312 free ISACA CISM practice questions from the CertStash pack of 1,250, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 312 free here, all 1,250 in the pack, and each step includes the one before it.
Get all 1,250 questions (US$39) · Download the first 10 as a PDF · Read the study guide
Question 1
An information security risk analysis BEST assists an organization in ensuring that:
Show answer and explanation
Correct answer: B. cost-effective decisions are made with regard to which assets need protection
Risk analysis fundamentally helps organizations prioritize their security investments by identifying which assets face the greatest threats and require protection. This directly enables cost-effective decision-making about where limited security resources should be allocated. While risk analysis informs other decisions like access control and technology selection, the BEST overall purpose is ensuring resources are spent efficiently on protecting critical assets.
Why the other options are wrong
- A. Risk analysis informs access control decisions but doesn't ensure their implementation.
- C. While risk analysis guides funding decisions, it doesn't directly apply funding itself.
- D. Risk analysis informs technology choices but doesn't mandate specific technologies.
Question 2
In a multinational organization, local security regulations should be implemented over global security policy because:
Show answer and explanation
Correct answer: D. requirements of local regulations take precedence.
Legal and regulatory requirements are mandatory obligations that take precedence over internal policies. If local regulations exist, they represent binding legal requirements that the organization must meet regardless of global policy preferences. Non-compliance with local regulations can result in legal penalties, fines, and loss of operating licenses, making regulatory requirements the ultimate authority in any jurisdiction.
Why the other options are wrong
- A. Business objectives don't override regulatory requirements; compliance is mandatory.
- B. Practicality of awareness doesn't determine which requirements apply.
- C. Global policies may contain necessary controls; the real issue is that local regulations are mandatory.
Question 3
To gain a clear understanding of the impact that a new regulatory requirement will have on an organization's information security controls, an information security manager should FIRST:
Show answer and explanation
Correct answer: D. perform a gap analysis.
A gap analysis is the FIRST appropriate step because it directly compares the organization's existing security controls against the new regulatory requirements, clearly identifying what is missing or inadequate. This establishes baseline understanding before committing resources. While risk assessment and cost-benefit analysis follow logically afterward, the gap analysis provides the foundational understanding of what controls need to be added or modified to meet the new requirement.
Why the other options are wrong
- A. Cost-benefit analysis requires knowing the gap first.
- B. Risk assessment comes after understanding the specific gaps.
- C. Management interviews provide business context but not technical understanding of control gaps.
Question 4
When management changes the enterprise business strategy, which of the following processes should be used to evaluate the existing information security controls as well as to select new information security controls?
Show answer and explanation
Correct answer: D. Risk management
Risk management is the comprehensive process that evaluates how business strategy changes affect the organizational threat landscape, identifies new risks, and determines both whether existing controls remain adequate and what new controls are needed. Risk management encompasses the systematic evaluation and selection of controls in response to strategic shifts. While change management is also important operationally, risk management is the process specifically designed to evaluate and select controls based on new business contexts.
Why the other options are wrong
- A. Access control management addresses a specific control type, not the overall evaluation needed.
- B. Change management handles implementation but not the control evaluation and selection process.
- C. Configuration management tracks settings but doesn't evaluate control adequacy or select new controls.
Question 5
Which of the following is the BEST way to build a risk-aware culture?
Show answer and explanation
Correct answer: D. Establish incentives and a channel for staff to report risks.
Establishing incentives and channels for staff to report risks creates a proactive, participatory risk-aware culture where employees feel empowered and rewarded for contributing to organizational security. This bottom-up engagement is more effective for building sustained cultural change than top-down messaging or testing. When employees are encouraged and motivated to identify and report risks, they become active participants in risk management rather than passive recipients of information.
Why the other options are wrong
- A. Changing messages periodically doesn't build sustained awareness or behavioral change.
- B. Communicating threats is reactive and doesn't necessarily build a culture of proactive risk management.
- C. Testing compliance and posting results is accountability-focused but doesn't encourage proactive risk reporting.
Question 6
What would be an information security manager's BEST recommendation upon learning that an existing contract with a third party does not clearly identify requirements for safeguarding the organization's critical data?
Show answer and explanation
Correct answer: C. Create an addendum to the existing contract.
An addendum to the existing contract is the practical, standard approach to address contractual gaps. It allows the organization to add specific data safeguarding requirements without disrupting the existing business relationship or requiring full contract renegotiation. This remedial measure is more practical than cancellation and more effective than risk transfer alone, as it establishes clear contractual obligations for the provider to implement protective measures.
Why the other options are wrong
- A. Cancellation is an extreme response that disrupts business; amendment is more appropriate.
- B. Risk transfer without contractual obligations doesn't ensure the provider will actually implement safeguards.
- D. An audit verifies provider capabilities but doesn't address the contractual gap that must be filled.
Question 7
An organization has purchased a security information and event management (SIEM) tool. Which of the following is MOST important to consider before implementation?
Show answer and explanation
Correct answer: A. Controls to be monitored
Identifying which controls and security events need to be monitored is the MOST critical consideration before SIEM implementation because it determines the entire scope and success of the deployment. Without knowing what to monitor, the SIEM implementation lacks purpose and focus. Once monitoring requirements are defined, reporting capabilities, vendor contracts, and support can be evaluated to meet those specific needs. Monitoring requirements drive all other implementation decisions.
Why the other options are wrong
- B. Reporting is important but depends first on knowing what will be monitored.
- C. The vendor contract is a supporting concern but not more important than defining monitoring requirements.
- D. Technical support is valuable but secondary to defining what the tool should actually monitor.
Question 8
Which of the following is MOST likely to be included in an enterprise security policy?
Show answer and explanation
Correct answer: A. Definitions of responsibilities
Definitions of responsibilities are the cornerstone of any enterprise security policy, clearly establishing who is accountable for various security functions and compliance. This is a high-level policy matter that applies organization-wide. Retention schedules and system access specifications are typically detailed in lower-level procedures or implementation standards rather than enterprise-level policies, and organizational risk is an input to policy rather than a component of it.
Why the other options are wrong
- B. Retention schedules are typically found in records management procedures, not enterprise security policy.
- C. System access specifications are implementation-level details found in standards or procedures.
- D. Organizational risk is analyzed to inform policy but isn't typically included as policy content itself.
Question 9
Which of the following should an information security manager do FIRST when a legacy application is not compliant with a regulatory requirement, but the business unit does not have the budget for remediation?
Show answer and explanation
Correct answer: D. Assess the consequences of noncompliance against the cost of remediation.
When a legacy application is noncompliant but lacks remediation budget, the information security manager must FIRST assess the consequences of noncompliance against remediation costs. This risk-benefit analysis is foundational to all subsequent decisions, it determines whether to pursue funding (A), accept risk (B), notify stakeholders (C), or take other action. Without understanding the actual risk exposure relative to cost, any decision lacks proper justification.
Why the other options are wrong
- A. Developing a business case is premature without first understanding the severity of noncompliance risk.
- B. Risk acceptance requires prior assessment and is a decision made after analysis, not before.
- C. Notification to legal and audit is appropriate after assessment, but not the first action.
Question 10
Which of the following is the MOST effective way to address an organization's security concerns during contract negotiations with a third party?
Show answer and explanation
Correct answer: C. Ensure security is involved in the procurement process.
Ensuring security is involved in the procurement process is the MOST effective approach because it embeds security requirements from the beginning of vendor selection and contract negotiation, rather than addressing concerns reactively. Early involvement allows security to shape contract terms, vendor selection criteria, and requirements. While other options (legal review, policy communication, audits) are supportive activities, early procurement involvement is the most proactive and comprehensive method.
Why the other options are wrong
- A. Legal department review is important but doesn't ensure security concerns are identified and addressed during negotiations.
- B. Communicating policy after vendor selection is reactionary rather than preventive.
- D. Auditing after contract signature may be too late to negotiate favorable security terms.
What people say about the full CISM pack 4.8 from 15
Incredible value. Cannot recommend this enough. Went in not knowing what to expect and ended up recognizing a solid chunk of the questions, For the price that is a great return.
Certification done! Used this in the final week before my exam. Recognised a lot of the content on exam day. Really glad I picked it up even at that late stage.
Best thing I bought for this exam
Question 11
Which of the following is the MOST important consideration for a global organization that is designing an information security awareness program?
Show answer and explanation
Correct answer: C. Cultural backgrounds
Cultural backgrounds are the MOST important consideration for a global organization designing an awareness program. Effective security awareness must resonate with diverse cultural values, communication styles, and work practices across different regions. While national regulations (A) must be complied with, local languages (D) are a delivery mechanism, and costs (B) are budgetary constraints, none are as fundamental as understanding cultural differences for program effectiveness across global audiences.
Why the other options are wrong
- A. While important for compliance, regulations don't shape program effectiveness as directly as cultural adaptation does.
- B. Program costs are budgetary constraints, not a consideration for program design effectiveness.
- D. Local languages are a necessary delivery vehicle but secondary to understanding cultural content preferences and norms.
Question 12
During the implementation of a new system, which of the following processes proactively minimizes the likelihood of disruption unauthorized alterations and errors?
Show answer and explanation
Correct answer: C. Change management
Change management is the process that proactively minimizes the likelihood of disruption, unauthorized alterations, and errors during system implementation. It provides formal procedures for requesting, evaluating, approving, testing, and implementing changes in a controlled manner. This prevents uncontrolled modifications that could introduce vulnerabilities, cause system failures, or create inconsistencies.
Why the other options are wrong
- A. Password management controls authentication but doesn't specifically address system disruption or unauthorized alterations during implementation.
- B. Version management tracks different versions of software but doesn't proactively minimize disruption or errors through controlled procedures.
- D. Configuration management establishes baselines but change management is the process that controls how modifications happen.
Question 13
Which of the following is the MOST important outcome of effective risk treatment?
Show answer and explanation
Correct answer: A. Implementation of corrective actions
The most important outcome of effective risk treatment is the implementation of corrective actions because taking action to address identified risks is what actually reduces organizational exposure. Without implementation, risk assessments and treatment plans remain theoretical; only through executing corrective and preventive actions does the organization achieve tangible risk reduction and protection.
Why the other options are wrong
- B. Complete elimination of risk is unrealistic and not the goal of risk treatment; acceptable residual risk is normal.
- C. Timely incident reporting is important for response but is not the outcome of risk treatment itself.
- D. Cost optimization may be a secondary benefit but is not more important than achieving actual risk reduction.
Question 14
Which of the following is the BEST way to ensure that organizational security policies comply with data security regulatory requirements?
Show answer and explanation
Correct answer: B. Align the policies to the most stringent global regulations.
Aligning policies to the most stringent global regulations ensures compliance with all applicable data security requirements, since adherence to the highest standard automatically satisfies lower standards. This approach future-proofs the organization and prevents gaps where one jurisdiction's requirements exceed another. Executive sign-off (A) approves policies but doesn't ensure compliance; stakeholder review (C) gathers input but doesn't guarantee regulatory alignment; outsourcing (D) transfers responsibility but remains the organization's ultimate obligation.
Why the other options are wrong
- A. Executive sign-off demonstrates approval but doesn't ensure policies meet regulatory requirements.
- C. Stakeholder review gathers perspectives but doesn't guarantee compliance with external regulatory requirements.
- D. Outsourcing compliance activities doesn't eliminate organizational responsibility for compliance.
Question 15
Which of the following BEST conveys minimum information security requirements to an organization in alignment with policies?
Show answer and explanation
Correct answer: D. Standards
Standards best convey minimum information security requirements in alignment with organizational policies. Standards define specific technical and operational requirements that must be met, providing clear, measurable expectations. They bridge policy (high-level direction) and procedures (detailed implementation steps) by establishing the baseline requirements that all systems and processes must meet.
Why the other options are wrong
- A. Procedures describe how to implement requirements, not the minimum requirements themselves.
- B. Regulations are external mandates, not organizational statements of minimum requirements.
- C. Baselines establish starting points for comparison but are less formal than standards for conveying requirements.
Question 16
Which of the following analyses will BEST identify the external influences to an organization's information security?
Show answer and explanation
Correct answer: A. Threat analysis
Threat analysis specifically identifies and evaluates external threats and adversaries that could compromise information security. It examines the threat landscape, threat actors, attack vectors, and malicious intent from outside the organization. This directly addresses external influences. Business impact analysis focuses on internal business consequences, gap analysis compares current state to desired state, and vulnerability analysis examines internal weaknesses, none specifically identify external influences.
Why the other options are wrong
- B. Business impact analysis measures the effect of disruptions but doesn't identify external threat sources.
- C. Gap analysis compares current and target states but is internal-focused, not external threat focused.
- D. Vulnerability analysis identifies internal weaknesses, not external influences or threats.
Question 17
Which of the following would be an information security manager's PRIMARY challenge when deploying a bring your own device (BYOD) mobile program in an enterprise?
Show answer and explanation
Correct answer: C. Inconsistent device security
Inconsistent device security is the PRIMARY challenge in deploying a BYOD program because devices are owned, configured, and maintained by diverse end users with varying security practices and capabilities. This creates unpredictable security postures across the organization. While configuration management, application control, and end user acceptance are important challenges, inconsistent device security encompasses the fundamental problem that different devices will have different operating systems, patch levels, security settings, and vulnerability exposures that are difficult to standardize.
Why the other options are wrong
- A. Configuration management is a technical challenge but can be addressed through MDM solutions.
- B. Mobile application control is important but is a subset of the broader security consistency challenge.
- D. End user acceptance is important but is a change management consideration rather than the primary security challenge.
Question 18
An organization performed a risk analysis and found a large number of assets with low-impact vulnerabilities. The NEXT action of the information security manager should be to:
Show answer and explanation
Correct answer: D. quantify the aggregated risk.
When many low-impact vulnerabilities are discovered, the next logical step is to quantify the aggregated risk. Individual low-impact vulnerabilities may collectively represent a significant risk when considered together. This aggregated risk analysis informs management decision-making and determines whether countermeasures, risk transfer, or reporting are necessary. Without quantifying the total risk, the organization cannot make informed decisions about how to proceed.
Why the other options are wrong
- A. Risk transfer is a response action taken after understanding the magnitude of aggregated risk.
- B. Determining countermeasures requires first understanding the full scope of aggregated risk.
- C. Reporting to management should include quantified aggregated risk, not precede it.
Question 19
Which of the following is MOST important to include in a report of an organization's information security risk?
Show answer and explanation
Correct answer: C. Residual risk
Residual risk is MOST important to include in an organization's information security risk report because it represents the actual risk remaining after controls and mitigation strategies have been applied. This is what the organization must accept and manage, making it the most actionable and relevant metric for leadership decision-making and resource allocation.
Why the other options are wrong
- A. Control risk is a component of analysis but less important than the final residual risk for reporting purposes.
- B. Mitigated risk shows the impact of controls but residual risk better represents the true organizational exposure.
- D. Inherent risk shows theoretical risk without controls but doesn't reflect the organization's actual exposure to report to leadership.
Question 20
Who is accountable for ensuring proper controls are in place to address the confidentiality and availability of an information system?
Show answer and explanation
Correct answer: C. Senior management
Senior management holds ultimate accountability for ensuring proper controls are in place to protect information systems, including confidentiality and availability. This is a governance and strategic responsibility that cannot be delegated away. While information security managers, business managers, and information officers execute and support these controls, accountability rests with senior management.
Why the other options are wrong
- A. An information officer role (if this is the intended reading) typically supports but doesn't hold ultimate accountability.
- B. Business managers own their systems but ultimate accountability for information security governance is with senior management.
- D. Information security managers execute controls but accountability rests with senior leadership.
Question 21
Which of the following is the GREATEST risk of centralized information security administration within a multinational organization?
Show answer and explanation
Correct answer: D. Violation of local law
Centralized information security administration in a multinational organization creates the greatest risk of violating local laws and regulations. Different countries have varying legal requirements (GDPR, LGPD, local data protection laws, encryption regulations), and a centralized approach may fail to account for these jurisdictional differences, resulting in compliance violations.
Why the other options are wrong
- A. Slower turnaround is a potential operational inefficiency but not the greatest risk to the organization.
- B. Centralized administration typically increases uniformity rather than decreases it.
- C. While centralization can reduce local objectivity, this is not as severe a risk as legal violations across multiple jurisdictions.
Question 22
An employee clicked on a link in a phishing email, triggering a ransomware attack. Which of the following should be the information security manager's FIRST step?
Show answer and explanation
Correct answer: B. Isolate the impacted endpoints.
Isolating impacted endpoints is the FIRST priority to contain the ransomware and prevent it from spreading to other systems. Containment is the immediate technical action that must happen before notifications or other steps. Notifying legal and management are important but secondary to stopping the spread. Wiping the system is premature before forensics and is not the first step.
Why the other options are wrong
- A. Legal notification is important but comes after initial containment of the threat.
- C. Wiping a system destroys forensic evidence and should not occur before investigation.
- D. Management notification is important but should follow containment of the active threat.
Question 23
The PRIMARY purpose for continuous monitoring of security controls is to ensure:
Show answer and explanation
Correct answer: B. effectiveness of controls.
The primary purpose of continuous monitoring is to verify that security controls are functioning as intended and effectively mitigating risks. While continuous monitoring may support compliance and identify gaps, its fundamental purpose is to assess whether controls actually work and maintain their effectiveness over time.
Why the other options are wrong
- A. Compliance alignment is a benefit but not the primary purpose of continuous monitoring.
