer: C. Providing a risk program governance structure
A risk program succeeds only when it has a governance structure that defines roles, decision rights, escalation paths and oversight. Governance establishes who owns each risk, who may accept it, how often risks are reviewed and how results are reported to senior management. That structure gives the program authority and consistency across the organization, so that assessments lead to actual decisions and actions. Templates and coding practices are operational tools that depend on governance to be used effectively.
Why the other options are wrong
- A. Risk control comments in code are a narrow development practice, not a factor in the success of an enterprise risk program.
- B. Threat-specific assessment templates are operational tools that do not provide the authority and accountability a program needs.
- D. Regulatory compliance requirements generally cannot be waived through risk acceptance, so this does not support program success.
Question 14
Network Forensics is the prerequisite for any successful legal action after attacks on your Enterprise Network.
Which is the single most important factor to introducing digital evidence into a court of law?
Show answer and explanation
Correct answer: C. Uninterrupted Chain of Custody
An uninterrupted chain of custody is the single most important factor for introducing digital evidence into court. Digital evidence is easy to alter, so the organization must prove, through documented records of who collected, handled, transferred and stored it, along with hash values, that the evidence presented is exactly what was collected. Any gap in that record lets opposing counsel challenge its integrity, and the evidence may be excluded or given little weight no matter how strong its content.
Why the other options are wrong
- A. An expert witness can explain evidence, but testimony cannot make evidence with a broken chain of custody trustworthy.
- B. Fast analysis by trained staff is valuable, yet the results are still challengeable if handling of the evidence is not documented.
- D. Logs are useful evidence only when their integrity and handling can be proven through chain of custody.
Question 15
In MOST organizations which group periodically reviews network intrusion detection system logs for all systems as part of their daily tasks?
Show answer and explanation
Correct answer: B. Information Security
In most organizations, Information Security reviews network intrusion detection system logs for all systems as a daily task, often through a security operations center. Reviewing these logs regularly is an operational detective control. It lets the team spot suspicious activity, investigate alerts and start incident response quickly. Information Security has the technical skills and the mandate to interpret intrusion data across the whole environment. Oversight functions check that the monitoring takes place, and system-specific teams look after their own platforms.
Why the other options are wrong
- A. Internal Audit independently checks that monitoring controls work, and reviewing logs day to day would compromise that independence.
- C. Compliance checks adherence to requirements and does not do the daily operational review of intrusion detection logs.
- D. Database Administration looks after database platforms and is not responsible for reviewing network intrusion detection logs across all systems.
Question 16
One of the MAIN goals of a Business Continuity Plan is to_______________.
Show answer and explanation
Correct answer: C. Provide step by step plans to recover business processes in the event of a disaster
A business continuity plan documents how the organization will continue or recover its critical business processes after a disruption, and one of its main goals is to provide step-by-step plans for that recovery. Priorities come from the business impact analysis, so the most critical processes are restored first within their recovery time objectives. Technical recovery of systems and data is covered by the disaster recovery plan, which supports the business continuity plan, while the business continuity plan itself remains focused on business processes.
Why the other options are wrong
- A. Making all infrastructure and applications available is neither realistic nor the aim, since recovery is prioritized according to the business impact analysis.
- B. Assigning technical teams to recover data belongs to the disaster recovery plan, not the main goal of business continuity.
- D. Defining roles for technical first responders is an IT and incident response matter, not the business process focus of the plan.
Question 17
Which of the following are primary concerns for management with regard to assessing internal control objectives?
Show answer and explanation
Correct answer: B. Compliance, Effectiveness, Efficiency
Internal control frameworks such as COSO define internal control as a process designed to provide reasonable assurance about objectives of effectiveness and efficiency of operations, reliability of reporting and compliance with applicable laws and regulations. When management assesses internal control objectives, its primary concerns are therefore compliance, effectiveness and efficiency. These are business-level objectives that apply across the organization, which distinguishes them from the narrower security properties used to describe protection of information.
Why the other options are wrong
- A. Confidentiality, integrity and availability describe information security properties, not management's internal control objectives.
- C. Communication and cost are not core internal control objectives, and reliability alone omits compliance and effectiveness.
- D. Confidentiality is a security property and cost is not a primary internal control objective.
Question 18
Which of the following is the MOST important goal of risk management?
Show answer and explanation
Correct answer: A. Finding economic balance between the impact of the risk and the cost of the control
The most important goal of risk management is to find the economic balance between the impact of a risk and the cost of controlling it. Eliminating all risk is impossible and uneconomic, so the aim is to reduce risk to a level within the organization's risk tolerance at a justified cost. Identifying risks and assessing threat impact are necessary steps in the process, but they serve this ultimate goal of cost-effective risk treatment that supports business objectives.
Why the other options are wrong
- B. Identifying potential victims of exploits is not a recognized goal of risk management.
- C. Identifying risk is an early step in the process, not its ultimate goal.
- D. Assessing the impact of threats is part of risk analysis and serves the larger goal of cost-effective treatment.
Question 19
When is an application security development project complete?
Show answer and explanation
Correct answer: D. When the application is retired.
Security in application development follows the full system development life cycle, from initiation through development, implementation, operation and maintenance, and finally disposal. Security obligations continue while the application is in production and maintenance, because new vulnerabilities, patches and changes keep arising. The work is complete only when the application is retired and its data and components are securely disposed of. Viewing security as lifecycle-long prevents the common failure of treating deployment as the end of security responsibility.
Why the other options are wrong
- A. Turning the application over to production begins the operational phase, during which security work continues.
- B. A one-year period is arbitrary and has no relationship to the application lifecycle.
- C. Maintenance is an ongoing phase that requires continued patching and security review, so the work is not complete.
Question 20
A customer of a bank has placed a dispute on a payment for a credit card account. The banking system uses digital signatures to safeguard the integrity of their transactions. The bank claims that the system shows proof that the customer in fact made the payment.
What is this system capability commonly known as?
Show answer and explanation
Correct answer: C. non-repudiation
Non-repudiation is the capability that prevents a party from credibly denying an action they performed. A digital signature is created with the signer's private key, which only the signer should hold, and anyone can verify it with the matching public key. Because the signature is bound to both the signer and the exact transaction data, the bank can show that the customer authorized that specific payment and that it was not altered afterward, which defeats the customer's denial.
Why the other options are wrong
- A. Conflict resolution is a business or legal process for settling disputes, not a security property of the system.
- B. Strong authentication verifies identity at login but does not by itself prove who authorized a specific transaction.
- D. Digital rights management controls the use and copying of digital content, not proof of a transaction.
Question 21
When would it be more desirable to develop a set of decentralized security policies and procedures within an enterprise environment?
Show answer and explanation
Correct answer: D. When the enterprise is made up of many business units with diverse business activities, risks profiles and regulatory requirements.
Decentralized security policies and procedures make sense when an enterprise is made up of many business units whose activities, risk profiles and regulatory requirements differ significantly. A single centralized set may not fit each unit, so allowing units to tailor their own policies and procedures, within an enterprise-wide framework of principles and minimum standards, lets each one address the laws and risks that actually apply to it while still supporting overall governance.
Why the other options are wrong
- A. A variety of technologies is handled through technology-specific standards, not by decentralizing policy.
- B. Decentralization usually duplicates effort and raises cost, so lower cost favors centralization.
- C. A unified incident response capability depends on central coordination, which decentralization works against.
Question 22
The Annualized Loss Expectancy (Before) minus Annualized Loss Expectancy (After) minus Annual Safeguard Cost is the formula for determining:
Show answer and explanation
Correct answer: D. Cost Benefit Analysis
The calculation of annualized loss expectancy before a safeguard, minus annualized loss expectancy after the safeguard, minus the annual cost of the safeguard is the cost benefit analysis formula used in quantitative risk management. For example, an ALE of 100,000 before, 20,000 after and an annual safeguard cost of 30,000 gives 100,000 minus 20,000 minus 30,000, or a net benefit of 50,000. A positive result shows the safeguard is cost justified, while a negative result shows it costs more than the loss it prevents.
Why the other options are wrong
- A. Single loss expectancy is asset value multiplied by exposure factor and represents the loss from one occurrence.
- B. Life cycle loss expectancy is not a recognized quantitative risk formula.
- C. Safeguard value is not the name of this analysis; the formula is the cost benefit analysis used to justify a control.
Question 23
Access Control lists (ACLs), Firewalls, and Intrusion Prevention Systems are examples of________________.
Show answer and explanation
Correct answer: D. Network based security preventative controls
Access control lists, firewalls and intrusion prevention systems are network-based preventive controls. Each one enforces rules on traffic as it crosses the network and blocks connections or packets that are not permitted or that match malicious patterns, stopping an attack before it reaches its target. They form key layers of defense in depth at network boundaries and between segments. Detective controls, such as an intrusion detection system or log monitoring, only identify activity and alert on it after it occurs.
Why the other options are wrong
- A. User segmentation groups people by role or access needs, while these devices filter network traffic.
- B. These devices operate on network traffic rather than separating software components or applications.
- C. These devices actively block traffic, which makes them preventive rather than detective controls.
Question 24
Which of the following represents the BEST method for obtaining business unit acceptance of security controls within an organization?
Show answer and explanation
Correct answer: B. Ensure business units are involved in the creation of controls and defining conditions under which they must be applied
Business units accept security controls most readily when they have helped shape them. Involving them in creating controls and in defining the conditions under which controls must be applied ensures the controls reflect operational realities, minimizes unnecessary disruption to business processes, and gives the business a sense of ownership. This collaborative approach produces controls that are both effective and practical, leading to consistent adoption rather than resistance or workarounds.
Why the other options are wrong
- A. Letting business units pick their own controls invites inconsistent protection and the omission of controls such as encryption.
- C. Imposing mandates backed by audits secures compliance through pressure rather than genuine acceptance.
- D. Separate controls for each business type fragment the control framework and make it harder to manage.
Question 25
Which of the following are necessary to formulate responses to external audit findings?
Show answer and explanation
Correct answer: A. Technical Staff, Budget Authority, Management
Responding to external audit findings requires three capabilities. Technical staff understand the finding and define a practical remediation, the budget authority commits the funding needed to carry it out, and management accepts accountability, approves the plan and sets target dates or formally accepts the risk. Together they produce a credible management response. Internal audit must remain independent of management decisions, so it may later verify remediation but does not formulate the organization's response to findings.
Why the other options are wrong
- B. Internal audit must stay independent and should not formulate responses, and this set omits management accountability.
- C. This set omits the technical staff needed to define remediation and includes internal audit, which must remain independent.
- D. This set omits the budget authority needed to fund remediation and includes internal audit, which must remain independent.
Question 26
If your organization operates under a model of "assumption of breach", you should:
Show answer and explanation
Correct answer: C. Focus your security efforts on high value assets
An assumption of breach model accepts that attackers will get in, or already have, so the goal shifts from keeping everyone out to limiting the damage when they do. Since resources are finite, the organization concentrates protection, monitoring, segmentation and response capability on its high value assets, the systems and data whose compromise would cause the greatest business harm. This risk-based prioritization makes sure the most critical assets are hardest to reach and fastest to recover.
Why the other options are wrong
- A. Firewall monitoring is a perimeter tactic, while assumption of breach presumes the perimeter has already been bypassed.
- B. Insurance transfers some financial loss but does not direct security effort or reduce the harm of a breach.
- D. Protecting all assets equally wastes limited resources and ignores the value-based prioritization this model requires.
Question 27
The Information Security Management program MUST protect:
Show answer and explanation
Correct answer: D. critical business processes and revenue streams
An information security management program exists to support the business, so its essential mandate is to protect the critical business processes and revenue streams that keep the organization operating. Security resources are finite, and a risk-based program prioritizes protection according to business impact rather than trying to protect everything equally. Tying the program to critical processes and revenue keeps it aligned with business objectives, earns senior management support, and guides where controls and spending deliver the greatest value.
Why the other options are wrong
- A. Audit schedules and findings are governance records that the program produces and uses, not the core of what it exists to protect.
- B. Intellectual property already released into the public domain no longer has confidentiality value that requires protection.
- C. Protecting every asset equally is neither feasible nor risk based, because protection must be prioritized by business impact and value.
Question 28
Which of the following provides an independent assessment of a vendor's internal security controls and overall posture?
Show answer and explanation
Correct answer: A. ISO27000 accreditation
ISO/IEC 27001 certification, often loosely called ISO 27000 accreditation, is granted only after an accredited third-party certification body audits the vendor's information security management system and its controls. Surveillance audits then continue on a regular cycle. Because the assessment is independent and covers the management system that governs the vendor's security program, it provides assurance about overall security posture rather than a single area. A CISO can rely on it, together with a review of the certificate scope, during vendor due diligence.
Why the other options are wrong
- B. Alignment with business goals is a strategic consideration and not an independent evaluation of a vendor's security controls.
- C. A PCI attestation of compliance covers only the cardholder data environment and may be based on self-assessment, so it does not reflect overall posture.
- D. Financial statements describe financial position and performance and provide no assessment of security controls.
Question 29
When dealing with Security Incident Response procedures, which of the following steps come FIRST when reacting to an incident?
Show answer and explanation
Correct answer: C. Containment
Once an incident has been detected and confirmed, the first reactive step is containment, which limits the spread of the attack and the resulting damage while preserving evidence. NIST SP 800-61 groups containment, eradication and recovery into one phase that follows detection and analysis, with containment performed first so that responders gain time to plan removal of the threat. Eradication then removes the cause, and recovery restores systems to normal operation, so both depend on the incident first being contained.
Why the other options are wrong
- A. Eradication removes the cause of the incident and is performed only after the incident has been contained.
- B. Escalation is a communication activity that supports the response rather than the first step in reacting to the incident itself.
- D. Recovery restores normal operations and comes last, after containment and eradication.
Question 30
An organization's information security policy serves to___________________.
Show answer and explanation
Correct answer: C. establish acceptable systems and user behavior
An information security policy is a high-level management statement that sets the organization's security objectives and defines what is acceptable for systems and for users. It states what must be done and who is accountable, it reflects senior management's intent, and it gives the authority for the standards, procedures and guidelines that follow. Detailed configurations, budget figures and arrangements with outside agencies belong in lower-level documents or other management processes. Keeping the policy at the level of acceptable behavior allows it to stay stable while the technical details change.
Why the other options are wrong
- A. Security configurations for systems are set out in standards and baselines that support the policy, not in the policy itself.
- B. Budget input comes from strategic planning and the business case, not from the information security policy.