- C. Minimizing control gaps is a consequence, not the primary purpose.
- D. System availability is a component of security but not the main focus of control monitoring.
Question 24
Which of the following would be the MOST effective countermeasure against malicious programming that rounds down transaction amounts and transfers them to the perpetrator's account?
Show answer and explanation
Correct answer: B. Ensure that proper controls exist for code review and release management.
The most effective countermeasure against malicious code inserted into business logic (like rounding down transactions) is proper code review and release management. This prevents malicious code from entering the system in the first place. While virus scanning (A), transaction monitoring (C), and patches (D) may detect or respond to threats, code review and release management provide preventive controls at the source by catching unauthorized or malicious code before it reaches production.
Why the other options are wrong
- A. Virus scanning may not detect application-level logic bombs or malicious business logic.
- C. Continuous monitoring is detective, not preventive; it catches the problem after deployment.
- D. Patches address known vulnerabilities but don't prevent custom malicious logic embedded during development.
Question 25
An information security manager has observed multiple exceptions for a number of different security controls. Which of the following should be the information security manager's FIRST course of action?
Show answer and explanation
Correct answer: C. Inform respective risk owners of the impact of exceptions
When multiple control exceptions are observed, the first course of action should be to inform the respective risk owners of the impacts these exceptions create. Risk owners need awareness of the control gaps so they can make informed decisions about acceptance or mitigation. This establishes accountability and enables proper risk decision-making before prioritizing treatments, escalating to the board, or designing new controls.
Why the other options are wrong
- A. Prioritization and treatment implementation come after stakeholders understand the risk impacts.
- B. Board escalation may be necessary but first requires risk owners to be informed and engaged.
- D. Designing mitigating controls is premature before the risk owners understand and acknowledge the issues.
Question 26
Which of the following needs to be established FIRST in order to categorize data properly?
Show answer and explanation
Correct answer: C. A data classification framework
A data classification framework must be established first because it defines the categories, levels, and criteria for classifying data. Without this framework, there is no standard basis for determining what constitutes confidential, sensitive, or public information needed for proper data categorization.
Why the other options are wrong
- A. A data protection policy is developed after understanding what data exists and how it's classified.
- B. A data flow diagram documents data movement but requires prior understanding of data classifications.
- D. A data custodian is assigned based on classifications already established by the framework.
Question 27
An information security manager is preparing incident response plans for an organization that processes personal and financial information. Which of the following is the MOST important consideration?
Show answer and explanation
Correct answer: C. Identifying regulatory requirements
Identifying regulatory requirements is the most important consideration when preparing incident response plans for an organization handling personal and financial information. Organizations processing such data are subject to specific legal and regulatory mandates (e.g., GDPR, HIPAA, PCI-DSS, state breach notification laws) that dictate minimum incident response requirements. Compliance with these mandates is non-negotiable and must be the foundation of any incident response plan.
Why the other options are wrong
- A. While industry frameworks provide good guidance, regulatory compliance requirements take precedence.
- B. Budget constraints are secondary; regulatory requirements cannot be avoided due to cost.
- D. Enterprise architecture alignment is important but doesn't address the fundamental legal obligations.
Question 28
A desktop computer is being used to perpetrate a fraud, and data on the machine must be secured for evidence. Which of the following should be done FIRST?
Show answer and explanation
Correct answer: D. Capture a forensic image of the computer.
Capturing a forensic image of the computer should be done FIRST to preserve the complete state of the system in its current condition. This creates a bit-by-bit copy that maintains chain of custody and allows analysis without altering original evidence. Hashing (B) is performed as part of forensic imaging to verify integrity, encryption (A) would destroy evidence usability, and copying (C) without forensic methodology compromises evidence admissibility in court.
Why the other options are wrong
- A. Encrypting the drive would destroy evidence and prevent forensic analysis.
- B. Hashing is part of the forensic imaging process, not done separately before imaging.
- C. Standard copying without forensic procedures compromises chain of custody and evidence integrity.
Question 29
What is the PRIMARY purpose of an unannounced disaster recovery exercise?
Show answer and explanation
Correct answer: B. To evaluate how personnel react to the situation
The primary purpose of an unannounced disaster recovery exercise is to evaluate how personnel react to the situation in real, unscripted conditions. Unannounced drills test actual response capabilities, decision-making, and personnel behavior without the artificial preparation that comes with announced exercises. This reveals true readiness and identifies gaps in training, communication, and procedures. While metrics, SLA assessment, and RTO estimation are valuable byproducts, the core value of the unannounced approach is observing genuine personnel responses and organizational behavior under stress.
Why the other options are wrong
- A. Providing metrics is an outcome, not the primary purpose of the exercise itself.
- C. SLA assessment can be done through announced or unannounced exercises; it is not what makes unannounced exercises distinctive.
- D. RTO estimation requires controlled testing; unannounced exercises measure actual behavior, not just timing metrics.
Question 30
A multinational organization is required to follow governmental regulations with different security requirements at each of its operating locations. The chief information security officer (CISO) should be MOST concerned with:
Show answer and explanation
Correct answer: A. developing a security program that meets global and regional requirements.
The CISO's MOST important concern must be developing a security program that meets both global and regional requirements. This addresses the core strategic challenge: creating a coherent security framework that complies with multiple, potentially conflicting regulatory regimes across different jurisdictions. This requires balancing standardization with localization and is the fundamental responsibility. The other options (communication, monitoring, best practices) are important tactical activities that support this overall objective.
Why the other options are wrong
- B. Communication with regulatory bodies is important but is a supporting activity, not the primary concern.
- C. Monitoring compliance is an operational activity that follows program development.
- D. Using best practices is a method, but the primary concern is meeting the specific requirements of each region.
Question 31
Which of the following should be the FIRST step of incident response procedures?
Show answer and explanation
Correct answer: A. Classify the event depending on severity and type
The first step in incident response procedures is to classify the event based on severity and type. This classification determines the appropriate response level, escalation pathway, and resources needed. Without proper classification, the response team cannot prioritize actions or allocate resources effectively. Risk assessment, cause analysis, and determining technical assistance needs are subsequent steps that depend on the initial classification.
Why the other options are wrong
- B. Risk assessment comes after classification to determine appropriate response level.
- C. Evaluating control failure causes is part of post-incident analysis, not the initial response step.
- D. Determining technical assistance needs occurs after initial classification and assessment.
Question 32
Which of the following is the MOST important reason for an organization to develop an information security governance program?
Show answer and explanation
Correct answer: A. Establishment of accountability
The most important reason to develop an information security governance program is to establish accountability at all levels of the organization. Governance creates the organizational structure, roles, responsibilities, and decision-making authority needed for security oversight. This foundation is more fundamental than compliance, tactical solutions, or incident monitoring, as it enables all other security activities to function effectively.
Why the other options are wrong
- B. Compliance with audit requirements is a benefit of governance but is not the most important reason.
- C. Creation of tactical solutions is an operational activity, not a governance purpose.
- D. Monitoring security incidents is an operational security function, not the primary governance purpose.
Question 33
Which of the following is the MOST reliable way to ensure network security incidents are identified as soon as possible?
Show answer and explanation
Correct answer: C. Collect and correlate IT infrastructure event logs.
Collecting and correlating IT infrastructure event logs is the most reliable way to identify network security incidents as soon as possible. This automated approach continuously monitors system and network activity in real-time, detecting anomalies and suspicious behavior through log analysis and correlation. It provides systematic, technology-driven detection without relying on human observation or training.
Why the other options are wrong
- A. Firewalls provide network protection but are not the primary mechanism for identifying incidents.
- B. End-user training supports awareness but is not as reliable as automated monitoring for early incident detection.
- D. Help desk staff can contribute to incident identification but cannot match the reliability and speed of automated log correlation.
Question 34
Which of the following is the MOST important consideration when updating procedures for managing security devices?
Show answer and explanation
Correct answer: A. Updates based on changes in risk, technology, and process
The most important consideration when updating procedures is ensuring those updates address actual changes in the organization's environment. Risk, technology, and process changes are the fundamental drivers that necessitate procedural updates. While management approval, alignment with security frameworks, and notification are all important, they are secondary to identifying what actually needs to change based on the evolving threat landscape and operational environment.
Why the other options are wrong
- B. Management approval is important but comes after determining what needs to change.
- C. Framework alignment is important but not the primary driver for determining what to update.
- D. Notification is part of implementation but not the primary consideration for identifying updates.
Question 35
The security baselines of an organization should be based on:
Show answer and explanation
Correct answer: B. standards.
Security baselines must be based on standards (such as industry frameworks like NIST, ISO 27001, or CIS controls) which provide the authoritative technical and operational guidance. Standards provide the foundation from which baselines are built. Policies define the what and why, procedures define the how, and guidelines provide recommendations, but standards establish the actual technical requirements that baselines implement.
Why the other options are wrong
- A. Procedures are the operational steps for implementing controls, not the foundation for baselines.
- C. Policies govern the overall security approach but baselines need to reference concrete technical standards.
- D. Guidelines are advisory in nature and lack the prescriptive authority needed to establish baselines.
Question 36
During which of the following development phases is it MOST challenging to implement security controls?
Show answer and explanation
Correct answer: B. Post-implementation phase
The post-implementation phase is MOST challenging for implementing security controls because systems are already in production, users are dependent on them, and making changes carries significant operational risk and disruption. Implementing controls after deployment is costly, may cause downtime, requires workarounds, and often results in suboptimal solutions. Controls are most efficiently and effectively implemented during design and development phases.
Why the other options are wrong
- A. Implementation phase is where controls can still be built in properly as part of initial deployment.
- C. Design phase is where controls are planned and is the optimal time for implementation.
- D. Development phase allows controls to be coded into the system before production use.
Question 37
Which of the following is the MOST essential element of an information security program?
Show answer and explanation
Correct answer: C. Involving functional managers in program development
Involving functional managers in program development is the MOST essential element because security cannot be effective without the participation and buy-in of operational leadership. Functional managers understand business processes, identify realistic constraints, communicate security requirements across their departments, and ensure security measures are integrated into actual business operations. Without this involvement, security programs become disconnected from business reality and fail to gain organizational support.
Why the other options are wrong
- A. While resource prioritization is important, it's a management decision made after establishing program fundamentals, not an essential foundation element.
- B. Benchmarking is a validation activity that should occur after the program is established; it's not foundational to program development.
- D. Applying business project management practices is useful but secondary to having organizational stakeholder engagement and support.
Question 38
Which of the following is the MOST effective method of determining security priorities?
Show answer and explanation
Correct answer: D. Impact analysis
Impact analysis is the MOST effective method for determining security priorities because priorities must be based on what matters most to the business, the consequences of failure or compromise. Impact analysis identifies which assets, systems, and risks would cause the greatest business harm, enabling resources to be allocated to protect the highest-impact areas first. This is more strategic than identifying vulnerabilities or gaps in isolation.
Why the other options are wrong
- A. Vulnerability assessment identifies weaknesses but doesn't indicate business impact or priority without impact analysis.
- B. Gap analysis shows what's missing compared to standards but doesn't inherently reflect business impact.
- C. Threat assessment identifies threats but must be combined with impact to determine priorities effectively.
Question 39
The PRIMARY goal of information security governance is to:
Show answer and explanation
Correct answer: C. align with business objectives.
The PRIMARY goal of information security governance is to align security with business objectives. Security governance exists to enable and protect business operations, it ensures that security investments and strategies directly support what the organization is trying to achieve. While reducing risk, aligning with processes, and establishing strategy are important components of security governance, they are all means to the end of achieving business objectives, not the primary goal itself.
Why the other options are wrong
- A. Risk reduction is an important outcome of security governance but not its primary goal.
- B. Alignment with processes is important but is subordinate to alignment with business objectives.
- D. Strategy establishment is a function of governance but not its ultimate goal.
Question 40
Which of the following will have the MOST negative impact to the effectiveness of incident response processes?
Show answer and explanation
Correct answer: C. Ambiguous severity criteria
Ambiguous severity criteria will have the most negative impact because it prevents consistent incident prioritization, leading to unpredictable response times, misaligned resource allocation, and inconsistent treatment of similar incidents. Without clear severity definitions, the entire incident response process becomes unreliable and ineffective, whereas other factors impact efficiency but not the fundamental effectiveness of response.
Why the other options are wrong
- A. High risk tolerance is an organizational policy choice that may increase acceptance of risk but doesn't impair response processes themselves.
- B. Decentralized monitoring can be less efficient but still enables incident detection and response with proper coordination.
- D. Manual reporting is less efficient than automated processes but does not prevent effective incident response if procedures are clear.
Question 41
An information security manager needs to ensure security testing is conducted on a new system. Which of the following would provide the HIGHEST level of assurance?
Show answer and explanation
Correct answer: B. An independent party is directly engaged to conduct testing.
An independent third party conducting security testing provides the highest level of assurance because it eliminates conflicts of interest and bias. Independent testers are not incentivized to minimize findings or downplay issues. Vendor-provided results lack independence, internal audit teams may lack specialized expertise and still have organizational bias, and self-assessments by the security team provide the lowest assurance due to inherent bias in evaluating one's own work.
Why the other options are wrong
- A. Vendor-provided results lack independence and may be biased toward favorable outcomes.
- C. Internal audit may lack specialized security testing expertise and still represents internal bias.
- D. Self-assessment by the security team provides minimal assurance due to inherent conflict of interest.
Question 42
The MOST effective way to continuously monitor an organization's cybersecurity posture is to evaluate its:
Show answer and explanation
Correct answer: B. key performance indicators (KPIs).
Key performance indicators (KPIs) provide quantifiable, measurable metrics that enable continuous evaluation of security posture across multiple dimensions (detection rates, response times, vulnerability remediation, patch compliance, etc.). KPIs can be tracked over time to show trends. Compliance with regulations is a baseline requirement but doesn't measure effectiveness. Senior management support is important but isn't measurable. Response timeliness to attacks is one metric but doesn't comprehensively measure posture.
Why the other options are wrong
- A. Compliance is a minimum requirement, not a measure of actual security effectiveness or posture.
- C. Management support is important but isn't a measurable indicator of cybersecurity posture.
- D. Attack response timeliness is one metric but insufficient alone to comprehensively measure overall cybersecurity posture.
Question 43
An information security manager's PRIMARY objective for presenting key risks to the board of directors is to:
Show answer and explanation
Correct answer: A. ensure appropriate information security governance.
The PRIMARY objective of presenting key risks to the board is to ensure appropriate information security governance. Governance requires the board to understand and oversee risk at a strategic level, enabling them to make informed decisions about risk acceptance and resource allocation. While quantifying reputational risks, meeting compliance, and re-evaluating risk appetite are all activities that may occur, they are secondary outcomes of the primary governance objective.
Why the other options are wrong
- B. Quantifying reputational risks is important but is a specific type of risk analysis, not the primary objective of board reporting.
- C. Meeting compliance requirements is a consequence of governance, not its primary objective.
- D. Re-evaluating risk appetite is an outcome that may result from board discussions, not the primary objective of the presentation.
Question 44
What is the FIRST line of defense against criminal insider activities?
Show answer and explanation
Correct answer: C. Validating the integrity of personnel
Validating the integrity of personnel through thorough vetting, background checks, and character assessment is the foundational first line of defense against insider threats. This preventive measure occurs before an individual gains access to systems or information, making it the earliest and most fundamental control. While access controls, security agreements, and monitoring are all important, they operate after personnel are already in the organization and cannot prevent threats from individuals with compromised integrity from being hired in the first place.
Why the other options are wrong
- A. Security agreements are reactive controls that depend on personnel already being hired; they don't prevent bad actors from being selected initially.
- B. Access controls are important but come after hiring and don't address the root issue of hiring people with questionable integrity.
- D. Monitoring is a detective control, not preventive, and occurs after an insider is already in position to cause harm.
Question 45
Which of the following is the MOST important function of an information security steering committee?
Show answer and explanation
Correct answer: B. Defining the objectives of the information security framework
The MOST important function of an information security steering committee is defining the objectives of the information security framework. This sets the strategic direction and ensures alignment with business objectives. Defining objectives provides the foundation for all other committee activities including control evaluation, reviews, and awareness content approval.
Why the other options are wrong
- A. Evaluating control effectiveness is an ongoing operational task but is derivative of established objectives.
- C. Conducting independent reviews is important for assurance but stems from defined objectives and framework.
- D. Approving awareness content is a tactical activity that doesn't represent the committee's most important function.
Question 46
When designing security controls, it is MOST important to:
Show answer and explanation
Correct answer: D. apply a risk-based approach.
Applying a risk-based approach is most important when designing security controls. This ensures resources are allocated to address the greatest risks first, balancing security investments with business needs. A risk-based approach considers likelihood, impact, and organizational priorities rather than implementing controls uniformly or arbitrarily.
Why the other options are wrong
- A. While preventive controls are valuable, detective and corrective controls are also essential in a layered approach.
- B. Controls should protect all sensitive information based on risk, not just confidential information.
- C. Cost evaluation is important but secondary to risk assessment in determining which controls to implement.
Question 47
An information security manager notes that security incidents are not being appropriately escalated by the help desk after tickets are logged. Which of the following is the BEST automated control to resolve this issue?
Show answer and explanation
Correct answer: C. Integrating incident response workflow into the help desk ticketing system
Integrating incident response workflow into the help desk ticketing system is the best automated control to ensure security incidents are properly escalated. This creates automated escalation rules, routing, and workflows that systematically enforce escalation procedures without relying on human judgment or manual processes. SLA reporting monitors compliance but doesn't enforce escalation; setting all incidents to highest priority is ineffective and creates alert fatigue; vulnerability scanning is unrelated to escalation procedures.
Why the other options are wrong
- A. SLA reporting monitors escalation compliance but does not automate or enforce escalation actions.
- B. Setting all tickets to highest priority dilutes urgency and creates alert fatigue, defeating the purpose.
- D. Vulnerability scanning in the help desk workflow is unrelated to incident escalation procedures.
Question 48
Changes have been proposed to a large organization's enterprise resource planning (ERP) system that would violate existing security standards. Which of the following should be done FIRST to address this conflict?
Show answer and explanation
Correct answer: C. Validate current standards.
When proposed changes conflict with existing security standards, the FIRST step is to validate that current standards are still relevant, appropriate, and accurately documented. This establishes a baseline understanding of what standards actually exist and whether they are current before making decisions about cost-benefit analysis or business impact. Validating standards ensures you're working with accurate information rather than assumptions.
Why the other options are wrong
- A. Cost-benefit analysis is premature without first understanding whether standards are valid and current.
- B. Business impact levels should be calculated after confirming what standards actually apply.
- D. Implementing updated standards is a decision that comes after analysis, not before validation.
Question 49
Which of the following is BEST determined by using technical metrics?
Show answer and explanation
Correct answer: A. Whether controls are operating effectively
Technical metrics are quantitative measurements of system and control performance, making them most suitable for determining whether specific controls are operating effectively. Technical metrics directly measure operational outcomes like detection rates, response times, and system availability. Options B, C, and D require broader strategic and business-level analysis beyond what technical metrics alone can provide.
Why the other options are wrong
- B. Managing security risk requires both technical and business-level metrics; technical metrics alone are insufficient.
- C. Resource allocation decisions require business case analysis and strategic planning, not just technical metrics.
- D. Strategic alignment is a high-level business assessment that cannot be determined primarily through technical metrics.
Question 50
When developing an escalation process for an incident response plan, the information security manager should PRIMARILY consider the:
Show answer and explanation
Correct answer: A. affected stakeholders.
When developing escalation procedures, the primary consideration must be the affected stakeholders, who needs to know, in what sequence, and based on what criteria. The stakeholder landscape (internal teams, executives, external parties, customers, regulators) determines the escalation pathways and decision points. Incident response teams, resource availability, and media coverage are all secondary to mapping out who the affected stakeholders are and how to notify them appropriately.
Why the other options are wrong
- B. The incident response team is one component, but escalation focuses on notifying affected stakeholders, not just the response team.
- C. Technical resource availability affects response capability, not the escalation decision criteria.
- D. Media coverage is a communication output, not a primary consideration for escalation process design.
Question 51
Which of the following provides the MOST assurance that a third-party hosting provider will be able to meet availability requirements?
Show answer and explanation
Correct answer: D. Service level agreement (SLA)
A Service Level Agreement (SLA) is a formal contract that explicitly defines availability requirements, performance metrics, response times, and remedies for non-compliance. Unlike a BCP which is internal planning, an incident response plan which handles incidents reactively, or an audit clause which verifies compliance, an SLA provides the most direct and enforceable assurance of meeting specific availability requirements because it legally binds the provider to measurable commitments with financial consequences.
Why the other options are wrong
- A. A BCP shows planning but doesn't guarantee meeting specific availability targets.
- B. An incident response plan addresses recovery but not preventive availability assurance.
- C. A right-to-audit clause only verifies compliance after the fact, not prevent failures.
Question 52
An organization's senior management is encouraging employees to use social media for promotional purposes. Which of the following should be the information security manager s FIRST step to support this strategy?
Show answer and explanation
Correct answer: B. Develop a guideline on the acceptable use of social media.
The information security manager's first step should be to develop guidelines on acceptable use of social media. This establishes the policies and boundaries that employees must follow before rolling out the initiative. Clear guidelines address risks such as data exposure, social engineering, and reputational damage. While awareness training, content filtering, and DLP solutions are all valuable supporting controls, they must be based on established policies and acceptable use guidelines.
Why the other options are wrong
- A. Security awareness comes after policy development; employees need guidelines before training on them.
- C. Web content filtering is a technical control that supports policy but doesn't establish what is acceptable.
- D. DLP solutions are technical measures that follow policy establishment and risk assessment.
Question 53
Audit trails of changes to source code and object code are BEST tracked through:
Show answer and explanation
Correct answer: C. program library software.
Program library software (also called source code management or version control systems) is specifically designed to track and maintain audit trails of all changes to both source code and object code. These tools provide version history, change logs, user attribution, timestamps, and the ability to audit who made what changes and when. Compilers transform code but don't track changes, code reviews are manual processes, and job control statements manage execution rather than tracking modifications.
Why the other options are wrong
- A. Compilers process code but do not create audit trails of changes.
- B. Code review is a quality control process but not the mechanism for tracking change audit trails.
- D. Job control statements manage batch job execution, not source code or object code change tracking.
Question 54
An information security team is investigating an alleged breach of an organization's network. Which of the following would be the BEST single source of evidence to review?
Show answer and explanation
Correct answer: B. Security information and event management (SIEM) tool
A SIEM tool is the BEST single source because it aggregates and correlates logs and events from across the entire infrastructure, providing comprehensive visibility into system activities, network traffic, and security events. While FIM, IDS, and antivirus provide valuable specialized data, a SIEM provides the broadest and most integrated view of what occurred during an alleged breach, making it the single best source for investigation.
Why the other options are wrong
- A. FIM only tracks file changes and integrity, providing limited scope for breach investigation.
- C. IDS focuses on intrusion attempts but may miss lateral movement and post-breach activities.
- D. Antivirus logs focus on malware detection and are narrower in scope than a comprehensive SIEM.
Question 55
If the inherent risk of a business activity is higher than the acceptable risk level, the information security manager should FIRST:
Show answer and explanation
Correct answer: C. assess the gap between current and acceptable level of risk.
The FIRST step when inherent risk exceeds acceptable risk is to assess the gap between current and acceptable risk levels. This assessment informs all subsequent decisions about mitigation strategy, risk transfer, or whether the business activity is viable. Understanding the magnitude of the gap is prerequisite to choosing the appropriate response.
Why the other options are wrong
- A. Risk transfer is one possible response but shouldn't be selected before understanding the gap; it's also not always feasible or cost-effective.
- B. Avoiding the business activity is extreme and premature before assessing whether the gap can be closed through mitigation.
- D. Implementing controls is the logical next step after assessment, but assessment must come first to determine what mitigation is needed.
Question 56
Which of the following is the MAIN benefit of performing an assessment of existing incident response processes?
Show answer and explanation
Correct answer: A. Validation of current capabilities
The main benefit of assessing existing incident response processes is validation of current capabilities, confirming what is already working, identifying gaps, and establishing a baseline of the organization's readiness. This assessment provides the foundation for all subsequent improvement activities. While assessments may inform benchmarking, prioritization, and threat identification, validation of actual capabilities is the primary benefit and purpose of conducting the assessment.
Why the other options are wrong
- B. Benchmarking against peers is a secondary benefit; the primary focus is on validating internal capabilities.
- C. Prioritization of improvements is an outcome after validation, not the main benefit of the assessment itself.
- D. Threat identification is outside the scope of assessing existing incident response processes; it would focus on process validation.
Question 57
Which of the following should be an information security manager's MOST important criterion for determining when to review the incident response plan?
Show answer and explanation
Correct answer: D. At intervals indicated by industry best practice
An information security manager's most important criterion for reviewing the incident response plan should be the intervals indicated by industry best practice, typically annually or after significant organizational changes. This ensures the plan stays current with industry standards and organizational evolution. While unmet RTOs, missing information, and audits are all valid triggers, relying on industry best practice ensures proactive, consistent review rather than reactive reviews that occur only after problems manifest.
Why the other options are wrong
- A. Unmet RTOs indicate a need to improve execution, but planned reviews occur regardless of performance.
- B. Missing information during recovery is reactive; reviews should be proactive and scheduled.
- C. Audits are external triggers; internal managers should review plans on a consistent schedule independent of audit cycles.
Question 58
An organization's intrusion prevention system (IPS) detected and blocked an unusually large number of external intrusion attempts within a 24-hour period. Which of the following should be the information security manager's FIRST course of action?
Show answer and explanation
Correct answer: B. Identify the source and nature of the attempts.
The security manager's first course of action should be to identify the source and nature of the attacks to understand what threat is being faced. This foundational investigation is prerequisite to all other actions, understanding the threat determines whether further investigation is needed, what type of assessments are necessary, and what information to escalate to management. Without this information, subsequent actions would be unfocused.
Why the other options are wrong
- A. Security assessments are premature before understanding the threat.
- C. Reviewing logs is part of the investigation process but comes after determining what specifically to investigate.
- D. Reporting to management should follow the initial investigation and threat characterization.
Question 59
Which of the following is MOST important for an information security manager to consider when identifying information security resource requirements?
Show answer and explanation
Correct answer: D. Information security strategy
Information security strategy is the primary driver for identifying resource requirements because it articulates the organization's security objectives, priorities, and direction. Resource requirements must align with and support the defined strategy. While current resourcing levels, available resources, and incident history provide context, they are secondary considerations. Strategy should drive requirements upward if necessary, not vice versa; decisions should be based on what is needed to achieve strategic goals, not constrained by current limitations.
Why the other options are wrong
- A. Availability of resources constrains implementation but should not drive requirement identification; strategy should determine needs first.
- B. Incidents inform priorities but are reactive; strategy is the proactive foundation for resource planning.
- C. Current levels provide baseline context but should not limit identification of what is actually needed to meet strategic objectives.
Question 60
Which of the following provides the BEST assurance that a contracted third-party provider meets an organization's security requirements?
Show answer and explanation
Correct answer: C. Right-to-audit clause in the contract
A right-to-audit clause in the contract provides the best assurance because it grants the organization direct authority to verify the provider's compliance with security requirements through independent audits. This contractual right enables ongoing verification and corrective action enforcement. While continuous monitoring and due diligence questionnaires are useful, they lack the enforcement mechanism of contractual audit rights. Performance metrics measure outcomes but don't provide verification authority.
Why the other options are wrong
- A. Continuous monitoring is effective but depends on the provider's cooperation and data sharing.
- B. Due diligence questionnaires are one-time assessments that become outdated quickly.
- D. Performance metrics measure compliance but don't provide verification authority or enforcement.
Question 61
Which of the following is the BEST method for reducing the risk of data loss due to phishing attacks?
Show answer and explanation
Correct answer: D. Educating users
User education is the most effective method for reducing phishing-related data loss because it addresses the human element, the primary vulnerability in phishing attacks. Well-trained users can recognize and report phishing attempts before clicking malicious links or entering credentials. While technical controls like data loss prevention, spam filtering, and password changes provide additional layers of defense, they cannot replace user awareness. Education tackles the root cause of successful phishing attacks.
Why the other options are wrong
- A. Frequent password changes do not prevent users from falling for phishing attacks initially.
- B. Data loss prevention helps prevent data exfiltration but does not stop phishing attacks themselves.
- C. Spam filtering reduces phishing emails reaching users but some always get through; user education is essential.
Question 62
A serious vulnerability was detected in a business application that can be exploited by external attackers to compromise the system. What is the information security manager's BEST course of action?
Show answer and explanation
Correct answer: C. Report the risk to the business application owner.
The information security manager's best course of action is to report the risk to the business application owner. This follows proper governance and accountability structures where the owner is responsible for remediation decisions and implementation. Reporting ensures the risk is formally documented, escalated to decision-makers, and tracked through to resolution. While temporary remediation or requesting immediate fixes may seem urgent, they bypass the proper governance process and the application owner's authority to make remediation decisions.
Why the other options are wrong
- A. Implementing temporary remediation without owner authorization bypasses proper governance and accountability.
- B. Requesting immediate shutdown is an extreme measure that should be the owner's decision based on business impact.
- D. Demanding immediate fixes bypasses the owner's decision-making authority and doesn't account for business impact assessment.
Question 63
Which of the following is the MOST important consideration in a bring your own device (BYOD) program to protect company data in the event of a loss?
Show answer and explanation
Correct answer: B. The ability to centrally manage devices
The ability to centrally manage devices is the MOST important protection for company data loss in BYOD because it enables enforcement of security policies, remote wipe capabilities, encryption requirements, and compliance monitoring across all devices. Central management provides comprehensive control and visibility. While locating devices (A) helps recovery and other controls (C, D) are useful, central management encompasses the broadest protective capabilities.
Why the other options are wrong
- A. Remote location helps find lost devices but doesn't guarantee data protection or enable data deletion.
- C. Restricting unapproved applications is one control but doesn't address data loss directly.
- D. Device classification helps organization but doesn't directly protect data in loss scenarios.
Question 64
An organization has concerns regarding a potential advanced persistent threat (APT). To ensure that the risk associated with this threat is appropriately managed, what should be the organization's FIRST action?
Show answer and explanation
Correct answer: D. Conduct an impact analysis.
When an organization detects a potential advanced persistent threat, the first action should be to conduct an impact analysis to understand what systems, data, and business functions are at risk and what the actual threat level is. This assessment informs all subsequent decisions about reporting, controls, and incident response. Without understanding the impact and scope, decision-makers cannot properly prioritize response actions or allocate resources effectively.
Why the other options are wrong
- A. Implementing additional controls before understanding the threat is premature and may not address the actual risk effectively.
- B. While senior management must be informed, this typically follows the initial threat assessment and impact analysis.
- C. Incident response processes should be triggered based on confirmed incidents with understood impact, not before impact analysis.
Question 65
An organization has decided to conduct a postmortem analysis after experiencing a loss from an information security attack. The PRIMARY purpose of this analysis should be to:
Show answer and explanation
Correct answer: C. document lessons learned.
The primary purpose of postmortem analysis is to extract lessons learned from security incidents to improve future prevention and response capabilities. While impact evaluation, prosecution support, and policy updates may occur as secondary outcomes, the core objective is organizational learning and continuous improvement. A postmortem serves the long-term security posture of the organization.
Why the other options are wrong
- A. Evaluating impact is part of incident response, not the primary purpose of postmortem analysis.
- B. Preparing for criminal prosecution is a legal consideration, not the primary security objective of postmortem analysis.
- D. Policy updates may result from lessons learned, but they are an outcome, not the primary purpose.
Question 66
An information security manager finds a legacy application has no defined data owner. Of the following, who would be MOST helpful in identifying the appropriate data owner?
Show answer and explanation
Correct answer: B. The individual who manages the process supported by the application
The individual who manages the process supported by the application would be most helpful in identifying the data owner. The process manager understands what data is critical to business operations, who depends on that data, and who is accountable for its use and integrity. This person has the business context needed to identify the appropriate owner, whereas others may have only technical or limited operational perspectives.
Why the other options are wrong
- A. Technical support personnel understand the application but not necessarily the business data ownership structure.
- C. User managers understand access but not necessarily who owns the data or is accountable for it.
- D. Privilege level does not correlate with data ownership responsibility; technically powerful users may not be data owners.
Question 67
An information security manager has been asked to provide regular status reports to senior management regarding the information security program. Which of the following would provide the MOST helpful information?
Show answer and explanation
Correct answer: D. Key performance indicators (KPIs)
Key Performance Indicators (KPIs) provide the MOST helpful information for senior management status reports because they are business-aligned, measurable metrics that demonstrate progress toward security objectives and program effectiveness. KPIs synthesize multiple data points into strategic insights relevant to business decisions, whereas a threat list is reactive intelligence, incident counts lack context, and remediation activities are operational details that executives don't need to manage day-to-day.
Why the other options are wrong
- A. A threat list is informational but lacks business context and actionable metrics.
- B. Incident counts alone lack context about severity, impact, or remediation.
- C. Remediation activities are operational details, not strategic program health indicators.
Question 68
The BEST indication of a change in risk that may negatively impact an organization is an increase in the number of:
Show answer and explanation
Correct answer: A. security incidents reported by staff to the information security team.
An increase in security incidents reported by staff indicates a genuine change in organizational risk and threat impact. Staff-reported incidents represent actual security events that have materialized, making them the most reliable indicator of negative risk change. In contrast, increased alerts, malware detections, and IDS events can result from better detection capabilities, tuning changes, or test activities rather than actual increased risk. Reported incidents reflect real harm or attempted compromise.
Why the other options are wrong
- B. Increased malware detections may reflect improved antivirus signatures rather than increased actual risk.
- C. More SIEM alerts can result from configuration changes, tuning adjustments, or increased monitoring rather than actual risk increase.
- D. Increased IDS events may indicate better detection sensitivity rather than a genuine increase in attack attempts or successful compromises.
Question 69
Which of the following is the MOST effective way to detect information security incidents?
Show answer and explanation
Correct answer: D. Educating end users on threat awareness and timely reporting
Educating end users on threat awareness and timely reporting is the most effective way to detect information security incidents. End users are often the first to notice unusual activity, suspicious communications, or signs of compromise. Well-trained users who understand what to look for and know how to report incidents serve as the organization's first line of detection. While response policies, incident response team training, and program testing are all important for handling incidents after detection, they do not detect incidents, educated users reporting threats is the most effective detection mechanism.
Why the other options are wrong
- A. Threat and vulnerability response policies enable handling but do not detect incidents.