- D. Relationships with law enforcement are handled in incident response plans and procedures, not by the organizational security policy.
Question 31
A severe security threat has been detected on your corporate network. As CISO you quickly assemble key members of the Information Technology team and business operations to determine a modification to security controls in response to the threat.
This is an example of:
Show answer and explanation
Correct answer: D. Security Incident Response
A severe threat has been detected on the corporate network, and the CISO assembles IT and business operations staff to decide how to modify security controls in response. Detecting the threat, convening the response team and adjusting controls to contain and counter it are core activities of security incident response as described in NIST SP 800-61. Involving business operations ensures that containment decisions account for business impact, which reflects the CISO role of balancing protection with operational needs.
Why the other options are wrong
- A. Change management governs planned modifications through review and approval, whereas this scenario is a reaction to an active threat.
- B. Thought leadership refers to shaping strategy and influencing industry thinking, not responding to a detected threat.
- C. Business continuity planning prepares for sustaining operations through disruptions, not the immediate handling of a detected threat.
Question 32
Which of the following is MOST useful when developing a business case for security initiatives?
Show answer and explanation
Correct answer: A. Cost/benefit analysis
A business case must show executives that an initiative is worth its cost. Cost/benefit analysis does this by comparing total costs, including acquisition, implementation and ongoing operation, against expected benefits such as reduced annualized loss expectancy, avoided regulatory penalties and operational efficiencies. It supports measures such as return on investment and payback period and frames security in the financial terms the business uses to decide. This makes it the most useful input when seeking approval and funding for security initiatives.
Why the other options are wrong
- B. Budget forecasts project future spending but do not show whether an initiative delivers enough value to justify its cost.
- C. Vendor management governs supplier relationships after sourcing decisions and does not justify why an initiative should proceed.
- D. A request for proposals solicits vendor offers once an initiative is approved and does not establish its business value.
Question 33
Which of the following activities results in change requests?
Show answer and explanation
Correct answer: C. Preventive actions
A preventive action is a planned, forward-looking activity that reduces the chance of future problems, for example adjusting a process or a baseline before a deviation happens. It changes plans that have already been approved, so it has to be raised as a formal change request and approved through integrated change control before work starts. This keeps baselines controlled and documented, and it lets the impact on scope, schedule, cost and risk be assessed before anything changes. The other options either respond to a problem that has already occurred or are only verification activities.
Why the other options are wrong
- A. A corrective action responds to a performance deviation that has already happened, while a preventive action is a planned forward-looking adjustment.
- B. Defect repair fixes a nonconforming component that has already been found, not a planned forward-looking adjustment.
- D. Inspection is a verification activity that examines work results and does not itself result in a change request.
Question 34
The company decides to release the application without remediating the high-risk vulnerabilities.
Which of the following is the MOST likely reason for the company to release the application?
Show answer and explanation
Correct answer: D. The company has a high risk tolerance
Releasing an application with known high risk vulnerabilities, rather than delaying to remediate them, reflects a business decision to accept that exposure. The most likely explanation is that the company has a high risk tolerance, valuing time to market, revenue or competitive advantage more than the potential loss from exploitation. Because the vulnerabilities were identified and the business still chose to proceed, the decision indicates acceptance of known risk rather than ignorance of it. The CISO should ensure the acceptance is documented and owned by the appropriate business executive.
Why the other options are wrong
- A. The vulnerabilities were identified and labeled high risk, so nothing suggests the company doubts they are real.
- B. The vulnerabilities have already been found, which shows the company was able to perform an assessment.
- C. Choosing to accept known risks is itself a risk decision, so the release does not show the absence of a risk management process.
Question 35
Involvement of senior management is MOST important in the development of:
Show answer and explanation
Correct answer: D. IT security policies
IT security policies are high-level statements of management intent that set direction, assign accountability and define what the organization requires. Because policies express the organization's risk appetite and commit resources, they must be developed with and approved by senior management to carry authority and be enforceable. Standards, guidelines, procedures and implementation plans are lower-level documents derived from policy and are developed by security and technical staff. Senior management involvement is therefore most important at the policy level, where governance begins.
Why the other options are wrong
- A. Procedures are detailed step-by-step instructions written by operational staff to carry out policy and do not need executive involvement.
- B. Implementation plans are tactical documents prepared by project and technical teams once policy direction has been set.
- C. Standards and guidelines are supporting documents that specify how policy is met and are developed by subject matter experts.
Question 36
The process for management approval of the security certification process which states the risks and mitigation of such risks of a given IT system is called___________________.
Show answer and explanation
Correct answer: D. Security accreditation
Security accreditation is the formal management decision that approves an IT system to operate based on the results of security certification. Certification is the technical assessment that documents the system's controls, risks and planned mitigations. A senior official then reviews that package and, by accrediting the system, explicitly accepts the residual risk on behalf of the organization. In the current NIST SP 800-37 terminology, this decision is called authorization to operate, and it reflects that the business owns the risk.
Why the other options are wrong
- A. Certification is the technical evaluation of the controls that precedes and supports management's approval.
- B. Security system analysis is an assessment activity, not the formal approval of the system by management.
- C. Business alignment is a strategic principle, not the formal process for approving a system to operate.
Question 37
When operating under severe budget constraints a CISO will have to be creative to maintain a strong security organization.
Which example below is the MOST creative way to maintain a strong security posture during these difficult times?
Show answer and explanation
Correct answer: B. Download open source security tools from a trusted site, test, and then deploy on production network
Under severe budget constraints, open source security tools can deliver real capability without licensing costs, but only if they are handled with the same discipline as any other production change. Obtaining the tools from a trusted site reduces the chance of tampered or malicious code, and testing them before deployment confirms they work as intended and will not disrupt production systems. This combination saves money while preserving the integrity and availability of the production network.
Why the other options are wrong
- A. Deploying tools straight to production without testing risks outages and unexpected behavior on critical systems.
- C. Trial versions expire and carry licensing limits, so they cannot sustain a security capability in production.
- D. Open source tools deployed to production without testing expose production to tampered code and operational failures.
Question 38
Which of the following is the MOST important for a CISO to understand when identifying threats?
Show answer and explanation
Correct answer: B. How vulnerabilities can potentially be exploited in systems that impact the organization
Identifying threats means understanding how threat sources could exploit vulnerabilities in the systems that support the organization, and what impact that would have on the business. This links threats, vulnerabilities and assets, which is the basis of risk assessment in NIST SP 800-30 and ISO/IEC 27005. With that understanding, the CISO can rank risks by likelihood and business consequence and recommend suitable treatment. How teams respond to incidents and how devices are configured are control and response questions that come later.
Why the other options are wrong
- A. How security operations respond to reported incidents is a response capability and does not identify the threats facing the organization.
- C. Device configurations are existing controls, which are evaluated after threats and exploitable vulnerabilities have been identified.
- D. Incident management preparation is about responding to attacks, not identifying the threats that could cause them.
Question 39
Which of the following is the PRIMARY purpose of International Organization for Standardization (ISO) 27001?
Show answer and explanation
Correct answer: A. Implementation of business-enabling information security
The primary purpose of ISO/IEC 27001 is to establish, implement, maintain and continually improve an information security management system that protects information in a way that supports the organization's objectives. It is a risk-based management system that aligns security with business needs, making it a framework for business-enabling information security. Compliance support, certification and the formulation of security requirements are benefits or uses that follow from implementing the management system rather than its central purpose.
Why the other options are wrong
- B. Supporting legal and regulatory compliance is a benefit of an ISMS, not its primary purpose.
- C. Certification is an optional outcome that demonstrates conformance, not the reason the standard exists.
- D. Formulating requirements and objectives is an activity within implementation rather than the primary purpose.
Question 40
With respect to the audit management process, management response serves what function?
Show answer and explanation
Correct answer: C. determining whether or not resources will be allocated to remediate a finding
In the audit management process, the management response is management's formal reply to each finding. It states whether management agrees with the finding and whether it will commit resources to remediate it, and if so the planned action, owner and target date, or alternatively that the risk will be accepted. The response therefore serves as the decision point on resource allocation and becomes the basis for tracking remediation through to closure.
Why the other options are wrong
- A. Root cause analysis may inform the response, but the response does not mitigate issues for all internal and external units.
- B. Adding oversight controls is one possible remediation outcome, not the function of the management response.
- D. Placing units on notice is a disciplinary or performance matter outside the audit response process.
Question 41
When updating the security strategic planning document, what two items must be included?
Show answer and explanation
Correct answer: C. The alignment with the business goals and the risk tolerance
Every update to the security strategic plan must show alignment with the business goals and reflect the organization's risk tolerance. Alignment ensures that security initiatives support what the business is trying to achieve, while risk tolerance, set by senior leadership, tells the CISO how much risk is acceptable and therefore how much protection and investment is warranted. Together they determine which initiatives are prioritized and funded, and they keep the plan anchored to business decisions rather than to technology preferences.
Why the other options are wrong
- A. The vision of the CIO is one executive's view and does not replace the organization's own risk tolerance.
- B. The mission statement is broad context, while explicit alignment with business goals is what the plan requires.
- D. An executive summary is a presentation element, and board vision does not substitute for business alignment and risk tolerance.
Question 42
A security officer wants to implement a vulnerability scanning program. The officer is uncertain of the state of vulnerability resiliency within the organization's large IT infrastructure.
What would be the BEST approach to minimize scan data output while retaining a realistic view of system vulnerability?
Show answer and explanation
Correct answer: B. Scan a representative sample of systems
When the state of a large infrastructure is unknown, scanning a representative sample of systems gives a realistic view of vulnerability while keeping the amount of scan data manageable. A well-chosen sample covering the main platforms, configurations, business units and criticality levels shows common weaknesses that are likely repeated across similar systems. The security officer can then set priorities, estimate how much remediation is needed and plan to expand scanning, without being swamped by data from scanning everything in the first round.
Why the other options are wrong
- A. Reducing the vulnerability checks in the tool settings hides real weaknesses and gives a distorted, overly favorable picture.
- C. Filtering output still produces the full volume of data and risks throwing away findings before anyone understands them.
- D. Scanning off-hours lowers operational impact but does not reduce the amount of output or make the view more realistic.
Question 43
At which point should the identity access management team be notified of the termination of an employee?
Show answer and explanation
Correct answer: A. Immediately so the employee account(s) can be disabled
The identity and access management team should be notified immediately when an employee is terminated, ideally through an automated link from the human resources process, so that all accounts and access rights can be disabled at once. Any delay leaves a window in which a departing and possibly disgruntled employee can still reach systems and data, creating risk of sabotage, data theft or fraud. Timely deprovisioning is a basic access control expectation in every major framework.
Why the other options are wrong
- B. A monthly review could leave the former employee with access for weeks.
- C. Waiting until the end of the day leaves hours of access after the termination decision.
- D. Waiting for an audit leaves accounts active indefinitely and fails basic access control requirements.
Question 44
Which of the following is a critical operational component of an Incident Response Program (IRP)?
Show answer and explanation
Correct answer: D. Daily monitoring of vulnerability advisories relating to your organization's deployed technologies.
Daily monitoring of vulnerability advisories for the organization's deployed technologies is a critical operational component of an incident response program. It is a continuous, hands-on activity that gives responders early warning of newly disclosed weaknesses and active exploits, so they can prepare detection, containment, and remediation before or as attacks occur. This supports the preparation and detection phases described in NIST SP 800-61, which depend on current threat and vulnerability awareness.
Why the other options are wrong
- A. Monthly tests focused on resource allocation are a planning and capacity exercise, not a critical day-to-day operational activity.
- B. Weekly budget reviews to keep funding percentages constant are a financial management task unrelated to incident response operations.
- C. Annual review of charters, policies, and agreements is a governance and administrative activity rather than an operational component.
Question 45
Which of the following is a benefit of a risk-based approach to audit planning?
Show answer and explanation
Correct answer: A. Resources are allocated to the areas of the highest concern
A risk-based approach to audit planning directs limited audit resources to the areas of highest risk and concern to the organization. Auditors assess the inherent risk of processes, systems, and business units, then prioritize the audit plan so that effort goes where control failures would have the greatest impact. This gives management and the board more meaningful assurance and makes the audit function more efficient than a fixed rotation or a schedule built for convenience.
Why the other options are wrong
- B. Scheduling months in advance is possible under any planning approach and is not a distinctive benefit of risk-based planning.
- C. Meeting the audit budget depends on project management, not on whether audits are selected by risk.
- D. Exposing staff to a variety of technologies is a training consideration, not the purpose of risk-based planning.
Question 46
When managing the security architecture for your company you must consider:
Show answer and explanation
Correct answer: D. All of the above
Managing a security architecture requires weighing every factor that shapes what can be built and sustained. Budget determines which technologies and services can be acquired and maintained. The size and skills of the security and IT staff determine what can realistically be deployed, operated and monitored. Company values, along with culture and risk appetite, determine which approaches fit how the business works. An architecture that ignores any of these will be unaffordable, unmanageable or rejected, so all of them must be considered.
Why the other options are wrong
- A. Considering budget by itself ignores the staffing and company values the architecture must also reflect.
- B. Considering staff size by itself ignores the budget and company values the architecture must also reflect.
- C. Considering company values by itself ignores the budget and staffing constraints the architecture must also reflect.
Question 47
The ability to demand the implementation and management of security controls on third parties providing services to an organization is_________________________.
Show answer and explanation
Correct answer: C. Vendor management
Vendor management is the function that gives an organization the ability to require third-party service providers to implement and manage security controls. It works through due diligence before selection, contract clauses and service level agreements that specify security obligations, right-to-audit provisions, and ongoing monitoring of vendor performance and risk. Without these mechanisms the organization has no leverage to demand that a provider protect its data. The organization remains accountable for its information even when a vendor processes it, which is why vendor management is a core CISO responsibility.
Why the other options are wrong
- A. Disaster recovery restores technology and operations after a disruption and does not provide leverage over third-party security controls.
- B. Security governance sets direction, accountability and oversight for the security program as a whole rather than enforcing controls on specific providers.
- D. Compliance management tracks adherence to laws, regulations and standards and does not itself impose control requirements on third parties.
Question 48
An international organization is planning a project to implement encryption technologies to protect company confidential information. This organization has data centers on three continents.
Which of the following would be considered a MAJOR constraint for the project?
Show answer and explanation
Correct answer: B. Encryption import/export regulations
Cryptography is regulated differently around the world. Many countries restrict the export, import or domestic use of encryption products, require licenses or registration, or limit key lengths and algorithms. A project deploying encryption across data centers on three continents must satisfy every applicable regime, which can dictate product selection, deployment schedules and even whether a given technology may be used in a location at all. That makes encryption import and export regulation a major constraint on the project.
Why the other options are wrong
- A. Local hiring laws affect staffing practices and do not limit how encryption technology can be deployed.
- C. Privacy laws generally encourage encryption of personal data rather than restrict the project.
- D. Time zone differences are a coordination issue that ordinary project scheduling can manage.
Question 49
Which of the following activities must be completed BEFORE you can calculate risk?
Show answer and explanation
Correct answer: A. Assigning a value to each information asset
Risk is a function of the value or impact of an asset combined with the likelihood that a threat will exploit a vulnerability. Without first identifying information assets and assigning each a value, there is no basis for determining what a compromise would cost, so risk cannot be calculated. Asset valuation is therefore the prerequisite activity. Assessing relative risk, determining likelihood and calculating exposure in the current setting are all parts of the risk calculation itself, which depends on the asset values established first.
Why the other options are wrong
- B. Assessing relative risk is part of risk calculation and depends on asset values already being known.
- C. Determining likelihood is an input within the risk calculation, not the prerequisite that must come first.
- D. Calculating risk to assets in their current setting is the risk calculation itself.
Question 50
You have recently drafted a revised information security policy. From whom should you seek endorsement in order to have the GREATEST chance for adoption and implementation throughout the entire organization?
Show answer and explanation
Correct answer: A. Chief Executive Officer
Endorsement from the Chief Executive Officer gives an information security policy the greatest chance of adoption across the entire organization. The CEO has authority over every business unit, so visible support from the top signals that the policy is a business requirement, not just an IT or security preference. Senior management commitment is a foundation of effective security governance, and executive endorsement drives compliance, resource allocation, and accountability throughout the enterprise.
Why the other options are wrong
- B. The Chief Information Officer has authority mainly over IT and lacks the organization-wide reach needed for enterprise adoption.
- C. The Chief Information Security Officer usually drafts the policy, so self-endorsement adds no executive authority over other business units.
Question 51
The CIO of an organization has decided to assign the responsibility of internal IT audit to the IT team. This is considered a bad practice MAINLY because_______________.
Show answer and explanation
Correct answer: D. This represents a conflict of interest
Audit only has value when the auditor is independent of the activity being examined. If the IT team audits IT, it is evaluating its own designs, configurations and operating practices, and it has an incentive to overlook or downplay weaknesses that reflect on its own performance. This conflict of interest undermines the objectivity and credibility of the findings for senior management and the audit committee. Internal IT audit should therefore sit in a function independent of IT operations, typically reporting to the audit committee.
Why the other options are wrong
- A. Unfamiliarity with audit practices can be fixed with training, and it does not remove the independence problem.
- B. Least privilege governs access rights to systems and data, not the assignment of audit responsibilities.
- C. Certification would not make the IT team independent, because they would still be auditing their own work.
Question 52
While designing a secondary data center for your company what document needs to be analyzed to determine how much should be spent on building the data center?
Show answer and explanation
Correct answer: C. Disaster recovery strategic plan
The disaster recovery strategic plan determines how much should be spent on a secondary data center. It sets the recovery strategy, such as a hot, warm or cold site, based on the recovery time objectives and recovery point objectives drawn from the business impact analysis, and it weighs the cost of each alternative against the business losses from prolonged downtime. That analysis defines the capability the secondary site must deliver and therefore the investment that is justified for building it.
Why the other options are wrong
- A. The business continuity plan covers keeping business operations running and does not specify the investment for a recovery facility.
- B. An application mapping document shows system dependencies but does not establish how much to spend on the site.
- D. An enterprise risk assessment covers risks across the whole organization and is not detailed enough to set the budget for a recovery site.
Question 53
A CISO decides to analyze the IT infrastructure to ensure security solutions adhere to the concepts of how hardware and software is implemented and managed within the organization.
Which of the following principles does this best demonstrate?
Show answer and explanation
Correct answer: C. Alignment with the business
Analyzing the IT infrastructure to make sure security solutions fit the way the organization actually implements and manages its hardware and software is an exercise in alignment with the business. Security that matches existing operating practices, architecture and management processes supports business operations instead of disrupting them, is easier to adopt and sustain, and reflects how the organization chooses to run its technology. Fitting security to the organization, rather than forcing the organization to fit security, is the essence of business alignment.
Why the other options are wrong
- A. Budget management concerns controlling security spending, not fitting solutions to how infrastructure is implemented and managed.
- B. Effective use of existing technologies is about getting value from current tools rather than conforming to organizational practices.
- D. Leveraging existing implementations means reusing deployed solutions, which is narrower than aligning security with the business.
Question 54
You have a system with 2 identified risks. You determine the probability of one risk occurring is higher than the other. This is an example of:
Show answer and explanation
Correct answer: A. Relative likelihood of event
When two identified risks are compared on the basis of how probable each one is, the comparison being made is the relative likelihood of the events. Likelihood is the probability that a threat event will occur and exploit a vulnerability, and ranking risks by relative likelihood is a standard step in risk analysis that, together with impact, lets the organization prioritize which risks deserve attention and resources first.
Why the other options are wrong
- B. Controlled mitigation effort concerns planning a risk response, not comparing how probable two events are.
- C. Risk impact comparison weighs the consequences of events, not their probability of occurring.
- D. Comparative threat analysis examines threat sources and capabilities rather than comparing the probability of two risks.
Question 55
Assigning the role and responsibility of Information Assurance to a dedicated and independent security group is an example of:
Show answer and explanation
Correct answer: C. Organizational Controls
Assigning information assurance responsibility to a dedicated and independent security group is a decision about organizational structure, roles and accountability. Such measures are organizational controls, also called administrative or management controls. They establish who is responsible for security, provide independence and separation of duties, and create the governance foundation on which technical and procedural controls are built and enforced across the enterprise.
Why the other options are wrong
- A. Detective controls identify events after they occur, such as logging or intrusion detection, rather than define roles.
- B. Proactive describes a timing approach, not the category that covers assignment of roles and responsibilities.
- D. Preemptive describes acting ahead of a threat, not the structural assignment of security responsibilities.
Question 56
From an information security perspective, information that no longer supports the main purpose of the business should be:
Show answer and explanation
Correct answer: D. analyzed under the retention policy.
When information no longer supports the main purpose of the business, the question becomes whether it must still be kept and, if not, how it should be disposed of. The retention policy answers this by defining retention periods based on legal, regulatory and business requirements and by specifying secure disposal once those periods end. Keeping unneeded data increases storage cost, legal discovery exposure and breach impact, so analysis under the retention policy reduces risk while preserving anything the organization is obliged to keep.
Why the other options are wrong
- A. The classification policy sets protection levels for data and does not decide whether data that has lost its business purpose should be kept or destroyed.
- B. The data ownership policy assigns accountability for data and does not set rules for keeping or disposing of it.
- C. A business impact analysis assesses the effect of disruption on critical processes, not the disposition of information that no longer supports them.
Question 57
The implementation of anti-malware and anti-phishing controls on centralized email servers is an example of what type of security control?
Show answer and explanation
Correct answer: A. Technical control
Anti-malware and anti-phishing filtering on central email servers is a technical control, also called a logical control. It is built into hardware, software or firmware and works automatically to detect and block malicious messages and attachments. NIST groups controls into management, operational and technical classes, and automated filtering by systems falls clearly in the technical class. Policies and procedures set out the requirement for such protection, but the filtering itself is done by technology.
Why the other options are wrong
- B. Management controls cover risk management, planning and policy, not automated filtering done by systems.
- C. Procedural controls rely on documented steps that people carry out, while email filtering runs automatically in technology.
- D. Organizational controls deal with structure, roles and responsibilities, not mechanisms that block malicious content.
Question 58
Which of the following illustrates an operational control process:
Show answer and explanation
Correct answer: C. Installing an appropriate fire suppression system in the data center
In the management, operational and technical control classification used in earlier NIST guidance, physical and environmental protection is an operational control family. Installing an appropriate fire suppression system in the data center is a physical and environmental safeguard carried out to protect facilities and equipment, so it illustrates an operational control process. Classifying systems during risk assessment, auditing processes and setting procurement standards are planning, assessment and acquisition activities that belong to the management control class.
Why the other options are wrong
- A. Classifying an information system as part of risk assessment is a management control activity.
- B. Auditing the configuration management process is a security assessment activity, which falls under management controls.
- D. Establishing procurement standards for vendors is an acquisition and governance activity within management controls.
Question 59
To have accurate and effective information security policies how often should the CISO review the organization policies?
Show answer and explanation
Correct answer: B. At least once a year
Information security policies should be reviewed at least once a year, and also whenever a significant change occurs, such as a new regulation, a major incident, a merger or a shift in business strategy. An annual minimum is the widely accepted baseline in common audit expectations and many regulatory frameworks, while ISO/IEC 27002 calls for review at planned intervals. It keeps policies accurate and effective without consuming senior management time on unnecessary revisions to documents that are meant to be stable, high-level statements.
Why the other options are wrong
- A. Reviewing only before an audit is reactive and tied to audit timing rather than to keeping policy current.
- C. Quarterly reviews are excessive for high-level policies, which are intended to be stable.
- D. A six-month cycle is not the accepted baseline and adds review effort without a clear benefit.
Question 60
IT control objectives are useful to IT auditors as they provide the basis for understanding the:
Show answer and explanation
Correct answer: C. Desired results or purpose of implementing specific control procedures.
A control objective is a statement of the result or purpose that a specific control procedure is meant to achieve, for example that only authorized changes reach production. Frameworks such as COBIT organize controls around these objectives. For an IT auditor, the objective is the benchmark for judging whether a control is adequately designed and whether it is operating effectively. It explains why the control exists, which lets the auditor assess other ways of achieving the same result. Checklists, techniques and policies are all tools or documents built around these objectives.
Why the other options are wrong
- A. An audit checklist is a working tool built from control objectives, not the understanding that the objectives provide.
- B. Specific security techniques are how a control is implemented, while the objective states the result the control must achieve.
- D. The security policy sets management direction at a higher level and is not what control objectives explain to the auditor.
Question 61
The amount of risk an organization is willing to accept in pursuit of its mission is known as______________.
Show answer and explanation
Correct answer: D. risk tolerance
Risk tolerance is the amount of risk an organization is willing to accept in pursuit of its mission and objectives. It sets the thresholds against which assessed risks are compared: risks within tolerance can be accepted, while risks beyond it require treatment. Defining risk tolerance is a senior management responsibility that guides consistent risk decisions across the organization, and NIST SP 800-39 treats it as a key output of the risk framing step.
Why the other options are wrong
- A. Risk transfer shifts the financial impact of a risk to another party, such as an insurer, and does not describe a level of acceptable risk.
- B. Risk mitigation reduces risk through controls and is a treatment option, not a measure of acceptable risk.
- C. Risk acceptance is a treatment decision about a particular risk, made by comparing it with the organization's tolerance.
Question 62
Which of the following is considered to be an IT governance framework and a supporting toolset that allows for managers to bridge the gap between control requirements, technical issues, and business risks?
Show answer and explanation
Correct answer: C. Control Objective for Information Technology (COBIT)
COBIT, developed by ISACA, is an IT governance and management framework accompanied by a supporting toolset of control objectives, process descriptions, management guidelines and maturity models. It is explicitly intended to let managers bridge the gap between control requirements, technical issues and business risks, linking IT processes to business goals and giving auditors and executives a common language for control and accountability. That positioning makes it the framework most often associated with IT governance in executive and audit discussions.
Why the other options are wrong
- A. ITIL is a framework for IT service management practices, not an IT governance framework for linking controls to business risk.
- B. COSO is an enterprise internal control and risk framework that is not specific to IT governance.
- D. PCI DSS is an industry security standard for protecting payment card data, not a governance framework.
Question 63
The process to evaluate the technical and non-technical security controls of an IT system to validate that a given design and implementation meet a specific set of security requirements is called____________________.
Show answer and explanation
Correct answer: A. Security certification
Security certification is the comprehensive evaluation of the technical and non-technical (management and operational) security controls of an information system to determine whether the design and implementation meet the specified security requirements. It produces the evidence that a senior official then uses to decide whether to authorize the system. Certification is therefore the technical assessment step, and accreditation is the separate management decision to accept the residual risk and approve operation. In current NIST terminology these map to security control assessment and authorization.
Why the other options are wrong
- B. Security accreditation is the management decision to authorize operation and accept residual risk, which follows the evaluation rather than performing it.
- C. Alignment with business practices and goals is a strategic objective, not the formal process of evaluating controls against security requirements.
- D. Security system analysis is a generic phrase and not the recognized term for the formal evaluation of controls against requirements.
Question 64
An organization's firewall technology needs to be replaced. A specific technology has been selected that is less costly than others and lacking in some important capabilities. The security officer has voiced concerns about sensitive data breaches but the decision is made to purchase.
What does this selection indicate?
Show answer and explanation
Correct answer: C. A high risk tolerance environment
Management chose a cheaper firewall that lacks important capabilities even after the security officer warned about the risk of sensitive data breaches. Knowingly accepting greater exposure in exchange for cost savings shows that the organization is willing to live with a higher level of risk, which indicates a high risk tolerance environment. The security officer properly advised on the risk, and the business, as risk owner, made the decision to accept it.
Why the other options are wrong
- A. The scenario describes a purchasing decision, not the level of threat activity facing the organization.
- B. Choosing a less capable firewall increases vulnerability rather than indicating a low vulnerability environment.
- D. A low risk tolerance organization would invest to reduce exposure rather than accept a weaker control to save money.
Question 65
Which of the following is considered the foundation for the Enterprise Information Security Architecture (EISA)?
Show answer and explanation
Correct answer: C. Information security policy
The information security policy is the foundation of the Enterprise Information Security Architecture. Policy, approved by senior management, states the organization's security objectives, principles, roles and requirements, and the architecture translates that direction into structures, standards and controls across the enterprise. Classification schemes for data and assets are themselves defined and mandated by policy, and external regulations are incorporated into the architecture through policy. Governance before technology means the architecture is built on policy rather than the reverse.
Why the other options are wrong
- A. Data classification is established and mandated by the security policy, so it is a component built on that foundation.
- B. Regulations are external requirements that the policy interprets and incorporates, not the foundation of the architecture.
- D. Asset classification is an activity directed by the security policy and depends on it.