- B. Testing the incident response program validates readiness but does not detect incidents.
- C. Training the incident response team enables response but does not detect incidents.
Question 70
An information security policy was amended recently to support an organization's new information security strategy. Which of the following should be the information security manager's NEXT step?
Show answer and explanation
Correct answer: B. Update standards and procedures
After amending a policy to support new security strategy, the next step is to update standards and procedures that operationalize and implement that policy. Standards and procedures translate policy into actionable guidance for the organization, making them the logical next step before evaluating alignment or refreshing training.
Why the other options are wrong
- A. Alignment with business strategy should have been confirmed before the policy amendment.
- C. Reviewing technical controls follows after standards and procedures are established.
- D. Training refresh comes after the implementing mechanisms (standards and procedures) are in place.
Question 71
Reviewing which of the following would be MOST helpful when a new information security manager is developing an information security strategy for a non-regulated organization?
Show answer and explanation
Correct answer: A. Management’s business goals and objectives
Reviewing management's business goals and objectives is MOST helpful because an effective security strategy must be grounded in the organization's specific business context and priorities. Security exists to enable and protect business objectives, not to operate in isolation. Understanding what the business is trying to achieve allows the security manager to align security investments and controls appropriately, even for non-regulated organizations that don't have compliance-driven requirements.
Why the other options are wrong
- B. Strategies of other companies may not align with this organization's unique business model and objectives.
- C. Best practices are a starting point but must be adapted to the organization's specific business goals.
- D. Risk assessment results are important but should follow the establishment of business-aligned strategy objectives.
Question 72
When preparing an information security policy for a global organization, how should an information security manager BEST address local legislation in multiple countries?
Show answer and explanation
Correct answer: D. Establish local policies for each country that supplement the global policy.
Establishing local policies that supplement a global policy is the best approach for addressing multiple jurisdictions. This allows an organization to maintain consistent security standards globally while ensuring compliance with each country's specific legal and regulatory requirements. Local policies can detail how the global policy is implemented within each jurisdiction's constraints.
Why the other options are wrong
- A. Relying on local interpretation without formal policies creates inconsistency and compliance gaps.
- B. Creating exceptions undermines policy consistency and creates loopholes rather than addressing regulatory requirements.
- C. Enforcing identical global policies ignores local legislative differences and creates non-compliance risks.
Question 73
Which of the following has the MOST direct impact on the usability of an organization's asset classification policy?
Show answer and explanation
Correct answer: A. The granularity of classifications in the hierarchy
The granularity of classifications in the hierarchy has the MOST direct impact on usability because it determines whether the classification scheme is practical and easy to apply. Too fine-grained classifications are difficult to maintain and understand; too coarse-grained classifications lack specificity. Appropriate granularity enables consistent, reliable application of the policy by all users.
Why the other options are wrong
- B. While IT management support is important for implementation success, it does not directly affect how usable the policy is.
- C. Risk register updates are periodic governance activities but do not directly impact the day-to-day usability of the classification scheme.
- D. Business objectives inform the classification strategy but the actual usability depends on how granular the classifications are.
Question 74
During which stage of the software development life cycle (SDLC) should application security controls FIRST be addressed?
Show answer and explanation
Correct answer: C. Requirements gathering
Security controls should be addressed first during requirements gathering, the earliest stage of the SDLC. This is when security requirements are defined and incorporated into the project scope, design, and development plans. Addressing security at this stage is far more cost-effective and comprehensive than retrofitting controls later. If security is not considered during requirements, it becomes much harder and more expensive to implement properly in subsequent phases.
Why the other options are wrong
- A. Code development is too late; security decisions must be made before coding begins.
- B. Configuration management occurs after design and development decisions are already made.
- D. While system design is early, requirements gathering precedes and informs the design phase.
Question 75
Which of the following provides an information security manager with the MOST accurate indication of the organization's ability to respond to a cyber attack?
Show answer and explanation
Correct answer: D. Red team exercise
A red team exercise provides the most accurate and comprehensive indication of actual cyber attack response capability because it simulates a full adversarial attack with independent thinking and adaptive techniques, testing the entire detection, response, and recovery process in realistic conditions. Walk-throughs (A) are paper exercises lacking real-world pressure, penetration tests (B) focus on technical vulnerabilities rather than response processes, and phishing exercises (C) test only awareness and email security. Red team exercises validate the complete operational response capability.
Why the other options are wrong
- A. Walk-throughs are passive and don't test actual response execution under stress.
- B. Penetration tests assess technical vulnerabilities, not organizational incident response capability.
- C. Phishing exercises test employee awareness only, not the full incident response ecosystem.
Question 76
Which of the following backup methods requires the MOST time to restore data for an application?
Show answer and explanation
Correct answer: C. Incremental
Incremental backups require the MOST time to restore because they only capture changes since the last backup of any kind. Restoration requires the full backup plus all incremental backups in sequence to rebuild the complete dataset. Disk mirroring is immediate, differential backups require fewer restores than incremental, and full backups are single-step restores. The sequential dependency of incremental backups makes restoration the slowest.
Why the other options are wrong
- A. Disk mirroring provides near-instantaneous recovery with no restoration time needed.
- B. Differential backups require only the full backup plus one differential, faster than incremental restoration.
- D. Full backup restoration is a single step, much faster than sequential incremental restoration.
Question 77
When building support for an information security program, which of the following elements is MOST important?
Show answer and explanation
Correct answer: A. Business impact analysis (BIA)
Business impact analysis (BIA) is the most important element for building support for an information security program because it quantifies the potential business consequences of security failures, demonstrating clear value and ROI to stakeholders and executives. This business-centric perspective is essential for securing organizational commitment and resources, whereas vulnerabilities, threats, and risk assessments are important but derive their context and priority from understanding business impacts.
Why the other options are wrong
- B. Vulnerability identification is important operationally but doesn't establish the foundational business case needed for stakeholder support.
- C. Threat analysis is necessary but doesn't directly demonstrate business relevance without connecting to impacts.
- D. Risk assessment combines threats and vulnerabilities but still requires BIA to contextualize findings for executive decision-making.
Question 78
For an organization that provides web-based services, which of the following security events would MOST likely initiate an incident response plan and be escalated to management?
Show answer and explanation
Correct answer: D. Suspicious network traffic originating from the demilitarized zone (DMZ)
Suspicious network traffic originating from the DMZ is the most critical event because it suggests active compromise or malicious activity within the organization's protected perimeter. For a web-based service organization, DMZ compromises directly threaten service availability and customer data. This requires immediate escalation and incident response activation.
Why the other options are wrong
- A. Anti-malware alerts on workstations are important but typically handled through standard endpoint management and are less immediately critical than DMZ compromise.
- B. Port scans are reconnaissance activity; while worth monitoring, they do not indicate active compromise requiring incident response.
- C. Failed login attempts are routine security events unless there is evidence of actual breach or compromise.
Question 79
Which of the following will protect the confidentiality of data transmitted over the Internet?
Show answer and explanation
Correct answer: D. IPsec protocol
IPsec protocol provides encryption at the network layer (Layer 3) to protect data confidentiality during transmission over the Internet. It encrypts the entire packet payload, protecting data in transit end-to-end across networks. Message digests provide integrity verification, not confidentiality. Encrypting file systems protect data at rest, not in transit. Network address translation masks internal addresses but does not encrypt or protect confidentiality of the data being transmitted.
Why the other options are wrong
- A. Message digests ensure data integrity and authentication but do not encrypt or protect confidentiality.
- B. Encrypting file systems protect data at rest on storage devices, not data transmitted over networks.
- C. Network address translation is a networking technique that hides internal addresses but does not protect data confidentiality in transit.
Question 80
Following a significant change to the underlying code of an application, it is MOST important for the information security manager to:
Show answer and explanation
Correct answer: B. update the risk assessment.
Following significant code changes, updating the risk assessment is the most important action because code changes fundamentally alter the application's risk profile. New vulnerabilities may be introduced, existing controls may be affected, and the threat landscape relative to the application changes. This reassessment informs all downstream decisions about the application. While informing management, validating UAT, and updating KRIs are all appropriate follow-up actions, they depend on first understanding the new risk picture.
Why the other options are wrong
- A. Informing management should occur after risk assessment is complete so you have accurate information to communicate.
- C. UAT validation is part of the change process but doesn't address the core security risk implications of the code changes.
- D. KRIs should be modified based on the updated risk assessment, not independently, making assessment the prerequisite step.
Question 81
Who should an information security manager contact FIRST upon discovering that a cloud-based payment system used by the organization may be infected with malware?
Show answer and explanation
Correct answer: D. The incident response team
The incident response team should be contacted first because they are trained to handle cybersecurity incidents, contain threats, preserve evidence, and coordinate the technical response. The incident response team can immediately begin containment and investigation while simultaneously determining what other parties (senior management, customers, cloud provider) need to be notified and when.
Why the other options are wrong
- A. Senior management should be informed but after the incident response team is engaged and initial containment begins.
- B. Customers should be notified per incident response procedures but only after the situation is assessed and contained.
- C. The cloud service provider should be contacted but after or alongside the incident response team's activation, as the response team determines necessary coordination.
Question 82
An information security manager has been asked to provide contract guidance from a security perspective for outsourcing the organization's payroll processing Which of the following is MOST important to address?
Show answer and explanation
Correct answer: B. Vendor compliance with the organization's information security policies
The most important requirement is vendor compliance with the organization's own information security policies. This ensures the vendor's practices align with the organization's risk tolerance and existing control framework. While industry standards and regulations are important, they are secondary to ensuring the vendor meets the organization's specific security requirements for handling sensitive payroll data.
Why the other options are wrong
- A. The most stringent regulations may be unnecessarily restrictive and aren't necessarily aligned with the organization's actual requirements.
- C. SLA requirements focus on service availability and performance, not specifically on information security measures.
- D. Industry standards are important but generic; organizational policies are more specific and directly applicable to the organization's needs.
Question 83
During the initiation phase of the system development life cycle (SDLC) for a software project, information security activities should address:
Show answer and explanation
Correct answer: B. security objectives
During the initiation phase of SDLC, information security activities should address security objectives, establishing what security must be achieved by the system. This phase sets the foundation for all subsequent security work by defining the goals and scope of security for the project. Baseline controls are implemented later, cost-benefit analyses support decision-making, and benchmarking occurs during execution and monitoring phases.
Why the other options are wrong
- A. Baseline security controls are typically defined and implemented in later SDLC phases, not initiation.
- C. Cost-benefit analyses support implementation decisions but are not the primary security activity focus in initiation.
- D. Benchmarking security metrics occurs during execution and monitoring, after objectives and baselines are established.
Question 84
Which of the following is the MOST important issue in a penetration test?
Show answer and explanation
Correct answer: C. Having a defined goal as well as success and failure criteria
Having clearly defined goals, success criteria, and failure criteria is the most important issue because without these, the penetration test cannot be properly scoped, executed, or evaluated. Clear objectives ensure the test addresses actual security concerns and that results are meaningful. While insider knowledge limitations, independence, and audit approval are good practices, they are secondary to establishing clear purpose and measurable success metrics.
Why the other options are wrong
- A. Testing without insider knowledge (black-box testing) is one approach but not universally required; some tests benefit from context.
- B. Independence is a best practice but less critical than having defined goals for the test.
- D. Audit approval is procedurally important but doesn't define the quality or validity of the test itself.
Question 85
Which of the following is the MOST effective way to prevent information security incidents?
Show answer and explanation
Correct answer: D. Implementing a security awareness training program for employees
Security awareness training addresses the human element, which is the root cause of most security incidents. While IDS/IPS, incident response, and SIEM tools are important for detection and response, they do not prevent incidents from occurring. Training employees to recognize threats, follow security policies, and avoid risky behaviors directly prevents incidents before they happen, making it the most effective preventive measure.
Why the other options are wrong
- A. IDS tools detect incidents but do not prevent them from occurring.
- B. Incident response is about managing incidents after they occur, not preventing them.
- C. SIEM tools monitor and detect incidents but are not a prevention mechanism.
Question 86
An organization's human resources (HR) department is planning to migrate a legacy application to a new application in the cloud. What is the BEST way for the information security manager to support this effort?
Show answer and explanation
Correct answer: D. Conduct a security assessment on the cloud provider.
A comprehensive security assessment of the cloud provider evaluates their security posture, controls, certifications, compliance, and risk management capabilities. This directly supports the migration decision by ensuring the provider meets organizational security requirements. A security assessment is more thorough than vulnerability scanning alone and addresses the full security context of moving sensitive HR data to the cloud.
Why the other options are wrong
- A. Encrypting data alone doesn't address broader cloud provider security issues or compliance requirements.
- B. Vulnerability scanning is technical but may not comprehensively evaluate provider security controls, certifications, and processes.
- C. Updating policies is necessary but doesn't evaluate whether the cloud provider can actually support those policies.
Question 87
Which of the following would be impacted the MOST by a business decision to move from traditional computing to cloud computing?
Show answer and explanation
Correct answer: D. Security strategy
Moving to cloud computing requires the most fundamental shift in security strategy because it fundamentally changes the organization's risk profile, responsibility model, and approach to security governance. While security awareness, standards, and policies may need updates, the overall strategy, which guides how the organization approaches security threats, asset protection, and risk management in a cloud environment, must be comprehensively reconsidered.
Why the other options are wrong
- A. Security awareness training may need updates but doesn't represent the most fundamental impact.
- B. Security standards provide guidelines but are more tactical than strategic.
- C. Policies are derived from strategy and while they need updating, the strategy itself is impacted most significantly.
Question 88
To address the issue that performance pressures on IT may conflict with information security controls, it is MOST important that:
Show answer and explanation
Correct answer: A. the steering committee provides guidance and dispute resolution.
When performance pressures conflict with security controls, the steering committee at the governance level is best positioned to provide authoritative guidance and dispute resolution. This executive body can weigh competing priorities, make informed trade-off decisions, and ensure organizational alignment. Changing policy to accommodate pressure (B) would weaken security; better alignment (C) is helpful but doesn't resolve conflicts; and reporting non-compliance (D) is reactive rather than proactive resolution.
Why the other options are wrong
- B. Compromising security policy to accommodate performance pressure undermines the security program.
- C. While alignment helps, it doesn't resolve fundamental conflicts between competing priorities.
- D. Reporting issues doesn't resolve the underlying conflict; governance-level intervention is needed.
Question 89
The use of a business case to obtain funding for an information security investment is MOST effective when the business case:
Show answer and explanation
Correct answer: A. relates the investment to the organization's strategic plan.
A business case for security funding is most effective when it directly relates the investment to the organization's strategic plan. This connection demonstrates how the security initiative supports organizational goals and priorities, making it compelling to business leaders and decision-makers. Strategic alignment is the key to securing resources in competitive environments.
Why the other options are wrong
- B. Realigning security objectives to strategy is important but is an outcome of alignment, not the most effective element of the business case itself.
- C. Clear language about management intent is important for communication, but does not address the fundamental business justification.
- D. Translating policies into requirements is a tactical implementation detail, not the primary effectiveness factor for funding justification.
Question 90
Which of the following is the MOST appropriate resource to determine whether or not a particular solution should utilize encryption based on its location and data classification?
Show answer and explanation
Correct answer: C. Standards
Standards are the most appropriate resource to determine encryption requirements based on data classification and location. Standards provide mandatory, specific technical requirements for how security measures like encryption must be implemented across the organization. They establish measurable, enforceable criteria that directly address technical decisions about encryption deployment.
Why the other options are wrong
- A. Guidelines are advisory and non-mandatory, lacking the prescriptive detail needed for technical decisions.
- B. Procedures describe how to implement controls but don't define what controls should be used.
- D. Policies establish the 'what' and 'why' but standards provide the specific 'how' for technical implementation.
Question 91
Which of the following MOST effectively allows for disaster recovery testing without interrupting business operations?
Show answer and explanation
Correct answer: C. Parallel testing
Parallel testing is the most effective method for disaster recovery testing without interrupting business operations. In parallel testing, the recovery environment is activated and tested simultaneously with the production environment, allowing full validation of disaster recovery procedures and systems while the primary systems continue serving users. This approach provides comprehensive testing without operational downtime.
Why the other options are wrong
- A. Structured walk-through is a discussion-based exercise that does not provide actual operational testing.
- B. Simulation testing is theoretical and does not activate actual recovery systems or data.
- D. Full interruption testing requires shutting down production systems, which directly interrupts business operations.
Question 92
Signature based anti-malware controls are MOST effective against:
Show answer and explanation
Correct answer: C. known threats.
Signature-based anti-malware is most effective against known threats because it identifies malware by matching file hashes, code patterns, or behavioral signatures against a database of previously identified malicious code. This approach works only when the threat has been discovered, analyzed, and added to the signature database, making it inherently ineffective against new or modified variants.
Why the other options are wrong
- A. Firewall configuration issues are a network control problem, not related to malware signature detection.
- B. Reused virus code is addressed by signatures, but the key factor is whether it is 'known' (in the database).
- D. Zero-day exploits are the classic weakness of signature-based approaches since they are unknown and lack signatures.
Question 93
Which of the following should be the PRIMARY focus of a status report on the information security program to senior management?
Show answer and explanation
Correct answer: C. Demonstrating risk is managed at the desired level
The PRIMARY focus of status reports to senior management should be demonstrating that risk is managed at the desired level, as this directly aligns with business objectives and senior management's accountability. Risk management is the strategic outcome of the security program that matters most to executive leadership. While policy compliance, budget management, and resource performance are important, they are all means to the end of achieving appropriate risk management.
Why the other options are wrong
- A. Policy compliance is important but is an operational metric, not the primary strategic focus.
- B. Budget management is a financial metric, not the primary indicator of security program effectiveness.
- D. Resource performance measurement is an internal operational concern, not the executive-level primary focus.
Question 94
Which of the following is MOST important to ensure when an organization is moving portions of its sensitive database to the cloud?
Show answer and explanation
Correct answer: C. Input from data owners is included in the requirements definition.
Including input from data owners in the requirements definition is MOST important because data owners have the deepest knowledge of their data's sensitivity, criticality, compliance needs, and business context. Their input ensures that cloud solutions truly meet organizational and regulatory requirements. While security team approval, audit rights, and encryption are all important security measures, they are secondary to correctly defining what protections are needed, which comes from data owner input.
Why the other options are wrong
- A. Security team approval is part of governance but doesn't replace data owner input on requirements.
- B. Audit rights are important contractual provisions but don't ensure proper requirements definition.
- D. Encryption is a necessary technical control but doesn't address whether requirements were properly defined before selection.
Question 95
The PRIMARY benefit of a centralized time server is that it:
Show answer and explanation
Correct answer: C. allows decentralized logs to be kept in synchronization.
The primary benefit of a centralized time server is enabling decentralized logs to remain synchronized. This ensures that logs across multiple systems have consistent timestamps, which is critical for correlating events, investigating incidents, maintaining audit trails, and detecting attack sequences. Without time synchronization, logs become unreliable for forensic analysis and compliance purposes.
Why the other options are wrong
- A. Time server synchronization does not directly prevent unrecoverable systems failures.
- B. While time servers may reduce requests, this is not their primary benefit.
- D. Time servers are not technically required by password synchronization programs.
Question 96
Which of the following is MOST important to the successful management of an information security program?
Show answer and explanation
Correct answer: C. Support from key stakeholders
Support from key stakeholders is the most critical foundation for a successful information security program. Without buy-in and support from executives, management, and business leaders, even the best security strategies will fail due to lack of resources, enforcement, and organizational alignment. Stakeholder support enables adequate budgeting, compliance efforts, and control implementation.
Why the other options are wrong
- A. Compliance is important but is a goal achieved through an effective program, not the foundation for success.
- B. Budget must be approved by stakeholders first; it's a consequence of stakeholder support, not the primary driver.
- D. Monitoring is a control mechanism that depends on having an established program supported by leadership.
Question 97
Which of the following should be done FIRST when selecting performance metrics to report on the vendor risk management process?
Show answer and explanation
Correct answer: C. Identify the intended audience.
When selecting performance metrics for any reporting process, the first and most critical step is to identify the intended audience. Different stakeholders, executives, technical teams, audit committees, require different metrics, formats, and levels of detail. This understanding drives all subsequent decisions about data sources, confidentiality requirements, and data ownership. Skipping this step results in metrics that don't serve their purpose.
Why the other options are wrong
- A. Data source selection comes after understanding what metrics and information the audience needs.
- B. Confidentiality requirements are determined after understanding the audience and their needs.
- D. Data owner identification follows the determination of what data is needed for the intended audience.
Question 98
A health care organization's information security manager is notified of a possible breach of critical patient data involving a large volume of records. What should the information security manager do FIRST?
Show answer and explanation
Correct answer: C. Validate whether the breach occurred
The security manager's FIRST action must be to validate whether the breach actually occurred. This is the foundational step because all subsequent actions depend on confirming the incident is real. Until verified, the manager cannot accurately assess impact, determine who to notify, or understand the regulatory obligations. Without validation, resources may be wasted and inappropriate notifications made based on false alarms.
Why the other options are wrong
- A. Regulatory notification should only occur after confirming a breach actually happened.
- B. Escalation should follow validation so management understands the actual situation.
- D. Impact assessment comes after confirming the breach, as impact depends on whether it actually occurred.
Question 99
The business advantage of implementing authentication tokens is that they:
Show answer and explanation
Correct answer: D. improve access security.
The primary business advantage of authentication tokens is improved access security through stronger authentication mechanisms and reduced reliance on passwords. Tokens support multi-factor authentication, reducing unauthorized access risk. While tokens may reduce administrative workload in some scenarios, their primary business value is security enhancement. They do not provide nonrepudiation and typically increase rather than reduce overall cost.
Why the other options are wrong
- A. Authentication tokens provide authentication but not nonrepudiation.
- B. Tokens typically increase costs due to infrastructure and hardware requirements.
- C. While tokens may reduce some admin tasks, security improvement is the primary business advantage.
Question 100
A small organization has a contract with a multinational cloud computing vendor. Which of the following would present the GREATEST concern to an information security manager if omitted from the contract?
Show answer and explanation
Correct answer: C. Authority of the subscriber to approve access to its data
The GREATEST concern if omitted is the subscriber's authority to approve access to its data. This addresses who controls access to the organization's most critical asset, its data. Without explicit contractual rights to approve data access, the organization loses control over who can view, process, or access its sensitive information, creating unacceptable security and privacy risks.
Why the other options are wrong
- A. Software escrow is relevant for specific software contracts but less critical than data access control for cloud services.
- B. Audit rights are important for compliance verification but less fundamental than maintaining control over data access.
- D. While data commingling should be avoided, the ability to approve access and maintain access controls is more critical than physical segregation.
Question 101
When developing a tabletop test plan for incident response testing, the PRIMARY purpose of the scenario should be to:
Show answer and explanation
Correct answer: B. provide participants with situations to ensure understanding of their roles.
The primary purpose of a tabletop exercise scenario is to provide realistic situations that ensure participants understand their defined roles and responsibilities in the incident response process. This educational focus helps teams develop muscle memory for proper procedures and clarifies who does what when incidents occur. While measuring management engagement, assessing readiness, and applying pressure are secondary benefits, the main purpose is to ensure participants grasp their specific roles and how they fit into the overall response structure.
Why the other options are wrong
- A. Measuring management engagement is a secondary outcome, not the primary purpose of the scenario.
- C. Giving the business a readiness measure is an outcome of testing, not the primary purpose of the scenario design.
- D. While pressure-based learning occurs, the primary purpose focuses on understanding roles rather than stress testing problem-solving.
Question 102
Which is the MOST important requirement when establishing a process for responding to zero-day vulnerabilities?
Show answer and explanation
Correct answer: D. The information security team implements recommended workarounds.
When no patch exists for a zero-day vulnerability, implementing recommended workarounds or mitigations is the most important immediate requirement. This allows the organization to continue operations while reducing risk exposure until a patch becomes available. Workarounds address the vulnerability directly at the point of exploitation. While antivirus updates, patch deployment processes, and stopping application use may all be considerations, they are either insufficient (antivirus against zero-days) or impractical (stopping critical applications) compared to implementing vendor-recommended mitigations.
Why the other options are wrong
- A. Antivirus signatures are ineffective against zero-day vulnerabilities by definition, as signatures don't yet exist.
- B. Patches don't exist for zero-days, so this process cannot be implemented immediately.
- C. Stopping all use of an impacted application may not be practical for critical business functions and is overly disruptive.
Question 103
Which of the following should an information security manager do NEXT after creating a roadmap to execute the strategy for an information security program?
Show answer and explanation
Correct answer: A. Develop a project plan to implement the strategy
After creating a roadmap for the security strategy, the NEXT logical step is to develop a detailed project plan to execute that strategy. A roadmap is a high-level vision, while a project plan provides the specific tasks, timelines, resources, and deliverables needed for implementation. This follows the natural progression from strategic planning to operational execution.
Why the other options are wrong
- B. Executive board consensus should have been obtained earlier in the strategy development process, not after the roadmap is created.
- C. Risk tolerance should be defined during strategy development, not after the roadmap is already created.
- D. Business goal alignment should be reviewed during strategy creation, not after the roadmap exists.
Question 104
An organization wants to ensure its confidential data is isolated in a multi-tenanted environment at a well-known cloud service provider. Which of the following is the BEST way to ensure the data is adequately protected?
Show answer and explanation
Correct answer: D. Ensure an audit of the provider is conducted to identify control gaps.
An independent audit of the cloud provider is the most comprehensive way to verify that controls adequately protect confidential data in a multi-tenant environment. Audits identify actual control gaps and implementation weaknesses rather than relying on provider claims or documentation. While framework compliance, policy review, and encryption documentation are all relevant, only a formal audit provides the verification needed to ensure adequate protection of sensitive data.
Why the other options are wrong
- A. Framework compliance alone doesn't guarantee the provider has effectively implemented all required controls.
- B. Policies and procedures don't confirm actual implementation or operational effectiveness of security controls.
- C. Encryption documentation describes the approach but doesn't verify proper implementation or key management practices.
Question 105
A small organization with limited budget hires a new information security manager who finds the same IT staff member is assigned the responsibility of system administrator, security administrator, database administrator, and application administrator. What is the manager's BEST course of action?
Show answer and explanation
Correct answer: D. Implement monitoring of IT administrator activities.
When segregation of duties cannot be achieved due to budget constraints, implementing monitoring of IT administrator activities is the BEST compensating control. This addresses the high-risk concentration of multiple critical roles by establishing detective controls that can identify unauthorized or fraudulent actions. Monitoring provides visibility into activities that would normally be separated, reducing the risk from this control weakness.
Why the other options are wrong
- A. Documentation alone does not mitigate the risk of concentrated administrative access.
- B. Automation of user provisioning doesn't address the fundamental problem of one person holding too many powerful roles.
- C. Strict control over provisioning is necessary but insufficient without monitoring to detect misuse by the overprivileged administrator.
Question 106
Which of the following is MOST important to determine following the discovery and eradication of a malware attack?
Show answer and explanation
Correct answer: B. The malware entry path
Determining the malware entry path is MOST important following eradication because understanding how the malware entered the system is critical for preventing future infections. Without knowing the entry path, the organization cannot close the vulnerability or control the attack vector. The entry path reveals gaps in preventive controls and informs remediation strategies to prevent recurrence, which is more valuable than knowing the malware type or creator.
Why the other options are wrong
- A. The creator's identity is rarely actionable for improving security controls.
- C. Malware type is secondary; understanding entry path is more directly actionable for prevention.
- D. Detection method is less important than understanding how the attack succeeded in the first place.
Question 107
It is MOST important for an information security manager to ensure that security risk assessments are performed:
Show answer and explanation
Correct answer: C. consistently throughout the enterprise.
Security risk assessments must be performed consistently throughout the enterprise to ensure uniform understanding of organizational risk across all business units and systems. This consistency enables coherent risk management strategy and prevents gaps where some areas lack proper risk evaluation.
Why the other options are wrong
- A. Root cause analysis is performed after incidents, not as the context for initial risk assessments.
- B. Security business cases are informed by assessments but are not the timing driver for when they should occur.
- D. While threat landscape changes are important, consistent ongoing assessments throughout the enterprise is more critical than purely reactive assessment.
Question 108
The fundamental purpose of establishing security metrics is to:
Show answer and explanation
Correct answer: C. provide feedback on control effectiveness.
The fundamental purpose of security metrics is to provide feedback on control effectiveness, enabling organizations to measure whether their security controls are functioning as intended and delivering expected protection. Metrics demonstrate the value and performance of security investments, support continuous improvement decisions, and provide evidence of due diligence. This feedback function is the cornerstone of metrics in security programs.
Why the other options are wrong
- A. Adopting best practices is an implementation outcome, not the fundamental purpose of metrics.
- B. Establishing benchmarks is a use of metrics but not their primary fundamental purpose.
- D. ROI is a business benefit that may result from good metrics but not their fundamental purpose.
Question 109
In order to understand an organization's security posture, it is MOST important for an organization's senior leadership to:
Show answer and explanation
Correct answer: C. ensure established security metrics are reported.
Ensuring established security metrics are reported is MOST important for senior leadership to understand security posture because metrics provide the quantified, objective view of how security is performing. Well-defined metrics give executives actionable visibility into whether the security program is effective, where gaps exist, and how security is trending over time. This regular metric reporting is more comprehensive and reliable than incident counts or single tests for understanding overall posture.
Why the other options are wrong
- A. Incident counts alone don't indicate posture; they may reflect detection capability rather than actual security state.
- B. A single incident response test provides limited insight; ongoing metrics give a broader view of posture.
- D. Risk mitigation progress is important but is one component; established metrics provide more complete posture understanding.
Question 110
Of the following, who should the security manager consult FIRST when determining the severity level of a security incident involving a third-party vendor?
Show answer and explanation
Correct answer: D. Business process owners
The business process owner should be consulted FIRST when determining severity of a third-party incident because they understand the criticality of the affected business process, its dependencies, and impact to the organization. They can immediately inform whether the incident affects essential operations and what the true business impact is. This contextual business knowledge is essential for proper severity classification before other technical or risk assessments.
Why the other options are wrong
- A. Risk manager should be involved but after the business impact is understood.
- B. Business partners are external stakeholders consulted after internal severity is determined.
- C. IT process owners focus on technical aspects but lack the business criticality perspective.
Question 111
The PRIMARY purpose of an information security governance framework is to ensure that the information security strategy is an extension of:
Show answer and explanation
Correct answer: A. organizational strategies.
The PRIMARY purpose of an information security governance framework is to ensure that information security strategy is an extension of organizational strategies. Governance frameworks provide the structure to align security with overall business objectives, ensuring that security investments support business goals. While IT strategy (B), enterprise architecture (C), and business cases (D) are related, organizational strategy is the overarching framework to which all others must align.
Why the other options are wrong
- B. Information technology strategy is a subset of organizational strategy, not the primary basis for security governance.
- C. Formal enterprise architecture is a tool but not the primary driver of security governance.
- D. Approved business cases support strategy implementation but are not the primary framework basis for governance.
Question 112
An attacker was able to gain access to an organization's perimeter firewall and made changes to allow wider external access and to steal data. Which of the following would have BEST provided timely identification of this incident?
Show answer and explanation
Correct answer: C. Deploying a security information and event management system (SIEM)
A SIEM system provides comprehensive logging, correlation, and real-time alerting capabilities that would detect unauthorized firewall configuration changes and data exfiltration attempts. SIEM aggregates and analyzes security events across the infrastructure, making it the most effective tool for timely incident identification compared to point solutions.
Why the other options are wrong
- A. DLP focuses on preventing data loss but would not necessarily detect firewall configuration changes made by the attacker.
- B. IPS can block malicious traffic but may not detect stealthy configuration changes to the firewall itself.
- D. Awareness training is preventive in nature and would not provide timely identification of an active incident already in progress.
Question 113
An information security manager has been asked to determine whether an information security initiative has reduced risk to an acceptable level. Which of the following activities would provide the BEST information for the information security manager to draw a conclusion?
Show answer and explanation
Correct answer: B. Performing a risk assessment
Performing a risk assessment provides the BEST information to determine if an initiative has reduced risk to acceptable levels because it measures residual risk post-implementation against defined thresholds. A risk assessment directly evaluates whether security controls achieved their intended risk reduction. Cost-benefit analysis (A) measures value but not risk reduction; risk register (C) documents known risks but may not capture current state; BIA (D) measures business impact, not security effectiveness.
Why the other options are wrong
- A. Cost-benefit analysis shows financial value but doesn't measure whether risk is actually at acceptable levels.
- C. Risk register documents identified risks but doesn't measure whether implemented controls reduced risk sufficiently.
- D. Business impact analysis assesses potential damage but doesn't evaluate security control effectiveness.
Question 114
Which of the following is the MOST effective way to help staff members understand their responsibilities for information security?
Show answer and explanation
Correct answer: B. Require staff to participate in information security awareness training.
Information security awareness training is the most effective method to help staff understand their security responsibilities because it actively educates employees on expectations, threats, and proper procedures. Training creates understanding and behavioral change, whereas agreements are passive documents, job descriptions are static reference materials, and disciplinary communication focuses on consequences rather than education. Awareness training is the foundation of a security-conscious workforce.
Why the other options are wrong
- A. Confidentiality agreements establish legal obligations but don't educate staff on security responsibilities.
- C. Communicating discipline focuses on consequences, not on helping staff understand what they should do.
- D. Job descriptions document roles but don't actively teach security practices and awareness.
Question 115
An intrusion has been detected and contained. Which of the following steps represents the BEST practice for ensuring the integrity of the recovered system?
Show answer and explanation
Correct answer: B. Install the OS, patches, and application from the original source.
Installing the OS, patches, and application from the original source (a clean installation) represents the best practice for ensuring system integrity after an intrusion. This approach guarantees a clean state free from any potential compromise or backdoors the attacker may have introduced. Starting fresh from trusted original sources is superior to restoring from backups that may contain malware or using forensic copies that preserve the compromised state.
Why the other options are wrong
- A. A forensic copy preserves the compromised state and should not be used for operational recovery.
- C. Restoring from backup risks reintroducing the intrusion if the backup was created after compromise occurred.
- D. Attempting to remove signs of intrusion without a clean rebuild leaves unknown vulnerabilities and potential backdoors.
Question 116
Which type of incident response test is the MOST efficient way to verify that backup power generators are functioning?
Show answer and explanation
Correct answer: D. Full interruption test
A full interruption test (also called a cutover test) is the most efficient way to verify that backup power generators are functioning because it actually interrupts normal operations and forces the system to rely entirely on the generators. This provides definitive proof that the generators work under real conditions. While more disruptive than other methods, it is the only test that truly validates actual functionality.