Question 66
An organization has a stated requirement to block certain traffic on networks. The implementation of controls will disrupt a manufacturing process and cause unacceptable delays, resulting in severe revenue disruptions.
Which of the following is MOST likely to be responsible for accepting the risk until mitigating controls can be implemented?
Show answer and explanation
Correct answer: D. The business owner
Risk acceptance belongs to the business owner of the affected process or asset. Here the required traffic blocking would disrupt manufacturing and cause severe revenue losses, so the owner of that manufacturing process must weigh the security exposure against the operational and financial impact and formally accept the risk until compensating or mitigating controls are in place. The CISO identifies the risk, explains the consequences and recommends options, but the business owns the risk decision. The acceptance should be documented, time limited and tied to a plan to implement mitigating controls.
Why the other options are wrong
- A. Audit and Compliance provide independent assurance and must stay independent, so they do not accept operational risk.
- B. The CFO oversees finance across the organization but is not the owner of the manufacturing process whose risk is being accepted.
- C. The CISO advises on risk and recommends treatment but does not own business process risk and should not accept it on the business's behalf.
Question 67
Which of the following is critical in creating a security program aligned with an organization's goals?
Show answer and explanation
Correct answer: A. Develop a culture in which users, managers and IT professionals all make good decisions about information risk
A security program aligns with organizational goals when information risk is treated as a business concern that everyone owns. Developing a culture in which users, managers and IT professionals all make good decisions about information risk embeds security into everyday business choices, so the program supports objectives instead of standing apart from them. Such a culture reflects senior management support, shared accountability and risk based thinking across the enterprise. Communications, awareness activities and budgets are tools that serve this aim, but the culture of sound risk decisions is what makes alignment real.
Why the other options are wrong
- B. Communicating support requirements and audit schedules is an operational activity that does not by itself align the program with business goals.
- C. Awareness programs inform staff about security goals but do not ensure the program reflects organizational objectives.
- D. Budgeting around internal compliance requirements is compliance driven rather than aligned with business goals and risk.
Question 68
What is the FIRST step in developing the vulnerability management program?
Show answer and explanation
Correct answer: B. Define policy
A vulnerability management program begins by defining policy. The policy establishes management's intent, scope, roles and responsibilities, risk-based remediation timeframes and reporting expectations, giving every later activity its authority and direction. Only after the policy exists can the organization baseline its environment, identify and prioritize vulnerabilities, remediate them and then maintain and monitor the program over time. Starting with policy reflects the governance-before-technology principle that underpins every security program a CISO builds.
Why the other options are wrong
- A. Baselining the environment follows policy definition, because the policy determines what must be baselined and to what standard.
- C. Maintaining and monitoring is the ongoing final stage of an established program, not the starting point.
- D. Organizing or assessing vulnerabilities depends on the scope and priorities that the policy must first define.
Question 69
The PRIMARY objective of security awareness is to:
Show answer and explanation
Correct answer: A. Encourage security-conscious employee behavior
The primary objective of security awareness is to change behavior, encouraging employees to recognize threats and act in a security-conscious way as part of their everyday work. Awareness programs focus attention on security so that people make sound choices, such as reporting phishing, protecting credentials and handling data correctly. Reading policies, documenting notice and meeting regulatory training requirements are supporting results, but the program succeeds only when employee behavior actually improves and human-related risk is reduced.
Why the other options are wrong
- B. Putting employees on notice for disciplinary purposes is a legal side benefit, not the purpose of awareness.
- C. Ensuring policies are read does not guarantee understanding or a change in behavior, which is the real goal.
- D. Meeting legal and regulatory requirements is a secondary outcome rather than the primary objective of awareness.
Question 70
As a new CISO at a large healthcare company you are told that everyone has to badge in to get in the building. Below your office window you notice a door that is normally propped open during the day for groups of people to take breaks outside. Upon looking closer, you see there is no badge reader.
What should you do?
Show answer and explanation
Correct answer: C. A physical risk assessment on the facility
A physical risk assessment of the facility is the right response. The propped door without a badge reader shows that physical controls do not match the stated policy, and the same gap may exist elsewhere. An assessment establishes the full extent of the weaknesses, their business impact, and the appropriate controls, and it gives the CISO evidence to present to management and facilities owners. This follows the principle of assessing risk before selecting a remedy.
Why the other options are wrong
- A. Posting a guard is a costly reaction to a single symptom before the overall risk has been assessed.
- B. Chaining a door shut may violate fire and life safety codes, and a memo alone does not address the underlying control gap.
- D. Physical security directly affects the protection of information assets, so the CISO cannot ignore the gap.
Question 71
The ability to hold intruders accountable in a court of law is important.
Which of the following activities are needed to ensure the highest possibility for successful prosecution?
Show answer and explanation
Correct answer: C. Well established and defined digital forensics process
Successful prosecution depends on evidence that a court will admit and trust. A well-established and defined digital forensics process ensures evidence is identified, collected, preserved, analyzed and documented using sound, repeatable methods, with an unbroken chain of custody and integrity verification such as hashing. Without that process, even strong evidence can be challenged or excluded. Law enforcement can only build a case on what the organization has properly preserved, so a mature internal forensics capability gives the highest likelihood of holding intruders accountable.
Why the other options are wrong
- A. Operating botnets for preemptive attacks is illegal and would expose the organization to liability rather than support prosecution.
- B. Collaboration with law enforcement helps, but prosecution still fails if the evidence was not collected and preserved through a sound forensic process.
- D. Retaliation under so-called active defense can break computer crime laws and taint the case instead of strengthening it.
Question 72
Which of the following is MOST important when tuning an Intrusion Detection System (IDS)?
Show answer and explanation
Correct answer: D. Trusted and untrusted networks
Defining trusted and untrusted networks is the most important consideration when tuning an intrusion detection system. The IDS must know which address ranges are internal and which are external so that its rules evaluate traffic in the correct direction and context. Accurate network definitions reduce false positives from normal internal traffic, reduce false negatives for attacks crossing trust boundaries and let analysts focus on alerts that represent real risk.
Why the other options are wrong
- A. Log retention affects forensics and compliance but does not change what the IDS detects.
- B. Storage encryption protects data at rest and has no bearing on detection rules or alert accuracy.
- C. The type of authentication governs access to systems and is not a factor in tuning detection.
Question 73
When a CISO considers delaying or not remediating system vulnerabilities which of the following are MOST important to take into account?
Show answer and explanation
Correct answer: A. Threat Level, Risk of Compromise, and Consequences of Compromise
Deciding to delay or forgo remediation is a risk decision, so it must rest on the components of risk. Threat level reflects how actively the vulnerability is being targeted or exploited, risk of compromise reflects how likely successful exploitation is given existing controls, and consequences of compromise reflect the impact on the business if it occurs. Together they show whether the remaining exposure is within risk tolerance and whether postponement can be justified to the risk owner.
Why the other options are wrong
- B. Risk avoidance is a treatment option, not a factor used to evaluate the exposure.
- C. Reputational and financial impact are both parts of consequence, and this set omits threat level entirely.
- D. Risk transfer is a treatment option, and this set omits both threat level and risk of compromise.
Question 74
Quantitative Risk Assessments have the following advantages over qualitative risk assessments:
Show answer and explanation
Correct answer: D. They are objective and can express risk / cost in real numbers
Quantitative risk assessments rely on measurable data and calculations, which makes them objective and allows them to express risk and cost in real numbers such as dollar losses and annual frequencies. These figures support cost-benefit analysis, comparison of control options and clear communication with executives who think in financial terms. The trade-off is that quantitative assessments require reliable data and take more time and effort than qualitative assessments, which are faster but subjective.
Why the other options are wrong
- A. Being subjective and quick describes qualitative assessments, not the advantages of quantitative ones.
- B. Quantitative assessments express risk in real numbers, not approximations.
- C. Quantitative assessments are objective, not subjective, because they rest on measured data and calculation.
Question 75
The ultimate goal of an IT security project is:
Show answer and explanation
Correct answer: A. Support business requirements
Information security exists to enable and protect the business, so the ultimate goal of any IT security project is to support business requirements. Projects are justified, prioritized and funded based on how they reduce risk to business objectives, satisfy obligations and enable operations at an acceptable cost. Policies, controls and technology are means to that end. A CISO who frames security projects in terms of business requirements gains executive support and ensures resources are spent where they deliver the most value.
Why the other options are wrong
- B. Implementing policies is a mechanism for achieving security objectives, not the ultimate goal of a project.
- C. Stock value is a broad financial outcome influenced by many factors and is not the direct goal of a security project.
- D. Complete security is unattainable, and pursuing it would waste resources and obstruct the business.
Question 76
SQL injection is a very popular and successful injection attack method.
Identify the basic SQL injection text:
Show answer and explanation
Correct answer: D. ' OR 1=1 --
The basic SQL injection string is a single quote followed by OR 1=1 and a comment marker, written as ' OR 1=1 --. The quote closes the string literal in the application's query, OR 1=1 makes the WHERE condition always true, and the double dash comments out the rest of the original statement. This classic payload can bypass login checks or return every row in a table. Parameterized queries, input validation and least privilege database accounts are the primary defenses.
Why the other options are wrong
- A. A bare DROP TABLE statement lacks the quote and logic manipulation needed to break out of the application's query.
- B. NOPs are no-operation machine instructions used in buffer overflow exploits, not SQL injection.
- C. Repeated dot-dot-slash sequences are a directory traversal technique against file paths, not SQL injection.
Question 77
A stakeholder is a person or group:
Show answer and explanation
Correct answer: A. Vested in the success and/or failure of a project or initiative regardless of budget implications.
A stakeholder is any person or group with a vested interest in the success or failure of a project or initiative, whatever their relationship to its budget. Stakeholders can include sponsors, users, managers, regulators, customers and support teams, and many of them have no budget role at all. Identifying stakeholders broadly ensures their requirements, concerns and influence are considered, which is essential to delivering an initiative that is accepted and succeeds.
Why the other options are wrong
- B. End users are only one group of stakeholders, so this definition is too narrow.
- C. Budget authority is not required to be a stakeholder; many stakeholders control no funds.
- D. Tying stakeholders to the project budget wrongly excludes everyone with an interest but no budget connection.
Question 78
When gathering security requirements for an automated business process improvement program, which of the following is MOST important?
Show answer and explanation
Correct answer: A. Type of data contained in the process/system
The type of data a process or system handles is the starting point for every security requirement. Data classification, guided by approaches such as FIPS 199, determines the impact of a loss of confidentiality, integrity or availability, which in turn drives the required controls, regulatory obligations, encryption needs, access restrictions and monitoring. Once the data and its sensitivity are understood, technical decisions about encryption, platforms and protocols can be made appropriately for the automated business process.
Why the other options are wrong
- B. Encryption requirements for data at rest are derived from the data's classification, so they follow rather than lead.
- C. The processing platform is an implementation choice that should satisfy requirements, not define them.
- D. Connection and protocol choices are technical details selected after the data's protection needs are known.
Question 79
One of your executives needs to send an important and confidential email. You want to ensure that the message cannot be read by anyone but the recipient.
Which of the following keys should be used to encrypt the message?
Show answer and explanation
Correct answer: C. The recipient's public key
In public key cryptography, anything encrypted with a recipient's public key can be decrypted only with the matching private key, which the recipient alone holds. Encrypting the email with the recipient's public key therefore ensures that no one else can read it. In practice, email systems encrypt the message with a symmetric session key and protect that key with the recipient's public key. Signing the message with the sender's private key adds integrity and non-repudiation, but it does not provide confidentiality.
Why the other options are wrong
- A. A certificate authority's key is used to sign and validate certificates, not to encrypt messages to a recipient.
- B. The recipient's private key is held only by the recipient and is never available to a sender for encryption.
- D. A message encrypted with your own public key could be decrypted only with your private key, so the recipient could not read it.
Question 80
An audit was conducted and many critical applications were found to have no disaster recovery plans in place. You conduct a Business Impact Analysis (BIA) to determine impact to the company for each application.
What should be the NEXT step?
Show answer and explanation
Correct answer: A. Create technology recovery plans
The audit found critical applications without disaster recovery plans, and the business impact analysis has now established the impact of losing each application along with its recovery priorities and recovery time objectives. The next step is to develop technology recovery plans that define strategies, resources and procedures to restore those applications within the required time frames. This follows the contingency planning sequence in NIST SP 800-34, where the business impact analysis drives recovery strategy and plan development, which closes the audit gap directly.
Why the other options are wrong
- B. Annualized loss expectancy is a risk quantification measure and does not produce the missing recovery plans.
- C. A hot site is one possible recovery strategy that should be selected through recovery planning, not built before plans exist.
- D. A crisis management plan addresses executive coordination and communication, not the application recovery plans the audit found missing.
Question 81
Which of the following will be MOST helpful for getting an Information Security project that is behind schedule back on schedule?
Show answer and explanation
Correct answer: C. Upper management support
Projects usually slip because of obstacles that the project team cannot remove alone, such as competing priorities, missing resources, unclear decisions or resistance from other departments. Upper management support supplies the authority to resolve these issues: executives can reallocate staff, approve funding, settle priority conflicts and make scope decisions quickly. With visible sponsorship, stakeholders across the organization cooperate more readily, which is the most effective way to bring a delayed information security project back on schedule.
Why the other options are wrong
- A. More frequent milestone meetings add reporting overhead without removing the obstacles that cause the delay.
- B. Internal audit provides independent assurance and has no authority to supply resources or remove project barriers.
- D. Additional training builds skills over time but does not address the immediate causes of a schedule slip.
Question 82
What is the primary reason for performing vendor management?
Show answer and explanation
Correct answer: B. To understand the risk coverage that are being mitigated by the vendor
From a security leadership view, vendor management is performed mainly to understand the risk coverage the vendor provides. When a service is outsourced, the vendor performs controls on the organization's behalf, but accountability for the risk stays with the organization. Vendor management assesses which risks the vendor mitigates, how well it does so through contracts, service level agreements, assessments and ongoing monitoring, and what residual risk remains, so gaps can be addressed and leadership can make informed decisions.
Why the other options are wrong
- A. A good long-term partnership is a desirable outcome, but it does not tell the organization whether its risks are covered.
- C. Vendor selection is a single early activity, while vendor management continues for the life of the relationship.
- D. Documenting the relationship records terms but does not by itself establish what risk the vendor mitigates.
Question 83
Payment Card Industry (PCI) compliance requirements are based on what criteria?
Show answer and explanation
Correct answer: D. The number of transactions performed per year by an organization
PCI compliance validation requirements are determined by merchant or service provider level, and those levels are set mainly by the number of card transactions processed per year. Higher volumes place an organization at a higher level with stricter validation, such as an annual on-site assessment by a Qualified Security Assessor, while lower volumes may allow a self-assessment questionnaire. Transaction volume reflects the amount of cardholder data at risk, so it drives the depth of validation required.
Why the other options are wrong
- A. Organization size in employees or revenue does not set the level, since a small company with high card volume is still placed at a high level.
- B. The types of cardholder data stored affect scope and specific controls, but they do not set the validation level.
- C. Retention is limited by the standard, but how long data is kept does not determine the compliance level.
Question 84
When dealing with risk, the information security practitioner may choose to:
Show answer and explanation
Correct answer: B. transfer
Transfer is one of the recognized risk treatment options, alongside mitigation, acceptance and avoidance. Transferring risk shifts the financial impact of a loss to another party, most often through insurance, outsourcing or contractual clauses such as indemnification. Ownership and accountability for the risk remain with the organization, but the financial consequences are shared or moved elsewhere. The security practitioner identifies transfer as an option and recommends it, and the business owner makes the final treatment decision.
Why the other options are wrong
- A. Acknowledging a risk recognizes that it exists but is not a risk treatment option.
- C. Assign is not a recognized risk treatment option.
- D. Deferring a risk merely postpones a decision and is not a recognized risk treatment option.
Question 85
In accordance with best practices and international standards, how often is security awareness training provided to employees of an organization?
Show answer and explanation
Correct answer: B. Every 12 months
Common best practice and the major frameworks and regulations treat security awareness training as an annual requirement for all personnel, delivered at onboarding and then refreshed every 12 months. An annual cycle keeps staff current on new threats, policy changes and their responsibilities, provides an auditable record of completion, and remains practical to sustain across the whole workforce. Organizations often supplement the annual course with ongoing reminders and phishing simulations, but the baseline formal cycle is yearly.
Why the other options are wrong
- A. An 18-month cycle leaves too long a gap and falls short of the annual baseline expected by best practice.
- C. Splitting frequency by environment risk level is not the recognized baseline; formal training is expected yearly for everyone.
- D. A six-month cycle exceeds the recognized baseline and is not what best practice prescribes for all employees.
Question 86
File Integrity Monitoring (FIM) is considered a________________________.
Show answer and explanation
Correct answer: D. Security detective control
File integrity monitoring is a detective control. It establishes a trusted baseline of critical files, typically using cryptographic hashes and attributes, and then compares current files against that baseline to detect unauthorized or unexpected changes. When a change is found, it generates an alert so the security team can investigate possible tampering, malware or misconfiguration. FIM does not stop the change from happening, which distinguishes it from preventive controls, and it is widely required by standards such as PCI DSS.
Why the other options are wrong
- A. FIM detects changes after they occur on hosts and does not prevent anything at the network level.
- B. Software segmentation isolates applications from one another, which is unrelated to monitoring files for changes.
- C. User segmentation separates users or groups by access, which is unrelated to monitoring file integrity.
Question 87
Which of the following set of processes is considered to be one of the cornerstone cycles of the International Organization for Standardization (ISO) 27001 standard?
Show answer and explanation
Correct answer: C. Plan-Do-Check-Act
The Plan-Do-Check-Act cycle is the continual improvement model associated with ISO/IEC 27001. Plan establishes the information security management system scope, policy, risk assessment and objectives; Do implements and operates the controls; Check monitors, measures, audits and reviews performance; and Act takes corrective action and improves the system. Repeating the cycle keeps the management system aligned with changing risks and business needs.
Why the other options are wrong
- A. Plan-Check-Do-Act places checking before doing, which is not the recognized improvement cycle.
- B. Plan-Select-Implement-Evaluate is not the cycle that underpins ISO/IEC 27001.
- D. SCORE is a community security checklist initiative, not a management system improvement cycle in ISO/IEC 27001.
Question 88
Which business stakeholder is accountable for the integrity of a new information system?
Show answer and explanation
Correct answer: B. CISO
Among the stakeholders listed, the CISO is accountable for the integrity of a new information system. Integrity is a core security objective, and the CISO owns the security program that defines integrity requirements, ensures controls such as input validation, change control and access restrictions are built into the system development life cycle, and verifies through testing and assessment that those controls work before the system goes live. The CISO then reports the resulting risk posture to the business owners and executives.
Why the other options are wrong
- A. The compliance officer monitors adherence to laws and regulations and is not accountable for the security of individual systems.
- C. The project manager is accountable for delivering scope, schedule and budget, not for the security properties of the system.
- D. The board provides overall governance oversight and does not hold accountability for the integrity of a specific system.
Question 89
Which of the following is a countermeasure to prevent unauthorized database access from web applications?
Show answer and explanation
Correct answer: C. Input sanitization
Input sanitization is the countermeasure that prevents unauthorized database access through web applications. Attacks such as SQL injection work by passing crafted input from a web form or parameter into a database query. Validating input against expected formats, rejecting or encoding dangerous characters and using parameterized queries ensures user data is treated as data and never executed as commands. Combined with least privilege database accounts, this closes the main path attackers use to read or alter data through the application.
Why the other options are wrong
- A. Removing stored procedures breaks legitimate functionality, and properly written stored procedures can actually reduce injection risk.
- B. Library control governs software libraries and code versions, not the input that reaches the database.
- D. Session encryption protects data in transit but does nothing to stop malicious input from reaching the database.
Question 90
The risk found after a control has been fully implemented is called:
Show answer and explanation
Correct answer: C. Residual Risk
Residual risk is the risk that remains after controls have been implemented. Because no control eliminates risk entirely, some exposure is always left over, and management must compare that residual risk with the organization's risk appetite and risk tolerance. If it falls within acceptable limits, the risk owner formally accepts it, and if not, further treatment is required. Residual risk is the standard term used in ISO/IEC 27005, ISO 31000 and NIST risk guidance.
Why the other options are wrong
- A. Total risk is the exposure before any controls are applied.
- B. Transferred risk is the portion shifted to a third party, such as an insurer, through contract.
- D. Post implementation risk is not a recognized risk management term.
Question 91
Which of the following is the BEST indicator of a successful project?
Show answer and explanation
Correct answer: D. the deliverables are accepted by the key stakeholders
A project exists to deliver value to the organization, and the people who judge whether that value has been delivered are its key stakeholders. Formal acceptance of the deliverables shows that the output meets their needs and can be put to use. Budget and schedule performance are useful measures of how the project was managed, but a project that finishes on time and under budget with deliverables the stakeholders reject has still failed.
Why the other options are wrong
- A. Spending at or under budget shows cost control but says nothing about whether the result is usable.
- B. Meeting only most of the specifications means some requirements remain unmet, which is not a sign of success.
- C. Finishing on time measures schedule performance, not whether stakeholders receive what they need.
Question 92
The PRIMARY objective for information security program development should be:
Show answer and explanation
Correct answer: A. Reducing the impact of the risk to the business.
The primary objective of an information security program is to reduce the impact of risk to the business to a level that senior management finds acceptable. Every component of the program, including incident response, continuity planning, policy, awareness and the selection of security solutions, exists to serve that goal. Framing the program around business risk keeps it aligned with organizational objectives and gives leadership a clear basis for funding and measuring it.
Why the other options are wrong
- B. Incident response is one component of the program and serves the broader goal of reducing business risk.
- C. Business continuity requirements are only one area of risk, while the program must address risk to the business as a whole.
- D. Security solutions are a means of treating risk and should be chosen to fit business risk rather than pursued as an end.
Question 93
Which of the following is the MOST important component of any change management process?
Show answer and explanation
Correct answer: A. Outage planning
Change management exists to introduce changes while protecting the availability of business services, so its most important component is outage planning. Outage planning identifies which systems and business processes a change will affect, how long services may be unavailable, which maintenance window minimizes business impact, which stakeholders must be notified and how operations will continue if the change runs long or fails. It ties every change to its business impact, which is the perspective a CISO brings to change governance, and it provides the basis on which timing, approval and contingency decisions are made.
Why the other options are wrong
- B. Scheduling only sets the timing of a change and is itself chosen as a result of outage planning.
- C. Approval tracking records authorization decisions but does not assess or manage the impact of a change on service availability.
- D. Back-out procedures cover only the reversal of a failed change, a narrow step that does not address the broader business impact of the outage.
Question 94
Which of the following functions evaluates risk present in IT initiatives and/or systems when implementing an information security program?
Show answer and explanation
Correct answer: A. Risk Assessment
Risk assessment is the function that evaluates the risk present in IT initiatives and systems. Following approaches such as NIST SP 800-30 and ISO/IEC 27005, it identifies threats and vulnerabilities, estimates the likelihood that a threat will exploit a weakness, and determines the resulting impact on the business, producing a risk rating. These results then inform risk treatment decisions within the wider risk management process when an information security program is implemented.
Why the other options are wrong
- B. Risk management is the overall cycle of framing, treating and monitoring risk rather than the specific evaluation function.
- C. A vulnerability assessment identifies technical weaknesses without weighing threat likelihood and business impact.
- D. System testing verifies that a system functions as designed and does not evaluate business risk.
Question 95
You manage a newly created Security Operations Center (SOC), your team is being inundated with security alerts and don't know what to do.
What is the BEST approach to handle this situation?
Show answer and explanation
Correct answer: A. Tune the sensors to help reduce false positives so the team can react better
A newly built SOC commonly receives a flood of alerts because its sensors still use default rules that generate many false positives. Tuning the sensors to the organization's environment removes noise, improves the accuracy of the remaining alerts and lets analysts concentrate on genuine threats. Addressing the root cause of alert overload in this way reduces alert fatigue, shortens response times and makes the best use of the existing team before any other measures are considered.
Why the other options are wrong
- B. Adding staff to process a flood of false positives raises cost without fixing the cause of the overload.
- C. Asking an overwhelmed team to chase every alert leads to fatigue and missed real incidents.
- D. Ignoring medium and low alerts can miss early indicators of an attack, and untuned severity ratings may be inaccurate.
Question 96
When deploying an Intrusion Prevention System (IPS), the BEST way to get maximum protection from the system is to deploy it___________
Show answer and explanation
Correct answer: D. In-line and turn on blocking mode to stop malicious traffic in-line.
An intrusion prevention system gives the most protection when it sits in-line, directly in the traffic path, with blocking mode turned on. In this position every packet passes through the device, so it can drop or reset malicious traffic in real time before it reaches the systems it protects. The deployment should be tuned to keep false positives low and should fail in a way that matches the organization's availability needs. Run only in detection or alert mode, an IPS is effectively an intrusion detection system.
Why the other options are wrong
- A. Alert mode only reports malicious traffic and lets it through, so an in-line device in this mode does not stop attacks.
- B. A sensor in promiscuous mode sees a copy of the traffic and is outside the data path, so it cannot reliably block traffic as it passes.
- C. Detection-only monitoring in promiscuous mode gives visibility but does not prevent anything.
Question 97
An example of professional unethical behavior is:
Show answer and explanation
Correct answer: B. Copying documents from an employer's server which you assert that you have an intellectual property claim to possess, but the company disputes
Copying documents from an employer's server while the company disputes your intellectual property claim is unethical because you are taking material whose ownership is unresolved and acting as judge in your own favor. A professional settles a disputed claim through proper channels, such as management, legal counsel or the courts, and does not use system access to remove the material. Doing so breaches the trust placed in an employee with access to corporate systems and may also violate policy and law, regardless of how strongly the individual believes the claim.
Why the other options are wrong
- A. Sharing material among members who all have legitimate access to it does not breach copyright or professional ethics.
- C. Storing documents on a thumb drive may violate security policy, but an authorized person doing so is a practice issue rather than an ethical breach.
- D. Accessing an email account as part of an officially sanctioned internal investigation is authorized activity and therefore not unethical.
Question 98
What is the term describing the act of inspecting all real-time Internet traffic (i.e., packets) traversing a major Internet backbone without introducing any apparent latency?
Show answer and explanation
Correct answer: B. Traffic Analysis
Traffic analysis examines the observable characteristics of every packet in a flow, such as source and destination addresses, ports, protocols, sizes, timing and volume. Because it works on header and flow data collected passively, typically from optical taps or mirrored ports, rather than holding packets in line to reassemble and parse their payloads, it can be applied to all real-time traffic on a major Internet backbone without introducing any apparent latency. Carriers and intelligence agencies use it to map communication patterns, detect anomalies and attacks, and identify relationships between parties at a scale that content inspection cannot match.
Why the other options are wrong
- A. Deep packet inspection parses packet payloads in line, and doing so for all traffic at backbone scale imposes processing overhead and latency that the scenario rules out.
- C. Heuristic analysis is a detection technique that uses rules and behavioral indicators to flag suspicious activity, not the term for inspecting all backbone traffic.
- D. Packet sampling deliberately examines only a subset of packets, so it cannot describe inspecting all traffic.
Question 99
An IT auditor has recently discovered that because of a shortage of skilled operations personnel, the security administrator has agreed to work one late night shift a week as the senior computer operator.
The most appropriate course of action for the IT auditor is to:
Show answer and explanation
Correct answer: B. Inform senior management of the risk involved.
When the security administrator also works as senior computer operator, separation of duties is broken. One person can both run production processing and control the security settings that would detect misuse, so that person could make unauthorized changes and hide them. The auditor's job is to identify the control weakness and report the risk to senior management. Management owns the risk and decides whether to accept it, add compensating controls or restructure staffing. Auditors do not design operational fixes and do not take part in the work they audit.
Why the other options are wrong
- A. Reviewing logs is a detective step after the fact, and the same administrator may be able to change those logs, so management still needs to be told.
- C. Building a monitoring technique designs a control for management instead of reporting the risk so management can decide on treatment.
- D. Working the shifts would destroy the auditor's independence, because the auditor would become part of the operations being audited.
Question 100
A system was hardened at the Operating System level and placed into the production environment. Months later an audit was performed and it identified insecure configuration different from the original hardened state.
Which of the following security issues is the MOST likely reason leading to the audit findings?
Show answer and explanation
Correct answer: D. Lack of change management processes
The system was correctly hardened when it entered production, so the hardening standard existed and was applied. Months later its configuration had drifted to an insecure state, which means changes were made without review, approval, testing or tracking. A change management process requires every modification to production to be assessed for security impact and documented, and it supports configuration baselines that are compared against the running state. The absence of that process is the most likely cause of the finding.