Why the other options are wrong
- A. An operational full test does not necessarily interrupt normal operations and may not fully validate generator performance.
- B. A simulation failure test is a theoretical exercise that does not verify actual generator functionality.
- C. A parallel recovery test runs systems in parallel but does not require actual reliance on generators.
Question 117
Which of the following is MOST important to review following a security incident?
Show answer and explanation
Correct answer: D. Lessons learned
Following a security incident, the most important activity is to conduct a lessons learned review. This post-incident analysis identifies what went well, what could be improved, and captures valuable insights to enhance future incident response effectiveness. While procedures, tools, and plans are important, reviewing lessons learned directly drives organizational improvement and prevents similar incidents.
Why the other options are wrong
- A. Incident response procedures are foundational but are reviewed DURING the process, not primarily after.
- B. Response tools and techniques are resources used, but their review is less critical than capturing lessons learned.
- C. The incident response plan guides the response but reviewing it comes after understanding what happened through lessons learned.
Question 118
A risk was identified during a risk assessment. The business process owner has chosen to accept the risk because the cost of remediation is greater than the projected cost of a worst-case scenario. What should be the information security manager's NEXT course of action?
Show answer and explanation
Correct answer: B. Document and escalate to senior management.
When a business process owner accepts a risk based on cost-benefit analysis, this represents a significant organizational decision that may have strategic implications. The information security manager should document this decision and escalate it to senior management for formal approval and awareness, ensuring accountability at the appropriate organizational level. While revisiting is important (Option A), escalation to senior management is the more critical immediate next action to ensure executive awareness and approval of the accepted risk.
Why the other options are wrong
- A. Revisiting is appropriate but secondary; senior management must first formally acknowledge and approve the risk acceptance.
- C. Shutting down the application isn't the security manager's decision; that's for business leadership after understanding the risk.
- D. Finding lower-cost remediation contradicts the business owner's decision; escalation should come first before exploring alternatives.
Question 119
An information security manager is recommending an investment in a new security initiative to address recently published threats. Which of the following is MOST important to include in the business case?
Show answer and explanation
Correct answer: B. Potential impact of threat realization
The most important element of a business case for a new security initiative is the potential impact of threat realization. This establishes the business justification by quantifying what damage, loss, or disruption will occur if the organization does not address the threat. This impact directly justifies the investment and helps senior management understand why the initiative is critical, making it the most persuasive component of the business case.
Why the other options are wrong
- A. IT strategy alignment is important for governance but doesn't justify the business need like threat impact does.
- C. Resource availability is a constraint to manage but doesn't justify the investment's necessity.
- D. Peer threat intelligence supports the argument but is less compelling than the organization's specific impact analysis.
Question 120
An information security manager wants to document requirements detailing the minimum security controls required for user workstations. Which of the following resources would be MOST appropriate for this purpose?
Show answer and explanation
Correct answer: B. Standards
Standards are the appropriate resource for documenting minimum security control requirements. Standards specify what must be done and define baseline security requirements that are mandatory across the organization. Policies provide high-level direction, procedures provide step-by-step instructions, and guidelines offer recommendations, none of these serve the specific purpose of defining minimum control requirements as effectively as standards do.
Why the other options are wrong
- A. Policies establish overall direction but lack the specific technical control requirements needed.
- C. Procedures detail how to perform tasks but don't specify minimum control requirements.
- D. Guidelines offer recommendations rather than mandatory minimum requirements.
Question 121
Which of the following components of an information security risk assessment is MOST valuable to senior management?
Show answer and explanation
Correct answer: A. Residual risk
Residual risk is the most valuable component for senior management because it represents the risk that remains after mitigation controls are implemented. This directly answers management's key question: 'What risk will the organization bear after implementing controls?' It drives strategic and budgetary decisions. ROI is useful but may not always be quantifiable; threat profiles are technical details; and mitigation actions are implementation details that follow from residual risk assessment.
Why the other options are wrong
- B. ROI can be difficult to quantify for security controls and is secondary to understanding actual risk exposure.
- C. Mitigation actions are implementation details that follow from risk assessment findings.
- D. Threat profile is technical detail that supports risk assessment but is not the primary management concern.
Question 122
A legacy application does not comply with new regulatory requirements to encrypt sensitive data at rest, and remediating this issue would require significant investment. What should the information security manager do FIRST?
Show answer and explanation
Correct answer: A. Assess the business impact to the organization.
When faced with a compliance gap requiring significant investment, the information security manager must first understand the full scope of the problem by assessing the business impact. This assessment informs whether remediation should proceed, how urgent it is, and what level of resources to justify. Understanding impact precedes cost determination and is necessary before presenting risk to management or exploring alternatives.
Why the other options are wrong
- B. Presenting risk to management should follow a thorough understanding of the business impact and available options.
- C. Investigating alternatives is premature before understanding the actual business impact of the noncompliance.
- D. Cost determination should follow impact assessment, as the severity of impact influences priority and investment decisions.
Question 123
Which of the following is the GREATEST value provided by a security information and event management (SIEM) system?
Show answer and explanation
Correct answer: A. Facilitating the monitoring of risk occurrences
A SIEM system's greatest value is facilitating real-time monitoring and detection of security events and risk occurrences across the environment. This enables rapid identification and response to security incidents. While measuring exploit impact is useful, it requires business process context not inherent to SIEM; policy repositories are document management functions; and log redirection is a basic feature, not the primary value proposition.
Why the other options are wrong
- B. Measuring business impact requires correlation with business processes, beyond SIEM's core function.
- C. Policy repository functions belong to document management systems, not SIEM.
- D. Log redirection is a basic technical feature, not the greatest value of SIEM.
Question 124
Which of the following is the BEST way for an information security manager to justify ongoing annual maintenance fees associated with an intrusion prevention system (IPS)?
Show answer and explanation
Correct answer: A. Establish and present appropriate metrics that track performance.
Establishing and presenting appropriate metrics that track performance (detection rates, incidents prevented, mean time to response improvements, etc.) directly demonstrates the IPS's value and justifies its cost. This is the most objective and business-relevant approach. While industry rankings and penetration tests provide some data, they don't directly show ongoing operational value. Competitive pricing alone doesn't justify why this specific IPS is worth its maintenance cost.
Why the other options are wrong
- B. Industry rankings are subjective and don't demonstrate this organization's specific IPS performance or ROI.
- C. A penetration test is a point-in-time assessment and doesn't justify ongoing annual costs.
- D. Competitive pricing shows market options but doesn't prove the value delivered by this particular system.
Question 125
Which of the following is necessary to determine what would constitute a disaster for an organization?
Show answer and explanation
Correct answer: C. Risk analysis
Risk analysis is necessary to determine what constitutes a disaster because it identifies threats, vulnerabilities, and their potential impacts on the organization. By analyzing risks, an organization can understand which events would cause significant business disruption and therefore qualify as disasters requiring recovery efforts. This analysis forms the foundation for defining disaster thresholds and determining recovery priorities.
Why the other options are wrong
- A. Recovery strategy analysis assumes disasters are already defined; it follows rather than precedes disaster definition.
- B. Backup strategy analysis is a technical control implementation decision, not a method for determining what is a disaster.
- D. Threat probability analysis is one component of risk analysis but alone doesn't determine business impact thresholds that define disasters.
Question 126
Which of the following is the MOST important security consideration when developing an incident response strategy with a cloud provider?
Show answer and explanation
Correct answer: D. Escalation processes
Escalation processes are the MOST important security consideration in incident response strategy with a cloud provider because they determine how quickly and effectively the organization can engage the provider, report incidents, and coordinate response actions. Without clear escalation procedures, critical incident response time may be lost. While audit reports, RTO, and technological capabilities are important, escalation processes directly enable effective incident response coordination.
Why the other options are wrong
- A. Security audit reports provide assurance but do not directly enable incident response.
- B. RTO is important for recovery planning but escalation processes are critical for response initiation.
- C. Technological capabilities support response but escalation defines who does what and when.
Question 127
An organization's CIO has tasked the information security manager with drafting the charter for an information security steering committee. The committee will be comprised of the CIO, the IT shared services manager, the vice president of marketing, and the information security manager. Which of the following is the MOST significant issue with the development of this committee?
Show answer and explanation
Correct answer: B. The committee lacks sufficient business representation.
The most significant issue is that the committee lacks sufficient business representation. The composition includes the CIO, IT shared services manager, VP of marketing, and the security manager, only one non-IT executive (marketing VP) represents the broader business. An effective information security steering committee requires representation from multiple business units and departments whose operations depend on information security, not just IT and one marketing executive. Without adequate business representation, the committee cannot properly understand business priorities, risks, and requirements needed to guide security strategy.
Why the other options are wrong
- A. Having senior executives on a steering committee is appropriate and expected; more executives is not inherently a problem.
- C. While business-IT alignment is important, this is not framed as a conflict but as a potential governance gap.
- D. The CIO's leadership of the committee is actually appropriate; this is not an issue.
Question 128
Which of the following external entities would provide the BEST guidance to an organization facing advanced attacks?
Show answer and explanation
Correct answer: C. Recognized threat intelligence communities
Recognized threat intelligence communities provide the best guidance for organizations facing advanced attacks because they offer curated, validated information about threat actors, attack patterns, and indicators of compromise specific to advanced persistent threats. These communities aggregate data from multiple sources and organizations, providing context and correlation that helps organizations understand and defend against sophisticated attacks more effectively than any single source.
Why the other options are wrong
- A. While peer organizations may offer insights, they lack the structured, comprehensive threat data that intelligence communities provide.
- B. Open-source reconnaissance is passive and may not provide actionable intelligence on advanced attacks.
- D. Disaster recovery consultants focus on recovery rather than threat detection and advanced attack guidance.
Question 129
Which of the following is MOST important to the successful implementation of an information security program?
Show answer and explanation
Correct answer: B. Obtaining stakeholder input
Obtaining stakeholder input is most critical to successful implementation because it ensures buy-in, alignment with business objectives, understanding of constraints and requirements, and commitment from those who must execute and support the program. Without stakeholder engagement, even the best-designed program will fail. KPIs measure performance but aren't prerequisite to implementation. Technology understanding is important but secondary to organizational alignment. Risk assessments are essential but periodic, initial stakeholder input comes first.
Why the other options are wrong
- A. KPIs are important for measurement but come after establishing stakeholder buy-in and program direction.
- C. Technology understanding is valuable but organizational alignment through stakeholder input is more fundamental to success.
- D. Risk assessments are essential but are typically part of the ongoing program; stakeholder input is needed from the start.
Question 130
Which of the following is an information security manager's BEST approach when selecting cost-effective controls needed to meet business objectives?
Show answer and explanation
Correct answer: D. Align with the risk appetite.
Aligning control selection with risk appetite ensures that controls are proportionate to the organization's willingness and ability to accept risk while meeting business objectives. This balances cost-effectiveness with appropriate protection. Gap analysis identifies deficiencies but doesn't drive cost-effective selection. Focusing only on preventive controls ignores other needed control types. Industry best practice provides benchmarks but doesn't account for the organization's specific risk tolerance and business priorities.
Why the other options are wrong
- A. Gap analysis identifies what's missing but doesn't determine which controls to select based on cost-effectiveness and business objectives.
- B. Preventive controls alone aren't sufficient; detective and corrective controls are also necessary for a balanced program.
- C. Best practice provides guidance but must be tailored to the organization's specific risk appetite and business context.
Question 131
Which of the following BEST enables the design of an effective incident escalation process?
Show answer and explanation
Correct answer: A. A well-defined organizational hierarchy
A well-defined organizational hierarchy is what best enables designing an effective incident escalation process. Escalation paths require clear reporting lines, decision authority levels, and responsibility chains so that incidents are routed to appropriate personnel based on severity and impact. Without understanding the organizational structure, escalation procedures cannot be properly designed.
Why the other options are wrong
- B. Control baselines define what controls should exist but don't inform escalation decision paths.
- C. A risk register helps prioritize risks but doesn't define how incidents should be escalated through the organization.
- D. Defense-in-depth defines control strategy, not the organizational structure needed for escalation.
Question 132
An incident response team has determined there is a need to isolate a system that is communicating with a known malicious host on the Internet. Which of the following stakeholders should be contacted FIRST?
Show answer and explanation
Correct answer: D. System administrator
When a system needs to be isolated due to malicious communication, the system administrator must be contacted first because they have the technical capability to immediately take action to isolate the system. While the business owner should be notified, this is a technical emergency requiring immediate action, not a business decision. Customers and executive management should be informed after containment is underway, following the incident response chain of command which prioritizes immediate technical remediation.
Why the other options are wrong
- A. Business owner notification is important but secondary to immediate technical isolation by the administrator.
- B. Customer notification is part of communication planning but not the first priority in active incident containment.
- C. Executive management should be notified, but the technical team must act first to contain the threat.
Question 133
To set security expectations across the enterprise, it is MOST important for the information security policy to be regularly reviewed and endorsed by:
Show answer and explanation
Correct answer: B. senior management.
Information security policies must be regularly reviewed and endorsed by senior management to establish organization-wide security expectations with appropriate authority and accountability. Senior management endorsement ensures that security policies have executive backing, are aligned with business objectives, and carry the weight needed for enterprise-wide compliance. While the CISO may draft policies and security administrators implement them, only senior management has the organizational authority and responsibility to set enterprise expectations. IT steering committees and CISOs support this process but are not the most important endorsers.
Why the other options are wrong
- A. Security administrators implement policies but lack the authority to set organization-wide expectations.
- C. The CISO is responsible for developing and recommending policies but senior management must endorse them for authority.
- D. An IT steering committee may advise but senior management has the ultimate authority and responsibility for policy governance.
Question 134
What should be the GREATEST concern for an information security manager of a large multinational organization when outsourcing data processing to a cloud service provider?
Show answer and explanation
Correct answer: A. Local laws and regulations
Local laws and regulations should be the greatest concern for a multinational organization outsourcing to cloud providers because data may be subject to different jurisdictions with conflicting requirements (data residency, sovereignty, privacy laws, export controls). Failure to comply with local laws exposes the organization to legal liability, regulatory penalties, and potential loss of operating licenses across multiple countries.
Why the other options are wrong
- B. Backup and restoration are operational concerns typically addressed through contract SLAs, not a strategic governance issue.
- C. SLAs are important contractual protections but are negotiable and derivative of legal requirements.
- D. Independent vendor review is a due diligence step, but does not address the fundamental compliance risk of operating across jurisdictions.
Question 135
Which of the following is the MOST effective approach to ensure seamless integration between the business continuity plan (BCP) and the incident response plan?
Show answer and explanation
Correct answer: D. Consistent event classifications are used in both plans.
Using consistent event classifications in both the business continuity plan and incident response plan is MOST effective for seamless integration because it ensures clear communication, consistent escalation criteria, and shared understanding between teams about when situations warrant response versus continuity actions. This common language prevents confusion and gaps.
Why the other options are wrong
- A. Including the BCP manager in the incident response team creates overlap but doesn't ensure integration of the plans themselves.
- B. Escalation criteria are important but don't address the fundamental need for integrated planning and terminology.
- C. Having identical team members is impractical and unnecessary; distinct teams can be well-integrated through proper planning.
Question 136
Which of the following is the MOST important requirement for a successful security program?
Show answer and explanation
Correct answer: D. Mapping security processes to baseline security standards
Mapping security processes to baseline standards (like NIST, ISO 27001) provides the foundational structure and legitimacy necessary for a successful security program. This establishes a recognized framework, enables measurement against industry standards, and provides stakeholders with confidence in the program's design. Management understanding of asset value is important but secondary; penetration testing and NDAs are specific controls, not foundational requirements.
Why the other options are wrong
- A. Asset value assessment is important for risk prioritization but not the foundation of program success.
- B. Penetration testing is a tactical security activity, not a foundational requirement.
- C. NDAs are important but represent one specific control, not a program requirement.
Question 137
Which of the following metrics provides the BEST measurement of the effectiveness of a security awareness program?
Show answer and explanation
Correct answer: D. The number of reported security incidents
The number of reported security incidents is the best measure of awareness program effectiveness because an effective awareness program increases employee vigilance and encourages reporting of suspicious activities and security concerns. Higher incident reporting indicates that employees are more aware, engaged, and willing to report issues, which is a primary goal of awareness programs. This metric directly reflects behavioral change resulting from the program.
Why the other options are wrong
- A. Budget variance measures financial management, not program effectiveness or employee awareness.
- B. Total security breaches reflect overall security posture but not specifically the impact of awareness training.
- C. Mean time between detection and remediation measures incident response capability, not the effectiveness of the awareness program itself.
Question 138
The MOST important reason for an information security manager to be involved in the change management process is to ensure that:
Show answer and explanation
Correct answer: B. risks have been evaluated.
The MOST important reason for an information security manager to be involved in change management is to ensure that risks have been evaluated before changes are implemented. Risk evaluation is the primary security contribution to change management, it ensures that changes don't introduce new vulnerabilities or compromise existing controls. While controls may need updating and vulnerabilities identified, evaluating risks is the fundamental reason for security involvement.
Why the other options are wrong
- A. Security controls should inform changes, but they don't drive the change management process.
- C. Regular updating of controls is an ongoing activity, not the primary reason for change management involvement.