Why the other options are wrong
- A. Asset management tracks what systems exist and who owns them, but it does not govern changes to their configuration.
- B. Hardening standards clearly existed, since the system was hardened before being placed in production.
- C. Access controls limit who can change a system, but authorized administrators can still make uncontrolled changes without change management.
Question 101
The rate of change in technology increases the importance of:
Show answer and explanation
Correct answer: D. Implementing and enforcing good processes.
Rapid technological change makes implementing and enforcing good processes more important. Well-defined processes for change management, risk assessment, procurement, configuration and project governance let an organization adopt new technology in a consistent, controlled and repeatable way, regardless of which tools or people are involved. Technologies come and go quickly, but sound processes persist and adapt, giving management assurance that each new system is evaluated, approved, secured and monitored before and after it enters production.
Why the other options are wrong
- A. Leading edge skills become outdated as quickly as the technology itself and cannot replace disciplined processes.
- B. User requirements matter for any system, but their importance does not grow with the pace of technological change.
- C. Outsourcing transfers work to a provider but still requires good processes to manage and govern that provider.
Question 102
A recommended method to document the respective roles of groups and individuals for a given process is to:
Show answer and explanation
Correct answer: C. Develop a Responsible, Accountable, Consulted, Informed (RACI) chart
A RACI chart is the recommended way to document the roles of groups and individuals for a given process. It maps each activity to who is Responsible for doing the work, who is Accountable for the outcome, who must be Consulted for input and who must be Informed of progress or decisions. This removes ambiguity, prevents gaps and overlaps in responsibility, and makes clear that each activity has exactly one accountable party.
Why the other options are wrong
- A. An organization chart shows reporting lines, not the roles people play in a specific process.
- B. An isolinear response matrix is not a recognized tool, and cost-benefit projections do not document roles.
- D. A telephone call tree supports emergency notification and does not define process roles.
Question 103
The FIRST step in establishing a security governance program is to?
Show answer and explanation
Correct answer: A. Obtain senior level sponsorship
Security governance is driven from the top, so the first step in establishing a governance program is obtaining senior level sponsorship. Executive sponsorship gives the program authority, defines accountability, secures funding and signals to the organization that security is a business priority. With that mandate in place, the program can then conduct risk assessments, prepare budgets and launch awareness activities. Without it, those later activities lack the authority and resources needed to succeed.
Why the other options are wrong
- B. Workshops for end users are awareness activities that come after the program has a mandate and direction.
- C. A risk assessment needs executive sponsorship and an agreed governance scope before it can drive decisions.
- D. A security budget cannot be approved or justified until senior management has sponsored the program.
Question 104
Which of the following international standards can be BEST used to define a Risk Management process in an organization?
Show answer and explanation
Correct answer: A. International Organization for Standardization 27005 (ISO-27005)
ISO/IEC 27005 provides guidance for information security risk management, covering context establishment, risk identification, analysis and evaluation, risk treatment, acceptance, communication and monitoring. It is designed to support the risk management requirements of ISO/IEC 27001, which makes it the best international standard for defining a risk management process in an organization. The other options address awareness training, payment card security and security measurement rather than the risk management process itself.
Why the other options are wrong
- B. NIST SP 800-50 addresses building a security awareness and training program, and it is a US government publication rather than an international standard.
- C. PCI DSS is an industry standard for protecting cardholder data, not a framework for defining a risk management process.
- D. ISO/IEC 27004 covers monitoring, measurement, analysis and evaluation of information security, not the risk management process.
Question 105
Risk appetite is typically determined by which of the following organizational functions?
Show answer and explanation
Correct answer: B. Board of Directors
Risk appetite is the amount and type of risk an organization is willing to pursue or retain in pursuit of its objectives, so it is a strategic governance decision. The board of directors, which holds ultimate oversight responsibility on behalf of shareholders and other stakeholders, sets the risk appetite in line with strategy. Senior management then translates it into risk tolerances and policies, and business units, security and assurance functions operate and report within those limits.
Why the other options are wrong
- A. Business units manage risk within their operations but work inside the appetite set by the board rather than defining it.
- C. Audit and compliance provide assurance on how risk is managed and do not set the organization's appetite.
- D. Security advises on risk and implements controls but does not determine how much risk the organization accepts.
Question 106
Regulatory requirements typically force organizations to implement ____________.
Show answer and explanation
Correct answer: B. Mandatory controls
Regulations impose legally binding obligations, so the controls they require are mandatory, and the organization must implement them regardless of its own cost-benefit preferences or risk appetite. Failure to implement them can bring fines, sanctions and legal liability. This distinguishes regulatory controls from discretionary controls, which the organization selects on the basis of its own risk assessment. Some regulations do address financial reporting, but the defining characteristic of controls driven by regulation is that they are mandatory.
Why the other options are wrong
- A. Financial controls are one subject area of control, and regulatory requirements span many areas beyond finance, such as privacy and security.
- C. Discretionary controls are chosen at management's judgment, which is the opposite of controls required by regulation.
- D. Optional controls are by definition not required, whereas regulations impose required controls.
Question 107
You currently cannot provide for 24/7 coverage of your security monitoring and incident response duties and your company is resistant to the idea of adding more full-time employees to the payroll.
Which combination of solutions would help to provide the coverage needed without the addition of more dedicated staff?
Show answer and explanation
Correct answer: D. Engage a managed security provider and have current staff on call for incident response
Engaging a managed security service provider delivers continuous 24/7 monitoring through a contracted service rather than added full-time employees. The provider watches events around the clock, triages alerts and escalates genuine incidents, while existing staff remain on call to make decisions and carry out incident response. This combination satisfies both constraints in the scenario: full coverage of monitoring and response duties without expanding the payroll. The contract should define service levels, escalation paths and reporting.
Why the other options are wrong
- A. An assumption of breach approach that defends only essential resources reduces protection and does not provide 24/7 monitoring.
- B. Reviewing incidents each morning leaves overnight events unaddressed for hours and does not provide continuous coverage.
- C. Text alerts from syslog lack analysis and triage, and they burden existing staff without delivering real 24/7 monitoring.
Question 108
Knowing the potential financial loss an organization is willing to suffer if a system fails is a determination of which of the following?
Show answer and explanation
Correct answer: B. Risk appetite
Risk appetite is the amount and type of risk, often expressed as a level of potential financial loss, that an organization is willing to accept in pursuit of its objectives. Knowing how much loss the organization is willing to suffer if a system fails is therefore a determination of risk appetite. Senior management sets the risk appetite, and it guides which risks are accepted and which must be reduced, transferred or avoided. The CISO uses it to prioritize controls and to present risk treatment options in business terms.
Why the other options are wrong
- A. Cost benefit analysis compares the cost of a control with the loss it prevents rather than defining acceptable loss.
- C. Business continuity concerns keeping critical functions running and recovering from disruption, not setting acceptable loss levels.
- D. Likelihood of impact describes the probability that a loss occurs, not how much loss the organization will accept.
Question 109
Which of the following best represents a calculation for Annual Loss Expectancy (ALE)?
Show answer and explanation
Correct answer: C. Single loss expectancy multiplied by the annual rate of occurrence
Annualized loss expectancy is the expected yearly loss from a specific risk, calculated as single loss expectancy multiplied by the annualized rate of occurrence (ALE = SLE x ARO). The SLE itself is the asset value multiplied by the exposure factor. For example, an SLE of 50,000 USD with an ARO of 0.5 gives an ALE of 25,000 USD. ALE helps justify controls by comparing their annual cost against the reduction in expected loss.
Why the other options are wrong
- A. Multiplying the asset value by a loss expectancy is not the ALE formula, because ALE requires the single loss expectancy and the annual rate of occurrence.
- B. Multiplying replacement cost by single loss expectancy is not a recognized formula and omits annual frequency.
- D. Total loss expectancy and total loss frequency are not standard terms in the ALE calculation.
Question 110
Which of the following BEST describes an international standard framework that is based on the security model Information Technology-Code of Practice for Information Security Management?
Show answer and explanation
Correct answer: C. International Organization for Standardization 27001
ISO/IEC 27001 is the international framework that grew out of the British Standard BS 7799, whose code of practice for information security management became ISO/IEC 17799 and later ISO/IEC 27002. ISO/IEC 27001 specifies the requirements for an information security management system and draws its reference control set from that code of practice, so the two documents work as a pair. It is also the only choice that is an international, certifiable standard, which is what the question asks for, while the other choices are national guidance or informational documents.
Why the other options are wrong
- A. NIST SP 800-12 is a United States introductory handbook on computer security, not an international standard built on the code of practice.
- B. RFC 2196 is an informational Site Security Handbook from the IETF, not an international management system standard.
- D. NIST SP 800-26 is a United States self-assessment guide for federal systems, not an international framework based on the code of practice.
Question 111
The formal certification and accreditation process has four primary steps, what are they?
Show answer and explanation
Correct answer: A. Evaluating, describing, testing and authorizing
The formal certification and accreditation process consists of evaluating, describing, testing and authorizing. The system and its risks are evaluated, the system boundary, security requirements and controls are described in documentation, the controls are tested to confirm they work as intended, and an authorizing official reviews the results and formally authorizes the system to operate by accepting the residual risk. This sequence moves from technical assessment to the management decision that the organization is willing to accept the remaining risk.
Why the other options are wrong
- B. Auditing and verifying are assurance activities, and the sequence omits the formal authorization by management.
- C. Purchasing is a procurement activity and is not a step in certification and accreditation.
- D. Discovery is not a formal step, and certifying cannot logically follow authorization, since certification supports the authorization decision.
Question 112
Scenario: Most industries require compliance with multiple government regulations and/or industry standards to meet data protection and privacy mandates.
What is one proven method to account for common elements found within separate regulations and/or standards?
Show answer and explanation
Correct answer: B. Develop a crosswalk
A crosswalk maps the requirements of multiple regulations, standards and frameworks against one another, often through a common control set, to show where they overlap and where each has unique requirements. Organizations can then implement a control once and use it as evidence for several obligations, reducing duplicated effort, audit fatigue and cost. Crosswalks are widely published, for example between NIST frameworks and ISO/IEC 27001, which makes them a proven method for managing multiple compliance mandates efficiently.
Why the other options are wrong
- A. Designing only to the strictest government standard can still miss unique requirements of other mandates and may impose unnecessary cost.
- C. Hiring a GRC expert adds staff but is not itself a method for identifying common requirements across mandates.
- D. A word processor search finds matching words but cannot map equivalent requirements that are worded differently.
Question 113
Scenario: You are the CISO and have just completed your first risk assessment for your organization. You find many risks with no security controls, and some risks with inadequate controls. You assign work to your staff to create or adjust existing security controls to ensure they are adequate for risk mitigation needs.
When formulating the remediation plan, what is a required input?
Show answer and explanation
Correct answer: D. Risk assessment
A remediation plan exists to treat the risks that the risk assessment identified, so the risk assessment is a required input. It documents each risk, its likelihood and impact, the controls that are missing or inadequate and the resulting risk ratings. Those results determine which controls must be created or adjusted, in what priority and with what resources, so that remediation targets the highest risks first and brings residual risk within the organization's risk appetite.
Why the other options are wrong
- A. The board of directors provides oversight and may approve funding, but it is not an input used to formulate the remediation plan.
- B. A virus definitions file is an operational update for antimalware tools and has no bearing on risk remediation planning.
- C. Patching history covers only one narrow control area and cannot describe the full set of risks and control gaps found.
Question 114
What is the definition of Risk in Information Security?
Show answer and explanation
Correct answer: A. Risk = Probability x Impact
In information security, risk is expressed as the combination of the likelihood that a threat event will occur and the impact or consequence if it does, commonly written as Risk = Probability x Impact. This formulation underpins standard risk assessment guidance such as NIST SP 800-30, and it is the basis for both qualitative risk matrices and quantitative measures such as annualized loss expectancy.
Why the other options are wrong
- B. A threat is a source of potential harm, and multiplying it by impact omits the likelihood of occurrence.
- C. Multiplying threat by probability omits the impact, which is essential to measuring risk.
- D. Impact includes operational, legal and reputational harm, so limiting it to financial impact does not define risk.
Question 115
The MOST common method to get an unbiased measurement of the effectiveness of an Information Security Management System (ISMS) is to_________________________.
Show answer and explanation
Correct answer: C. perform an independent audit of the security controls
An unbiased measurement of an information security management system requires independence from those who design and operate it. An independent audit of the security controls provides that objectivity, because the auditors have no stake in the results and test controls against defined criteria. ISO/IEC 27001 itself requires internal audits performed by objective and impartial auditors, and certification adds an external audit. Measurements produced by the security team or control owners are useful for management, but they cannot be considered unbiased.
Why the other options are wrong
- A. The information security team runs the ISMS and has a stake in showing it works, so its measurement is not unbiased.
- B. The team managing the controls would be evaluating its own work, which lacks independence.
- D. Operational reports are produced by those operating the controls and reflect self-assessment rather than independent measurement.
Question 116
Information security policies should be reviewed _____________________.
Show answer and explanation
Correct answer: D. by stakeholders at least annually
Information security policies should be reviewed by stakeholders at least annually, and also whenever significant changes occur in the business, technology, threats, or regulatory environment. Involving stakeholders keeps policies aligned with business objectives and secures ownership and support across the organization, while an annual cycle ensures that no policy drifts out of date. This approach is consistent with ISO/IEC 27001 and common governance practice, which expect policies to be reviewed at planned intervals by those accountable for them.
Why the other options are wrong
- A. Internal audit provides independent assurance and should not own the review of policies it later audits, and a fixed semiannual cycle is not the expected baseline.
- B. Reviewing only when new systems come online is event driven and leaves policies unreviewed for long periods, and the CISO alone is not the full stakeholder group.
- C. The incident response team is not responsible for policy governance, and tying reviews to audits does not create a regular review cycle.
Question 117
The effectiveness of an audit is measured by?
Show answer and explanation
Correct answer: D. How the recommendations directly support the goals of the company
An audit delivers value when its recommendations help the organization achieve its goals. The effectiveness of an audit is therefore measured by how directly its recommendations support business objectives, for example by reducing risk to critical processes, improving control efficiency or enabling compliance that the business depends on. This reflects the CISO view that security and assurance activities exist to serve the business. Recommendations that are numerous but disconnected from business goals consume resources without improving the organization's position.
Why the other options are wrong
- A. The number of controls in use measures the control environment, not the effectiveness of the audit.
- B. Exposing risk tolerance is not the purpose of an audit and does not measure its value.
- C. Counting actionable items measures volume, and many recommendations can still fail to address what matters to the business.
Question 118
Your incident response plan should include which of the following?
Show answer and explanation
Correct answer: C. Procedures for reclamation
An incident response plan must cover the full lifecycle of preparation, detection and analysis, containment, eradication, recovery and post-incident activity. Reclamation refers to recovering and restoring affected systems, data and services to a trusted operating state after the threat has been removed, and it is a required component of the plan. Without defined reclamation procedures, the organization may restore compromised systems, reintroduce the threat or prolong the outage.
Why the other options are wrong
- A. Classification procedures do not cover reclaiming and restoring affected systems after an incident, which the plan must define.
- B. Charge-back is a financial cost allocation mechanism, not an incident response procedure.
- D. Litigation is led by legal counsel and is not the procedure that restores systems to a trusted state after an incident.
Question 119
Human resource planning for security professionals in your organization is a:
Show answer and explanation
Correct answer: A. Training requirement that is on-going and always changing.
Human resource planning for security professionals is an ongoing training requirement that keeps changing. Threats, attack techniques, technologies, regulations and business priorities all evolve, so the skills the security team needs today will not be enough next year. A CISO therefore treats workforce planning as a continuous cycle: assess current skills against program needs, identify gaps, fund training and certification, and revisit the plan as the environment and strategy change. This keeps the team capable of supporting the business and managing emerging risk.
Why the other options are wrong
- B. Threats are becoming more sophisticated and harder to detect, so planning for security staff is neither simple nor easy.
- C. A single annual user awareness session cannot keep security professionals current with a constantly changing threat landscape.
- D. Automation and anti-virus tools have not eliminated threats, and skilled people are still needed to manage risk and operate controls.
Question 120
An anonymity network is a series of?
Show answer and explanation
Correct answer: B. Virtual network tunnels
An anonymity network is a series of virtual network tunnels. Traffic is wrapped in layers of encryption and relayed through several nodes, each of which knows only the previous and next hop, so no single point can link the sender to the destination. Tor is the best known example. Security leaders should understand these networks because they can protect privacy and also allow attackers or insiders to hide the origin of traffic and bypass monitoring controls.
Why the other options are wrong
- A. Anonymity networks are open to the public and are not covert government networks.
- C. Tor is a volunteer-operated relay network, not a set of government networks.
- D. War driving maps record the locations of wireless networks and have nothing to do with anonymizing traffic.
Question 121
Creating good security metrics is essential for a CISO.
What would be the BEST sources for creating security metrics for baseline defenses coverage?
Show answer and explanation
Correct answer: B. Firewall, anti-virus console, IDS, syslog
Metrics for baseline defense coverage should come from the systems that actually enforce and observe security controls. The firewall shows perimeter policy enforcement and blocked traffic, the anti-virus console shows endpoint protection coverage and detections, the intrusion detection system shows attempted attacks, and syslog aggregates security events across hosts. Together these feeds show how widely and how well the baseline defenses are deployed and operating across the environment.
Why the other options are wrong
- A. Servers, routers, switches and modems are infrastructure, not dedicated security controls that report defensive coverage.
- C. Exchange and web servers are business applications and do not measure defensive coverage.
- D. Routers and switches are network infrastructure, and this set omits firewall and anti-virus data on core defenses.
Question 122
The single most important consideration to make when developing your security program, policies, and processes is:
Show answer and explanation
Correct answer: A. Alignment with the business
Alignment with the business is the foundation of any security program, policy set or process. Security exists to protect and enable the mission of the organization, so its objectives, priorities and investments must be derived from business goals and the risk appetite set by senior management. A program built this way earns executive sponsorship, funding and stakeholder support, while a program that ignores business needs is viewed as an obstacle and is bypassed or defunded regardless of its technical quality.
Why the other options are wrong
- B. Budgeting for unforeseen compromises is a financial planning detail that follows from business priorities rather than shaping the program.
- C. Authority for the security executive comes from the business mandate and governance structure, so asserting it is not the starting consideration.
- D. Streamlining for efficiency is an operational concern with no bearing on how the program, policies and processes are designed.
Question 123
How often should the Statements of Standards for Attestation Engagements-16 (SSAE16)/International Standard on Assurance Engagements 3402 (ISAE3402) report of your vendors be reviewed?
Show answer and explanation
Correct answer: A. Annually
Service organizations typically issue their SSAE 16 or ISAE 3402 reports once a year, each covering a defined period of control operation. Reviewing vendor reports annually keeps the review cycle aligned with each new report, confirms that the controls the organization relies on are still described and operating effectively, and allows exceptions and complementary user entity controls to be addressed promptly as part of ongoing vendor risk management.
Why the other options are wrong
- B. Quarterly review does not match the annual issuance of the report, so most reviews would examine nothing new.
- C. A bi-annual cycle does not match the yearly issuance of the report and leaves reviews out of step with each new attestation.
- D. Semi-annual review would repeatedly revisit the same report because a new one is normally issued only once a year.
Question 124
What is the main purpose of the Incident Response Team?
Show answer and explanation
Correct answer: C. Ensure efficient recovery and reinstate repaired systems
The incident response team exists to limit the damage from a security incident and get the business back to normal operations quickly and safely. It contains the incident, removes the cause, recovers efficiently and puts repaired, verified systems back into service. This matches the containment, eradication and recovery phases in NIST SP 800-61. Fast, orderly recovery cuts downtime, financial loss and reputational harm. Communication, policy writing and awareness training are supporting or separate functions handled elsewhere in the security program.
Why the other options are wrong
- A. Sharing incident details supports the response and is often handled with public relations and legal, but it is not the team's main purpose.
- B. Writing program policy is a governance function owned by security leadership, not the purpose of the incident response team.
- D. Employee awareness programs are a preventive activity run by the security awareness function, not the incident response team.
Question 125
Creating a secondary authentication process for network access would be an example of?
Show answer and explanation
Correct answer: B. Supporting the concept of layered security
Adding a secondary authentication process for network access is an example of layered security, also called defense in depth. Several independent controls protect the same resource, so if one layer fails, for example a stolen password, the attacker still has to get past another layer before gaining access. Layered controls lower the chance that a single weakness leads to a compromise. This is a basic design principle that a CISO uses when building a security architecture that can withstand attacks.
Why the other options are wrong
- A. A second authentication layer is a deliberate risk-reduction control, not a sign of idle administrative time.
- C. Network segmentation divides the network into separate zones and has nothing to do with adding authentication steps.
- D. The administrative effort is a planned cost of a justified control, not an undue burden, and it does not describe what the control represents.
Question 126
The framework that helps to define a minimum standard of protection that business stakeholders must attempt to achieve is referred to as a standard of:
Show answer and explanation
Correct answer: C. Due Care
Due care is the standard of reasonable protection that a prudent organization is expected to provide for the assets and information entrusted to it. It establishes the minimum level of safeguards that business stakeholders must attempt to achieve, and failing to meet it can expose the organization and its leaders to negligence claims. Due care is closely paired with due diligence, the ongoing effort to investigate risks and verify that those protections remain effective.
Why the other options are wrong
- A. Due compromise is not a recognized legal or security standard.
- B. Due process refers to fair legal procedures and the rights of individuals, not a minimum standard of protection.
- D. Due protection is not a recognized standard; the established term for reasonable minimum protection is due care.
Question 127
You have implemented a new security control.
Which of the following risk strategy options have you engaged in?
Show answer and explanation
Correct answer: B. Risk Mitigation
Implementing a new security control is risk mitigation, sometimes called risk reduction. Mitigation keeps the activity in place but applies safeguards that lower the likelihood of a threat event, its impact, or both, until the remaining residual risk falls within the organization's risk tolerance. It is the most common form of risk treatment and stands apart from transferring risk to another party, avoiding the activity altogether, or knowingly accepting the risk as it stands.
Why the other options are wrong
- A. Risk transfer shifts the financial consequences to another party, such as an insurer, rather than adding a control.
- C. Risk avoidance eliminates the risky activity entirely instead of protecting it with a control.
- D. Risk acceptance means taking no further action and living with the risk, not implementing a new control.
Question 128
Which of the following tests is performed by an Information Systems (IS) auditor when a sample of programs is selected to determine if the source and object versions are the same?
Show answer and explanation
Correct answer: C. A compliance test of program library controls
Comparing the source and object versions of a sample of programs tells the auditor whether program library controls are working as designed. If the versions match, the library has not received unauthorized or untracked changes, and production code still matches its approved source. A test that checks whether a control operates as intended is a compliance test. A substantive test looks at the accuracy and completeness of transactions, balances or data. The control being tested here is program library management (version control and change control), not the compiler.
Why the other options are wrong
- A. Checking that versions match tests whether a control is operating, which makes it a compliance test, not a substantive test.
- B. The test checks the integrity of programs held in the library, not the behavior of the compiler.
- D. This is neither a substantive test nor a test of compiler controls, because it checks whether library version controls are operating.
Question 129
Which of the following is a benefit of information security governance?
Show answer and explanation
Correct answer: B. Reduction of the potential for civil and legal liability
Information security governance gives the organization a structured, accountable way to manage security risk: clear policies, defined roles, oversight by senior management and documented decisions. These elements demonstrate due care and due diligence and support compliance with laws, regulations and contracts. As a result, a key benefit of governance is a reduced potential for civil and legal liability, because the organization can show that it acted responsibly and took reasonable steps to protect information.
Why the other options are wrong
- A. Senior management provides direction and oversight in governance, while developing control processes is delegated to management and staff.
- C. Questioning trust in vendor relationships is not an outcome or benefit of governance.
- D. Governance reduces, not increases, the risk of decisions based on incomplete management information.
Question 130
During the course of a risk analysis your IT auditor identified threats and potential impacts. Next, your IT auditor should:
Show answer and explanation
Correct answer: B. Identify and evaluate existing controls.
Once threats and their potential impacts have been identified, the next step in risk analysis is to identify and evaluate the controls already in place. Existing controls reduce how likely a threat is to succeed and how much damage it causes, so they have to be understood before the remaining risk can be measured. This shows how much residual risk remains and whether more safeguards are needed. NIST SP 800-30 follows the same order, looking at threats and vulnerabilities, then controls, then likelihood, impact and risk.
Why the other options are wrong
- A. Assessing management's risk assessment process is not the next analytical step after threats and impacts have been identified.
- C. Information assets and their supporting systems are identified at the start of risk analysis, before threats and impacts.
- D. Reporting to management comes after controls are evaluated and residual risk is determined, so the full risk picture is presented.
Question 131
Which of the following functions MUST your Information Security Governance program include for formal organizational reporting?
Show answer and explanation
Correct answer: B. Audit and Legal
For formal organizational reporting, an information security governance program must include Audit and Legal. Internal Audit gives independent assurance on how effective controls are and reports to the board or audit committee, which makes security reporting credible. Legal interprets regulatory, contractual and liability obligations and advises on disclosure and how to handle issues. Together they make sure governance reporting is accurate, defensible and complete. This supports accountability to senior management and the board for how information security risk is managed.
Why the other options are wrong
- A. Human Resources and Budget support the program, but neither gives the independent assurance and legal oversight that formal reporting needs.
- C. Budget is a resource function, not a formal reporting channel for governance oversight.
- D. Human Resources supports personnel security but does not give the independent assurance needed for formal governance reporting.
Question 132
The exposure factor of a threat to your organization is defined by?
Show answer and explanation
Correct answer: B. Percentage of loss experienced due to a realized threat event
Exposure factor is the percentage of an asset's value that would be lost if a specific threat event occurred. It is a key input to quantitative risk analysis: single loss expectancy equals asset value times exposure factor, and annualized loss expectancy equals single loss expectancy times the annualized rate of occurrence. For example, a 500,000 dollar asset with a 40 percent exposure factor has a single loss expectancy of 200,000 dollars.
Why the other options are wrong
- A. Subtracting the cost of controls from annualized loss expectancy is part of a cost-benefit analysis, not the definition of exposure factor.
- C. Asset value times exposure factor is the formula for single loss expectancy, not exposure factor.
- D. The annualized rate of occurrence measures how often a threat is expected to occur, not the percentage of loss.
Question 133
When dealing with a risk management process, asset classification is important because it will impact the overall:
Show answer and explanation
Correct answer: A. Threat identification
Risk assessment guidance such as ISO/IEC 27005 begins by identifying and classifying assets, and only then identifies the threats that could harm them. Classification records the value, sensitivity and criticality of each asset, which tells the organization which assets deserve close attention and therefore which threat sources and threat events must be examined in depth. Because threats are always identified against specific assets, the way assets are classified directly shapes the scope and focus of threat identification, and that step in turn feeds every later stage of the risk management process.
Why the other options are wrong
- B. Risk treatment is selected after risks have been identified and analyzed, so it responds to the assessed risk rather than being the step that classification directly shapes.
- C. Risk monitoring tracks risks and controls over time and is a downstream activity, not the step that classification directly shapes.
- D. Risk tolerance is set by senior management as a business decision and is not determined by classifying assets.
Question 134
Which of the following best describes the purpose of the International Organization for Standardization (ISO) 27002 standard?
Show answer and explanation
Correct answer: B. To establish guidelines and general principles for initiating, implementing, maintaining and improving information security management within an organization
ISO/IEC 27002 is the code of practice for information security controls. Its stated scope is to establish guidelines and general principles for initiating, implementing, maintaining and improving information security management within an organization. It supports the ISO/IEC 27001 management system by providing detailed control guidance that organizations use when selecting and implementing controls. The remaining statements are fragments of the older code of practice wording that described intended uses and benefits rather than the purpose and scope of the standard itself.
Why the other options are wrong
- A. Effective management practice and confidence in interorganizational dealings are described benefits of applying the guidance, not the purpose of the standard.
- C. Offering recommendations to individuals responsible for security reflects the intended audience in older wording, not the defining purpose of ISO/IEC 27002.
- D. Serving as a common basis for organizational standards is a stated use of the guidance, not its primary purpose.
Question 135
Security related breaches are assessed and contained through which of the following?
Show answer and explanation
Correct answer: D. Incident response
Incident response is the formal capability through which security breaches are detected, assessed, contained, eradicated and recovered from. NIST SP 800-61 describes this lifecycle as preparation, detection and analysis, containment, eradication and recovery, and post-incident activity. Assessment determines the scope and severity of the breach, and containment limits further damage while evidence is preserved. The incident response team coordinates technical staff, management, legal counsel and communications so that breaches are handled consistently rather than ad hoc.