- D. Identifying vulnerabilities is part of risk evaluation, but risk evaluation itself is the primary concern.
Question 139
Which of the following is the MOST important output from a post-incident review?
Show answer and explanation
Correct answer: A. Documentation of lessons learned
Documentation of lessons learned is the most important output from a post-incident review because it captures knowledge gained from the incident, identifies process improvements, prevents recurrence, and helps the organization mature its security posture. This institutional learning is the primary value of conducting reviews and directly supports continuous improvement in incident response capabilities.
Why the other options are wrong
- B. Digital forensic artifacts are inputs to the review process, not the primary output or deliverable.
- C. Revised BIA may be a secondary outcome if the incident revealed gaps, but it's not the main purpose of post-incident review.
- D. Cost compilation supports financial reporting but does not represent the core objective of improving security practices.
Question 140
The business value of an information asset is derived from:
Show answer and explanation
Correct answer: C. its criticality.
Business value reflects how important an asset is to achieving business objectives, that is, its criticality to business processes and the impact its loss or compromise would have on operations, revenue and reputation. Valuation therefore starts with classifying and ranking assets by criticality to the business.
Why the other options are wrong
- A. Replacement cost measures only the expense of rebuilding or reacquiring the asset, which is often far less than its worth to the business.
- B. A risk assessment uses asset value as an input; it does not create that value.
- D. The threat profile describes what may attack the asset, not the asset's worth to the organization.
Question 141
Which of the following is BEST to include in a business case when the return on investment (ROI) for an information security initiative is difficult to calculate?
Show answer and explanation
Correct answer: D. Estimated reduction in risk
When ROI is difficult to calculate quantitatively, the BEST alternative is to include estimated reduction in risk, which is a qualitative but highly relevant measure for security initiatives. This demonstrates business value through risk mitigation rather than direct financial returns. Risk reduction directly justifies security investments by showing how the organization's overall risk profile improves.
Why the other options are wrong
- A. Maturity level increases are process-focused metrics that don't directly address the business value of risk mitigation.
- B. Efficiency gains may not apply to all security initiatives and are less central to security value propositions than risk reduction.
- C. Projected costs alone don't demonstrate value or ROI; they only show expenses without benefit justification.
Question 142
Which of the following is the MOST important input to the development of an effective information security strategy?
Show answer and explanation
Correct answer: C. Business processes and requirements
Business processes and requirements are the most important input because security strategy must align with and enable business objectives. Security exists to protect business assets and enable operations, not the reverse. Understanding what the organization does and needs allows security strategy to be appropriately designed, resourced, and prioritized to support business goals.
Why the other options are wrong
- A. Policies and procedures are outputs of strategy development, not primary inputs.
- B. Current and desired state is important but must be evaluated against business needs to be meaningful.
- D. Risk and impact assessments inform strategy but should be contextualized within business requirements.
Question 143
What is the BEST way for an information security manager to ensure critical assets are prioritized in a new information security program?
Show answer and explanation
Correct answer: C. Conduct an inventory of information assets.
Conducting an inventory of information assets is the best foundational step to prioritize critical assets in a new security program because it provides visibility into what assets exist, their locations, and their business value. Without a complete inventory, prioritization decisions lack proper data and context. Procedures, training, and backups are implementation activities that should follow the asset discovery and prioritization phase.
Why the other options are wrong
- A. Procedures should be updated after critical assets are identified and prioritized
- B. Training is important but cannot be targeted effectively without knowing what assets to protect
- D. Backup implementation should follow prioritization of which assets need protection
Question 144
A technical vulnerability assessment on a personnel information management server should be performed when:
Show answer and explanation
Correct answer: C. changes are made to the system configuration
Configuration changes create new vulnerability exposure and are the primary trigger for reassessment. When system configurations change, the security baseline changes, requiring immediate vulnerability assessment to identify any new weaknesses or misconfigurations. This is proactive and scheduled security hygiene. While unauthorized access attempts (B) suggest an active threat, and unexpected outages (D) require investigation, neither is the BEST trigger for assessment. Employee departure (A) is important for access review but not specifically a vulnerability assessment trigger.
Why the other options are wrong
- A. Personnel changes require access reviews but don't directly necessitate system vulnerability assessments.
- B. Increased unauthorized attempts indicate a potential attack but don't trigger the need for configuration vulnerability assessment.
- D. Outages require incident investigation and root cause analysis but aren't the primary trigger for vulnerability assessment.
Question 145
Senior management wants to provide mobile devices to its sales force. Which of the following should the information security manager do FIRST to support this objective?
Show answer and explanation
Correct answer: C. Assess risks introduced by the technology
Before implementing any mobile device program, senior management must first understand what risks are being introduced by this technology. Risk assessment is the foundational step in the decision-making process, it informs whether to proceed, what controls are needed, and helps justify the investment. While an acceptable use policy, vulnerability assessment, and MDM solutions are all important follow-up actions, they cannot be properly developed without first understanding the risks involved.
Why the other options are wrong
- A. An acceptable use policy is necessary but comes after understanding the risks that the policy must address.
- B. Vulnerability assessment of specific devices is a later step after risk assessment determines the approach.
- D. Researching MDM solutions is premature without first understanding what risks need to be mitigated.
Question 146
Which of the following would BEST enable the timely execution of an incident response plan?
Show answer and explanation
Correct answer: A. Definition of trigger events
Clear definition of trigger events is essential for timely execution because it enables personnel to recognize when an incident response plan should be activated without delay. Trigger events provide objective criteria that signal the need for immediate action. A service desk, decision support tool, or data classification process may support incident response but do not directly enable timely execution of the plan itself.
Why the other options are wrong
- B. A centralized service desk improves incident tracking but doesn't define when response plans are triggered.
- C. Decision support tools may assist during response but don't enable timely plan execution.
- D. Data classification is important for handling data but doesn't enable timely execution of incident response plans.
Question 147
Which of the following is the MOST important consideration when defining security configuration baselines?
Show answer and explanation
Correct answer: B. The baselines are proportionate to risk.
Security baselines must be proportionate to risk because resources are finite and excessive baselines waste investment while insufficient baselines leave organizations exposed. Risk proportionality ensures that baseline requirements match the actual threat and vulnerability landscape of the organization. While regulatory standards, vulnerability remediation, and business alignment are all considerations, proportionality to risk is the MOST important foundational principle that guides all baseline decisions.
Why the other options are wrong
- A. Regulatory compliance is a constraint that baselines must meet, but baselines may exceed regulatory standards based on organizational risk.
- C. Addressing vulnerabilities is important but baselines should address risks comprehensively, not just known vulnerabilities.
- D. Business alignment is important for implementation but risk proportionality is the primary technical consideration.
Question 148
A security policy exception is leading to an unexpected increase in the number of alerts about suspicious Internet traffic on an organization's network. Which of the following is the BEST course of action?
Show answer and explanation
Correct answer: B. Present a risk analysis with recommendations to senior management.
The best course of action is to present a risk analysis with recommendations to senior management. This escalates the issue appropriately by documenting the security risk created by the policy exception, quantifying its impact, and proposing options for management decision. Senior management must be informed of the risk-benefit tradeoff and can then decide whether to modify the exception, accept the risk, or implement compensating controls. This represents proper governance and risk management rather than unilateral technical action.
Why the other options are wrong
- A. Removing alert rules masks the underlying security problem without addressing the root cause.
- C. Updating the risk register documents the issue but doesn't drive action or escalate the decision to appropriate authority.
- D. Evaluating network architecture may be necessary but shouldn't be the immediate response without management awareness and approval.
Question 149
Which of the following is MOST important for an information security manager to verify before conducting full-functional continuity testing?
Show answer and explanation
Correct answer: C. Teams and individuals responsible for recovery have been identified
Before conducting full-functional continuity testing, it is most important to verify that teams and individuals responsible for recovery have been identified. Without clear designation of recovery personnel and their roles, testing cannot be meaningful or executable. Identified teams can then be properly trained, coordinated, and tested. The other elements, while important, are secondary to having accountable personnel in place.
Why the other options are wrong
- A. Documentation in simple language is important but secondary to having identified responsible parties
- B. Offsite copies are important but don't ensure testing can actually proceed
- D. Risk acceptance is important but doesn't ensure the organization can actually execute recovery procedures
Question 150
A penetration test was conducted by an accredited third party. Which of the following should be the information security manager's FIRST course of action?
Show answer and explanation
Correct answer: B. Ensure a risk assessment is performed to evaluate the findings.
The security manager's first action should be to ensure a risk assessment is performed to evaluate the penetration test findings because this prioritizes vulnerabilities by business impact and likelihood, providing the necessary context for decision-making about remediation sequencing and resource allocation. This assessment-first approach prevents reactive responses and ensures limited resources target the highest-risk issues.
Why the other options are wrong
- A. Requesting funding should follow the risk assessment so that requests are justified and prioritized by risk level.
- C. Reporting to senior management should include the risk assessment context to support informed decisions.
- D. Ensuring resolution should be based on risk-prioritized timelines, not immediate indiscriminate remediation.
Question 151
An information security manager has identified that security risks are not being treated in a timely manner. Which of the following is the BEST way to address this situation?
Show answer and explanation
Correct answer: A. Assign a risk owner to each risk.
Assigning a risk owner to each identified risk is the best way to ensure risks are treated in a timely manner. A designated owner is accountable for taking action, tracking progress, and reporting status, creating clear responsibility that drives action. Ownership creates accountability and responsibility chains that naturally accelerate risk treatment processes.
Why the other options are wrong
- B. Creating controls addresses some risks but doesn't directly solve the timeliness issue if ownership and accountability are unclear.
- C. Updates without ownership don't actually accelerate treatment; they only communicate status.
- D. Re-analysis without ownership structures doesn't improve timeliness of actual risk treatment.
Question 152
What is the PRIMARY objective of information security involvement in the change management process?
Show answer and explanation
Correct answer: C. To reduce the likelihood of control failure
The PRIMARY objective of security involvement in change management is to reduce the likelihood of control failure. While authorization (B) is part of the process and compliance (D) is a benefit, the core objective is ensuring that changes don't inadvertently bypass or weaken existing security controls. This proactive risk reduction is the fundamental purpose of security review in change processes.
Why the other options are wrong
- A. Narrowing threat landscape is too broad and not specific to change management's security role.
- B. Authorization is a procedural aspect, not the primary objective of security involvement.
- D. Regulatory compliance is a consequence, not the primary objective of change management security review.
Question 153
Which of the following would be MOST helpful to identify worst-case disruption scenarios?
Show answer and explanation
Correct answer: D. Business impact analysis (BIA)
A Business Impact Analysis (BIA) is specifically designed to identify and quantify worst-case disruption scenarios by analyzing critical business processes, dependencies, recovery time objectives, and recovery point objectives. It directly examines what happens when systems fail. Cost-benefit analysis (A) evaluates financial trade-offs, SWOT analysis (B) identifies organizational strengths and weaknesses, and business process analysis (C) documents processes but doesn't focus on disruption impact. Only BIA targets worst-case scenarios.
Why the other options are wrong
- A. Cost-benefit analysis evaluates financial trade-offs, not worst-case disruption identification.
- B. SWOT analysis identifies strategic factors but not specific disruption scenarios.
- C. Business process analysis documents how processes work, not their failure impacts.
Question 154
Recommendations for enterprise investment in security technology should be PRIMARILY based on:
Show answer and explanation
Correct answer: B. alignment with business needs
Enterprise security technology investments must be primarily aligned with business needs to ensure resources are allocated efficiently and address the organization's specific risk landscape. While financial resources, risk tolerance, and standards compliance are all considerations, they are secondary to understanding what the business actually requires. Business alignment ensures security investments directly support organizational objectives and provide measurable value.
Why the other options are wrong
- A. Financial availability is a constraint, not the primary basis for determining what security investments are needed.
- C. Risk tolerance influences investment decisions but is not the primary driver, business needs must be identified first.
- D. International standards provide frameworks but should not drive investment decisions ahead of actual business requirements.
Question 155
What is the PRIMARY objective of implementing standard security configurations?
Show answer and explanation
Correct answer: D. Control vulnerabilities and reduce threats from changed configurations.
The PRIMARY objective of implementing standard security configurations is to control vulnerabilities and reduce threats from configuration drift and unauthorized changes. Standard configurations ensure consistency, reduce attack surface, and prevent misconfigurations that could introduce security weaknesses. This directly addresses risk reduction across the infrastructure.
Why the other options are wrong
- A. Flexibility is contrary to the purpose of standard configurations.
- B. While reducing operational burden may be a benefit, it is not the primary security objective.
- C. Comparison between systems is a secondary task, not the primary objective.
Question 156
Which of the following factors would have the MOST significant impact on an organization's information security governance model?
Show answer and explanation
Correct answer: A. Corporate culture
Corporate culture is the foundational element that shapes how security is perceived, prioritized, and implemented across an organization. It influences risk tolerance, compliance attitudes, resource allocation, and employee security behaviors. While budget, outsourcing, and headcount are important operational factors, they are constraints or implementations within the governance model rather than determinants of its structure. Culture directly impacts whether governance policies are embraced or resisted.
Why the other options are wrong
- B. Outsourced processes are managed through governance but don't fundamentally shape the governance model itself.
- C. Number of employees affects scale and complexity but not the core governance approach.
- D. Security budget is a resource constraint that operates within the governance framework, not a primary driver of it.
Question 157
An anomaly-based intrusion detection system (IDS) operates by gathering data on:
Show answer and explanation
Correct answer: A. normal network behavior and using it as a baseline for measuring abnormal activity.
Anomaly-based IDS systems establish a baseline of normal network behavior and then use statistical analysis and machine learning to detect deviations from that baseline as potential anomalies or attacks. This approach allows detection of unknown or zero-day attacks that do not match known signatures. The system learns what is normal for the network and flags what differs from that established baseline.
Why the other options are wrong
- B. Anomaly-based systems use normal behavior as the baseline, not abnormal behavior.
- C. IDS systems detect and alert; firewalls (not IDS) have the capability to drop connections.
- D. Using attack pattern signatures is characteristic of signature-based IDS, not anomaly-based systems.
Question 158
An organization is performing an annual review of its risk landscape. Which of the following anticipated changes will have the MOST significant impact on the information security strategy?
Show answer and explanation
Correct answer: C. The expansion to an international location with unfamiliar security and privacy regulations
The expansion to an international location with unfamiliar security and privacy regulations has the most significant impact on information security strategy because it introduces entirely new regulatory frameworks, compliance obligations, and security requirements that fundamentally reshape how the organization must operate and protect data globally.
Why the other options are wrong
- A. MSSP contract renegotiation affects operational tools but not the overall security strategy.
- B. Database migration to a new platform is a technical change with managed scope and known risk.
- D. Firewall infrastructure replacement is a tactical tool update that follows existing strategy.
Question 159
Which of the following is MOST effective in reducing the financial impact following a security breach leading to data disclosure?
Show answer and explanation
Correct answer: D. An incident response plan
An incident response plan is most effective in reducing financial impact following a security breach causing data disclosure. A well-designed incident response plan minimizes detection time, containment time, notification delays, and regulatory penalties. It addresses forensics, communication, legal obligations, and customer management, all critical cost drivers. While backups support recovery and DLP prevents some breaches, incident response directly reduces the costs associated with a disclosed breach.
Why the other options are wrong
- A. Backup and recovery address availability and data loss, not the financial impact of disclosure
- B. Business continuity plans address operational continuity, not the specific costs of a security breach disclosure
- C. DLP prevents some breaches but cannot reduce financial impact of a breach that has already occurred
Question 160
Which of the following is the PRIMARY reason that an information security manager should restrict the use of generic administrator accounts in a multi-user environment?
Show answer and explanation
Correct answer: A. To prevent accountability issues
Restricting generic administrator accounts primarily addresses accountability issues. When multiple people share a generic admin account, it's impossible to determine which individual performed which actions, creating a significant accountability gap. This violates the principle of individual accountability in security controls. While segregation of duties, audit trails, and access control are all related security concerns, the PRIMARY reason for restricting generic accounts is to establish individual accountability so that specific users can be held responsible for their actions.
Why the other options are wrong
- B. Segregation of duties is a control mechanism but not the primary reason; accountability is more fundamental.
- C. Protecting audit trails is important but is a consequence of maintaining accountability, not the primary reason.
- D. Unauthorized access prevention is addressed through access controls, not account restriction policies.
Question 161
Management has expressed concerns to the information security manager that shadow IT may be a risk to the organization. What is the FIRST step the information security manager should take?
Show answer and explanation
Correct answer: D. Determine the extent of shadow IT usage
Before taking any action to address shadow IT, the information security manager must first understand the scope and extent of the problem. Determining current shadow IT usage provides the baseline needed for subsequent decisions about policy, blocking mechanisms, or evaluating project value. Without this assessment, any response will be uninformed.
Why the other options are wrong
- A. Blocking is premature without understanding what exists and its business value.
- B. Policy updates should follow assessment of the actual shadow IT landscape.
- C. Value assessment comes after identifying what shadow IT projects exist.
Question 162
Which of the following presents the GREATEST challenge to a security operations center's timely identification of potential security breaches?
Show answer and explanation
Correct answer: C. IT system clocks are not synchronized with the centralized logging server.
Unsynchronized system clocks create the greatest challenge to timely breach identification because log timestamps will be inconsistent across systems, making it impossible to accurately correlate events, establish timelines, or detect attack sequences. This directly impairs the SOC's ability to identify and respond to security incidents. While the other options present security challenges, they do not as directly impede the fundamental capability to detect breaches in real-time.