Why the other options are wrong
- A. The IT support team may assist during an incident, but it is not the structured process responsible for assessing and containing breaches.
- B. Forensic analysis investigates and preserves evidence as one activity within incident response and does not itself contain the breach.
- C. The physical security team protects facilities and people and is not responsible for assessing and containing information security breaches.
Question 136
Scenario: You are the newly hired Chief Information Security Officer for a company that has not previously had a senior level security practitioner.
The company lacks a defined security policy and framework for their Information Security Program. Your new boss, the Chief Financial Officer, has asked you to draft an outline of a security policy and recommend an industry/sector neutral information security control framework for implementation.
Your Corporate Information Security Policy should include which of the following?
Show answer and explanation
Correct answer: A. Roles and responsibilities
A corporate information security policy is a high-level governance document that states management's intent, scope and objectives and assigns roles and responsibilities. Defining who is accountable, from executive management and the CISO to data owners, custodians and users, is essential because it establishes accountability and authority for the whole program. Detailed operational content such as contact lists or configuration settings belongs in lower-level procedures and standards, which can change frequently without reopening the policy.
Why the other options are wrong
- B. Information security theory is educational background material and does not belong in an organizational policy.
- C. Incident response contacts change often and belong in incident response procedures or playbooks, not the corporate policy.
- D. Desktop configuration standards are technical specifications documented in separate standards that support the policy.
Question 137
The process of creating a system which divides documents based on their security level to manage access to private data is known as ____________________.
Show answer and explanation
Correct answer: D. data classification
Data classification is the process of organizing information into categories according to its sensitivity, value and criticality, such as public, internal, confidential and restricted. Each level is tied to handling, labeling and access requirements, so the classification scheme drives who may access private data and how it must be protected. Data owners assign classifications, and custodians apply the corresponding controls. A defined classification system lets the organization focus its strongest protections on its most sensitive information instead of protecting everything equally.
Why the other options are wrong
- A. Security coding refers to writing software securely and has nothing to do with sorting documents by security level.
- B. Privacy protection is a broad objective for safeguarding personal data, not the process of grouping documents by sensitivity.
- C. Data security system is a generic phrase and not the recognized name for categorizing information by security level.
Question 138
You are the CISO of a commercial social media organization. The leadership wants to rapidly create new methods of sharing customer data through creative linkages with mobile devices. You have voiced concern about privacy regulations but the velocity of the business is given priority.
Which of the following BEST describes this organization?
Show answer and explanation
Correct answer: C. Risk tolerant
Leadership has heard the CISO raise privacy regulation concerns and has still chosen to prioritize business velocity in new ways of sharing customer data. That is a conscious decision to accept a higher level of regulatory, legal and reputational risk in pursuit of growth, which is the defining trait of a risk tolerant organization. The CISO has properly advised, and the business has exercised its right to own the risk decision. A risk tolerant posture still requires the CISO to document the accepted risk and keep leadership informed as exposure changes.
Why the other options are wrong
- A. Risk conditional is not a recognized description of an organizational risk posture.
- B. Risk minimal would describe an organization seeking the lowest possible exposure, the opposite of overriding privacy concerns for speed.
- D. A risk averse organization would have slowed or halted the initiative to address the privacy concerns before proceeding.
Question 139
Which of the following is a fundamental component of an audit record?
Show answer and explanation
Correct answer: B. Date and time of the event
The date and time of the event is a basic part of every audit record. Without a reliable timestamp, events cannot be put in order, linked across systems or used to rebuild a timeline in an investigation. NIST SP 800-53 audit content requirements include when an event occurred, along with the type of event, where it occurred, its source, its outcome and the identity involved. Synchronized clocks make timestamps trustworthy across the environment and support accountability, forensic analysis and the evidential value of logs.
Why the other options are wrong
- A. An originating IP address is useful for network events, but many audit records, such as local system or application events, do not have one.
- C. Audit records capture the outcome of an event, success or failure, not only failures, so failure alone is not a basic component.
- D. Authentication type only applies to authentication events and is not part of every audit record.
Question 140
As the CISO, you need to create an IT security strategy.
Which of the following is the MOST important thing to review before you start writing the plan?
Show answer and explanation
Correct answer: C. The company business plan
The company business plan is the most important input to review before writing an IT security strategy. Security exists to enable and protect the business, so the strategy must be built on the organization's objectives, planned initiatives, markets and priorities. Knowing where the business is heading tells the CISO which assets and processes matter most, which risks threaten those goals and where investment will deliver value. The current environment, budget and technology trends are then assessed in light of that business direction.
Why the other options are wrong
- A. The existing IT environment is assessed afterward, in light of what the business needs, and does not set the strategic direction.
- B. Technology trends at other companies do not reflect this organization's objectives and should not drive its security strategy.
- D. The present budget is a constraint to work within, not the basis for deciding what the strategy must achieve.
Question 141
Your penetration testing team installs an in-line hardware key logger onto one of your network machines.
Which of the following is of major concern to the security organization?
Show answer and explanation
Correct answer: A. In-line hardware keyloggers are undetectable by software
The major concern with in-line hardware keyloggers is that software cannot detect them. The device sits between the keyboard and the computer and captures keystrokes, including passwords, without installing any code, so anti-malware tools, endpoint agents and host monitoring do not see it. Detection depends on physical inspection of workstations, port controls and tamper-evident measures. The penetration test shows that physical security and regular hardware inspection are essential parts of defense in depth.
Why the other options are wrong
- B. Low cost makes the devices accessible, but that does not change the organization's ability to detect them.
- C. In-line hardware keyloggers must be physically attached to the machine, so the claim is false.
- D. Regulatory compliance is not the issue, because the threat lies in covert capture of keystrokes.
Question 142
After a risk assessment is performed, a particular risk is considered to have the potential of costing the organization 1.2 Million USD.
This is an example of____________.
Show answer and explanation
Correct answer: C. Quantitative risk analysis
Expressing a risk as a potential cost of 1.2 million USD assigns it a specific monetary value, which is the defining feature of quantitative risk analysis. Quantitative methods use numeric values such as asset value, single loss expectancy, annualized rate of occurrence and annualized loss expectancy to express risk in financial terms. Qualitative analysis, by contrast, rates risk with descriptive scales such as high, medium and low, while risk appetite and risk tolerance describe acceptance levels rather than analysis methods.
Why the other options are wrong
- A. Qualitative risk analysis uses descriptive ratings such as high, medium and low rather than specific dollar amounts.
- B. Risk appetite is the amount of risk an organization is willing to pursue, not a measured cost of a single risk.
- D. Risk tolerance is the acceptable variation around objectives, not an estimate of what a specific risk could cost.
Question 143
Which of the following is considered a project versus a managed process?
Show answer and explanation
Correct answer: D. installation of a new firewall system
A project is a temporary endeavor with a defined start, a defined end and a unique deliverable, while a managed process is an ongoing, repeatable operational activity. Installing a new firewall system fits the definition of a project: it has specific objectives, a scope, a schedule, resources and a clear completion point when the firewall is in production. Once installed, operating and maintaining the firewall becomes part of managed processes. Ongoing risk assessment, continuous vulnerability management and monitoring during incident response are recurring activities with no fixed end.
Why the other options are wrong
- A. Ongoing risk assessment of routine operations is a continuous activity, which makes it a managed process.
- B. Continuous vulnerability assessment and repair is a recurring operational cycle, which makes it a managed process.
- C. Monitoring the environment during incident response is part of an established operational process rather than a temporary project.
Question 144
The newly appointed CISO of an organization is reviewing the IT security strategic plan.
Which of the following is the MOST important component of the strategic plan?
Show answer and explanation
Correct answer: A. There is a clear definition of the IT security mission and vision.
A clear definition of the IT security mission and vision is the most important component of the strategic plan. The mission states why the security program exists and how it serves the business, and the vision describes the future state the program is working toward. Every goal, initiative, metric and budget request in the plan should trace back to them. Without a clear mission and vision, the plan lacks direction and the CISO cannot show stakeholders how security supports the organization.
Why the other options are wrong
- B. Requiring return on investment for every project is impractical for many security controls and is not the core of a strategic plan.
- C. Staffing integration is an operational detail that supports the plan rather than defining it.
- D. An auditing methodology verifies controls and does not set the strategic direction of the program.
Question 145
Risk that remains after risk mitigation is known as_____________.
Show answer and explanation
Correct answer: B. Residual risk
Residual risk is the risk that remains after controls and other mitigation measures have been applied. Because no control eliminates risk entirely, some exposure always remains, and management must compare that residual risk against its risk tolerance. If it falls within tolerance, the risk owner formally accepts it; if not, further treatment is required. Tracking residual risk is central to frameworks such as NIST SP 800-39 and ISO/IEC 27005.
Why the other options are wrong
- A. Accepted risk is risk that management decides to tolerate, which is a decision made about the residual risk.
- C. Non-tolerated risk is not a standard term for the risk remaining after mitigation.
- D. Persistent risk is not a standard risk management term for what remains after controls are applied.
Question 146
Which of the following is considered one of the most frequent failures in project management?
Show answer and explanation
Correct answer: D. Failure to meet project deadlines
Failure to meet project deadlines is one of the most frequently reported failures in project management. Industry surveys consistently show that a large share of projects finish late, as schedules slip because of poor estimates, scope creep, dependencies and changing priorities. A missed deadline is the visible failure that stakeholders experience, delaying expected benefits and often increasing costs, which is why schedule control is a central concern of project management frameworks such as PMBOK.
Why the other options are wrong
- A. Overly restrictive management is an occasional problem rather than one of the most common project failures.
- B. Insufficient resources is a contributing cause of trouble rather than the failure that projects most often record.
- C. Excessive personnel is an uncommon situation and is not a typical project failure.
Question 147
Which of the following functions implements and oversees the use of controls to reduce risk when creating an information security program?
Show answer and explanation
Correct answer: B. Risk Management
Risk management is the function that implements and oversees controls to reduce risk to an acceptable level. It spans the full cycle of identifying and assessing risks, selecting and implementing appropriate controls, and continuously monitoring their effectiveness, in line with frameworks such as NIST SP 800-39 and ISO/IEC 27005. When building an information security program, risk management provides the structure that connects business risk appetite to the selection and oversight of controls across all areas of the organization.
Why the other options are wrong
- A. Risk assessment identifies and evaluates risks but is only one step within risk management and does not oversee controls.
- C. Incident response handles security events after they occur rather than overseeing controls across the program.
- D. Network security administration is a narrow technical function and does not oversee controls across the whole program.
Question 148
Which of the following is a symmetric encryption algorithm?
Show answer and explanation
Correct answer: A. 3DES
Triple DES (3DES) is a symmetric block cipher, meaning the same secret key material is used to encrypt and decrypt. It applies the DES algorithm three times to each 64-bit block, typically in an encrypt-decrypt-encrypt sequence with two or three keys, to overcome the short key length of single DES. 3DES is now deprecated in favor of AES, but it remains a standard example of symmetric encryption.
Why the other options are wrong
- B. RSA is an asymmetric algorithm that uses a mathematically related public and private key pair.
- C. Elliptic curve cryptography is an asymmetric approach based on public and private key pairs.
- D. MD5 is a hash function that produces a fixed-length digest and does not encrypt or decrypt data.
Question 149
An organization's Information Security Policy is of MOST importance because_____________.
Show answer and explanation
Correct answer: C. It communicates management's commitment to protecting information resources
The information security policy is a high-level statement of management intent, and its greatest importance is that it communicates management's commitment to protecting information resources. That visible commitment gives the security program its authority, sets expectations for everyone in the organization and provides the mandate from which standards, procedures and guidelines are derived. Compliance processes, protective frameworks and employee acknowledgments all depend on the authority that this expression of management commitment provides.
Why the other options are wrong
- A. Processes for meeting compliance requirements are defined in procedures and standards, not in the high-level policy.
- B. The detailed protective framework is built from standards and controls that derive their authority from the policy's statement of commitment.
- D. Formal acknowledgment by employees and vendors is an implementation mechanism, not the reason the policy matters.
Question 150
When you develop your audit remediation plan what is the MOST important criteria?
Show answer and explanation
Correct answer: B. To validate that the cost of the remediation is less than risk of the finding.
A remediation plan should be driven by risk and cost. For each finding, the CISO should confirm that the cost of remediation is justified by the risk it reduces, so that resources go first to the findings where spending produces the greatest risk reduction. Where remediation costs more than the risk, the business owner can formally accept the risk instead. This cost-benefit test keeps the plan defensible to management and aligned with the organization's risk appetite.
Why the other options are wrong
- A. Auditors must remain independent, so they assess the outcome rather than validate or own management's remediation process.
- C. Remediating an arbitrary half of the findings ignores their relative risk.
- D. Fixing every finding regardless of cost or risk is rarely achievable and misallocates resources.
Question 151
Which of the following information may be found in table top exercises for incident response?
Show answer and explanation
Correct answer: B. Process improvements
A tabletop exercise walks incident response team members through a simulated scenario in a discussion setting to test plans, roles, communications and decision making without affecting live systems. Its principal output is a set of lessons learned: gaps in procedures, unclear responsibilities and communication breakdowns, which are captured as process improvements to the incident response plan. NIST SP 800-84 describes tabletop exercises in this way, as a means of validating and improving response capabilities.
Why the other options are wrong
- A. A tabletop exercise is a discussion of a simulated event, so it produces no real-time remediation measurements.
- C. Budget increases are decided through the financial planning process, not produced by an incident response exercise.
- D. Control selection belongs to risk assessment and system design activities rather than incident response exercises.
Question 152
According to ISO 27001, of the steps for establishing an Information Security Governance program listed below, which comes first?
Show answer and explanation
Correct answer: B. Define Information Security Policy
ISO/IEC 27001 has management start the information security management system by setting its direction, which means defining scope and establishing the information security policy. The policy states management's commitment and security objectives and gives the framework for the risk-related work that follows. Only after that does the organization define how it will assess and treat risk, identify threats, vulnerabilities and impacts, and decide how to manage the risks found. Resources are then allocated to support the treatment plan.
Why the other options are wrong
- A. Deciding how to manage risk comes after risks have been identified and assessed under the direction the policy sets.
- C. Identifying threats, risks, impacts and vulnerabilities is part of risk assessment, which comes after the policy is established.
- D. The ISMS budget is set once risks and treatment needs are known, not as the first step.
That was 152 of 606.
The full EC-Council 712-50 CCISO pack has all 606 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 303 free as one PDF by email. Get the Half Pack →