Why the other options are wrong
- A. Decentralized infrastructure requires operational adjustments but doesn't inherently prevent timely breach detection.
- B. Unsupported OSes are a vulnerability management issue, not a detection speed problem.
- D. Slow patch deployment is a risk management issue distinct from breach identification timeliness.
Question 163
Which of the following should be determined FIRST when preparing a risk communication plan?
Show answer and explanation
Correct answer: C. Target audience
The target audience must be determined first when preparing a risk communication plan because all subsequent decisions about reporting content, communication channels, and reporting frequency depend on knowing who will receive the communication. Different audiences (executives, technical staff, board members) require different levels of detail, communication methods, and frequencies. Starting with the audience allows the plan to be tailored appropriately for its intended recipients.
Why the other options are wrong
- A. Reporting content is determined after identifying the audience, as content must match audience sophistication and needs.
- B. Communication channel selection depends on understanding the target audience's preferences and accessibility.
- D. Reporting frequency should align with the audience's decision-making cycles and information needs.
Question 164
Which of the following is the MOST important consideration when reporting the effectiveness of an information security program to key business stakeholders?
Show answer and explanation
Correct answer: D. Linking security metrics to business objectives
Business stakeholders care most about how security aligns with and enables business objectives. Option D directly addresses this by linking security metrics to organizational goals, demonstrating value and relevance. Linking to BIA (A) is internal focus; incident reduction (B) is tactical without business context; and cost savings (C) alone doesn't prove effectiveness. Business objectives are the ultimate measure of program relevance.
Why the other options are wrong
- A. BIA linkage is internal and doesn't demonstrate business value to stakeholders
- B. Incident reduction is important but lacks business context without objective linkage
- C. Cost savings alone don't prove security effectiveness or business alignment
Question 165
Which of the following would be MOST helpful when determining appropriate access controls for an application?
Show answer and explanation
Correct answer: D. Data criticality
Data criticality is the most important factor in determining appropriate access controls because it directly indicates the security level required; highly critical data demands stricter controls regardless of other factors. Access control requirements must be proportionate to the value and sensitivity of the data being protected, making data classification the foundation of access control decisions.
Why the other options are wrong
- A. Industry best practices provide guidance but may not align with the organization's specific data criticality and risk profile.
- B. Gap analysis results identify deficiencies but do not determine what access controls should be implemented.
- C. End-user input is helpful for usability but should not drive access control decisions, which must be security-focused.
Question 166
Which of the following is a PRIMARY function of an incident response team?
Show answer and explanation
Correct answer: D. To provide effective incident mitigation
A PRIMARY function of an incident response team is to provide effective incident mitigation, actively responding to and containing security incidents to minimize damage and recovery time. This is the core operational purpose of such teams. While single points of contact, risk assessments, and business impact analyses may support incident response, the team's primary mission is direct mitigation and resolution of active security incidents.
Why the other options are wrong
- A. Single point of contact is a coordination mechanism, not a primary function.
- B. Risk assessment for vulnerabilities is a security management function, not incident response.
- C. BIA is a planning tool used before incidents, not a primary response function.
Question 167
Which of the following is the MOST effective approach for determining whether an organization's information security program supports the information security strategy?
Show answer and explanation
Correct answer: D. Develop key performance indicators (KPIs) of information security
The most effective approach for determining whether an information security program supports the strategy is to develop key performance indicators (KPIs) that measure alignment between program activities and strategic objectives. KPIs provide measurable criteria to assess whether program implementation is achieving strategic goals. This allows for objective evaluation of progress and effectiveness. While options A, B, and C are related activities, KPIs create a structured measurement framework that directly demonstrates the connection between program execution and strategy achievement.
Why the other options are wrong
- A. Ensuring adequate resources is important but does not measure whether the program supports the strategy.
- B. Auditing for deficiencies identifies problems but not whether the program strategically aligns with objectives.
- C. Identifying gaps is part of assessment but KPIs provide a more comprehensive measurement approach.
Question 168
When evaluating the risk from external hackers the maximum exposure time would be the difference between:
Show answer and explanation
Correct answer: D. compromise and containment.
The maximum exposure time when evaluating risk from external hackers is the difference between compromise and containment. This is the window during which an attacker has unauthorized access and the organization has not yet stopped the attack. The longer this window, the more damage can be done. Detection to response is important but the exposure begins at compromise, making compromise-to-containment the maximum exposure period.
Why the other options are wrong
- A. Log refresh and restoration relate to recovery procedures but don't represent the active exploitation window.
- B. Identification and resolution are part of response but don't define the initial exposure period from compromise.
- C. Detection to response is important but exposure actually begins before detection, from the moment of compromise.
Question 169
The GREATEST benefit resulting from well-documented information security procedures is that they:
Show answer and explanation
Correct answer: B. ensure that security policies are consistently applied.
The greatest benefit of well-documented information security procedures is that they ensure security policies are consistently applied across the organization. Documentation provides the standard reference that all personnel should follow, eliminating variation and ensuring uniform implementation of security controls. While documentation supports training, auditing, and temporary staff, its primary and greatest value is in enabling consistent application of security policies throughout the organization.
Why the other options are wrong
- A. Training facilitation is a benefit but not the greatest one compared to consistency in policy application.
- C. Providing an audit basis is important but secondary to the primary benefit of ensuring consistent application.
- D. Supporting temporary staff is beneficial but not the greatest benefit compared to consistency organization-wide.
Question 170
The PRIMARY purpose for defining key risk indicators (KRIs) for a security program is to:
Show answer and explanation
Correct answer: C. provide information needed to take action.
Key Risk Indicators (KRIs) are designed to provide actionable information that enables management to take proactive measures before risk becomes critical. While KRIs support investment decisions, benchmarking, and control validation, their primary purpose is to enable timely decision-making and risk management actions based on early warning signals.
Why the other options are wrong
- A. Supporting investment is a secondary benefit, not the primary purpose.
- B. Benchmarking comparison is useful but not the primary purpose of KRIs.
- D. Control validation is about control effectiveness, not the primary KRI purpose.
Question 171
Internal audit has reported a number of information security issues that are not in compliance with regulatory requirements. What should the information security manager do FIRST?
Show answer and explanation
Correct answer: B. Assess the risk to business operations
When regulatory non-compliance issues are identified, the first priority is to assess the risk to business operations. This determines the urgency and severity of the issues, which informs prioritization of remediation efforts and resource allocation. Understanding business impact guides whether issues require immediate emergency response or can be addressed through planned remediation. This risk assessment then drives all subsequent actions including gap analysis and resource planning.
Why the other options are wrong
- A. Creating exceptions may sometimes be appropriate but should not be the first response, risk must be assessed first to determine what can actually be excepted.
- C. Vulnerability assessment addresses technical weaknesses but doesn't directly address the regulatory compliance issues already identified by audit.
- D. Gap analysis is useful but should follow risk assessment, as risk prioritization determines which gaps are most critical to address first.
Question 172
Which of the following is the MOST effective method of preventing deliberate internal security breaches?
Show answer and explanation
Correct answer: D. Screening prospective employees
Screening prospective employees is the most effective method of preventing deliberate internal security breaches. Background checks, reference verification, and integrity assessments identify individuals with malicious intent or high-risk profiles before they gain access to systems and data. This prevents the threat from existing in the first place.
Why the other options are wrong
- A. IDS detects attacks but cannot prevent an authorized insider from deliberately breaching security.
- B. Biometric controls restrict physical access but do not prevent authorized employees from causing breaches.
- C. Firewalls protect network perimeter but cannot prevent insiders with legitimate access from breaching security.
Question 173
Which of the following would BEST provide stakeholders with information to determine the appropriate response to a disaster?
Show answer and explanation
Correct answer: C. Business impact analysis (BIA)
A Business Impact Analysis (BIA) identifies critical business functions, their dependencies, recovery time objectives (RTOs), and recovery point objectives (RPOs). This directly informs disaster response decisions by clarifying which systems must be recovered first, in what sequence, and within what timeframes, enabling stakeholders to make appropriate prioritization and resource allocation decisions.
Why the other options are wrong
- A. Vulnerability assessments identify weaknesses, not business impact priorities or recovery requirements.
- B. SWOT analysis examines strengths, weaknesses, opportunities, and threats but does not provide specific disaster response guidance.
- D. Risk assessment identifies risks but does not specifically prioritize disaster recovery response actions based on business criticality.
Question 174
Which of the following metrics is the BEST measure of the effectiveness of an information security program?
Show answer and explanation
Correct answer: A. Reduction in the amount of risk exposure in an organization
Reduction in risk exposure is the BEST measure of overall security program effectiveness because it directly reflects the program's ultimate goal: to reduce organizational risk to acceptable levels. Risk encompasses both threats and vulnerabilities and their impacts, making it the most comprehensive metric. Reducing just threats or vulnerabilities in isolation doesn't guarantee reduced risk, and cost reduction doesn't necessarily correlate with actual security improvement.
Why the other options are wrong
- B. Threat reduction alone doesn't measure program effectiveness; you cannot eliminate all threats.
- C. Cost reduction is a financial metric, not a security effectiveness measure.
- D. Vulnerability reduction is one component of risk management but doesn't address threat likelihood or impact.
Question 175
An online bank identifies a successful network attack in progress. The bank should FIRST:
Show answer and explanation
Correct answer: B. isolate the affected network segment.
The immediate priority during an active network attack is to isolate the affected network segment to contain the breach and prevent further spread. This is the critical first action in incident response that limits damage. Reporting to the board (A) is a notification step that comes later, shutting down the entire network (C) is excessive and disruptive without first understanding scope, and assessing PII compromise (D) requires investigation that should follow containment. Containment must come first.
Why the other options are wrong
- A. Board reporting is important but is a communication step, not the immediate technical response needed.
- C. Total network shutdown is disproportionate and prevents investigation; segment isolation is the measured first step.
- D. Assessing PII compromise is part of the investigation that follows containment, not the initial response.
Question 176
Which of the following should be done FIRST once a cybersecurity attack has been confirmed?
Show answer and explanation
Correct answer: A. Isolate the affected system
Once a cybersecurity attack is confirmed, the immediate priority is to isolate the affected system to prevent lateral movement, further data exfiltration, or spread of malware to other systems. This containment step is a fundamental principle of incident response and must happen before other actions. Isolation limits the scope of damage and preserves evidence, making it the logical first action.
Why the other options are wrong
- B. Powering down can destroy volatile memory and evidence needed for forensics.
- C. Senior management notification, while important, does not mitigate the active threat.
- D. Contacting authorities comes after immediate technical response and containment.
Question 177
An organization has identified an increased threat of external brute force attacks in its environment. Which of the following is the MOST effective way to mitigate this risk to the organization's critical systems?
Show answer and explanation
Correct answer: D. Implement multi-factor authentication.
Multi-factor authentication (MFA) is the most effective preventive control against brute force attacks because it makes credential compromise alone insufficient to gain access. Even if an attacker successfully guesses or obtains a password, they cannot authenticate without the second factor. While options A, B, and C improve detection and monitoring capabilities, they are reactive measures that occur after attack attempts. MFA actively prevents unauthorized access at the authentication layer, which is the most direct defense against brute force attacks.
Why the other options are wrong
- A. Log monitoring detects attacks but does not prevent them from occurring.
- B. SIEM provides visibility into attacks but is a detection tool, not a prevention mechanism.
- C. Increasing IDS sensitivity improves detection but does not stop attackers from attempting authentication.
Question 178
Which of the following should an information security manager do FIRST when assessing conflicting requirements between the global organization's security standards and local regulations?
Show answer and explanation
Correct answer: A. Conduct a gap analysis against local regulations.
Conducting a gap analysis against local regulations should be done FIRST when assessing conflicting requirements. This establishes a factual understanding of what local regulations actually require, which is the essential baseline for any subsequent decision-making. Without understanding the specific gaps and their implications, cost-benefit analysis (B) cannot be meaningful, and prioritizing standards (D) without understanding local requirements could create legal liability.
Why the other options are wrong
- B. Cost-benefit analysis is premature without first understanding the regulatory requirements through gap analysis.
- C. Creating a local version assumes the gap analysis is already complete and decisions are made.
- D. Prioritizing organizational standards over local regulations is legally and ethically problematic and cannot be the first step.
Question 179
Which of the following is the MOST important consideration when developing information security objectives?
Show answer and explanation
Correct answer: C. They are clear and can be understood by stakeholders
For security objectives to be effective and actionable, they must first and foremost be clear and understandable to all stakeholders. Without clarity and comprehension, stakeholders cannot properly support, implement, or measure against the objectives. While reassessment, approval, and alignment with frameworks are all important, they are secondary considerations that depend on the foundational requirement of clarity.
Why the other options are wrong
- A. Reassessment and reporting are important ongoing activities but not the primary consideration when initially developing objectives.
- B. Approval by IT governance is a procedural step that should occur after objectives are properly defined and understood.
- D. Using frameworks is a good practice for developing objectives, but clarity of communication is the most critical foundational element.
Question 180
What should be an information security manager's MOST important consideration when reviewing a proposed upgrade to a business unit's production database?
Show answer and explanation
Correct answer: B. Ensuring residual risk is within appetite
The MOST important consideration when reviewing a production database upgrade is ensuring that residual risk remains within the organization's risk appetite. This is the fundamental risk management principle, that after implementing controls or changes, the remaining risk is acceptable. While updating inventory (A), cost-benefit analysis (C), and management awareness (D) are relevant considerations, the primary information security responsibility is managing risk to acceptable levels.
Why the other options are wrong
- A. Inventory updates are administrative follow-ups, not the primary consideration.
- C. Cost-benefit analysis is important but secondary to residual risk assessment.
- D. Management awareness is important but doesn't address the core security question of acceptable risk.
Question 181
Which of the following provides the BEST evidence that a newly implemented security awareness program has been effective?
Show answer and explanation
Correct answer: C. There has been an increase in the number of phishing attempts reported.
An increase in the number of phishing attempts reported indicates that the awareness program has been effective. This demonstrates that employees are now recognizing phishing attempts and reporting them rather than silently falling victim. Increased reporting of attacks is a positive indicator that security awareness is working, as it shows employees are alert and engaged, whereas zero reports might actually indicate people are still being deceived.
Why the other options are wrong
- A. Zero successful phishing attempts is ideal but unrealistic and difficult to verify; absence of reports doesn't prove awareness worked.
- B. Completion of training demonstrates attendance but not actual behavior change or effectiveness.
- D. Management support for funding indicates resource commitment but doesn't measure actual program effectiveness.
Question 182
Which of the following is the MOST important element in the evaluation of inherent security risks?
Show answer and explanation
Correct answer: A. Impact to the organization
The MOST important element in evaluating inherent security risks is the impact to the organization. Inherent risk is the risk that exists before controls are applied, and its severity is fundamentally determined by the potential harm or impact it could cause to the organization's operations, assets, or reputation. Impact assessment drives all subsequent risk management decisions.
Why the other options are wrong
- B. Control effectiveness is relevant to residual risk assessment, not inherent risk, which exists without controls.
- C. Residual risk is the risk remaining after controls, which depends on inherent risk and control effectiveness.
- D. Cost of countermeasures is a financial consideration that follows risk evaluation, not an element of the evaluation itself.
Question 183
An employee of an organization has reported losing a smartphone that contains sensitive information. The BEST step to address this situation is to:
Show answer and explanation
Correct answer: A. remotely wipe the device.
The best immediate step is to remotely wipe the device to prevent unauthorized access to the sensitive information it contains. This directly eliminates the risk of data exposure from the lost device. While other steps like disabling access and escalation are also appropriate, remote wiping addresses the immediate threat to sensitive data on the missing device.
Why the other options are wrong
- B. Terminating connectivity prevents further use but does not eliminate the risk of someone accessing data already on the device.
- C. Disabling user access to corporate resources does not address the sensitive data already present on the lost device.
- D. Escalation to management is appropriate but is a supporting step, not the best technical response to the immediate data exposure threat.
Question 184
An organization wants to integrate information security into its human resource management processes. Which of the following should be the FIRST step?
Show answer and explanation
Correct answer: B. Assess the business objectives of the processes
Before integrating security into any business process, you must first understand what the business is trying to achieve. Assessing business objectives provides the foundation for all subsequent steps. Once objectives are clear, you can identify associated risks, evaluate costs, and benchmark against best practices. Starting with risk identification (Option A) without understanding objectives could lead to over-controlling or under-protecting against business-critical processes.
Why the other options are wrong
- A. Risk identification depends on understanding business objectives first; doing it second ensures risks are evaluated in proper context.
- C. Cost evaluation comes after understanding what needs to be protected and why.
- D. Benchmarking against best practices should follow understanding your own business objectives and priorities.
Question 185
Which of the following is the BEST way to reduce the risk associated with a successful social engineering attack targeting help desk staff?
Show answer and explanation
Correct answer: A. Conduct security awareness training
Security awareness training is the best way to reduce social engineering risk targeting help desk staff because it directly addresses the human vulnerability being exploited. Training teaches staff to recognize social engineering tactics, verify identities, follow proper procedures, and resist manipulation. This directly mitigates the attack vector by making staff resistant to deception and manipulation.
Why the other options are wrong
- B. Two-factor authentication protects account access but doesn't reduce the likelihood of social engineering attacks against help desk personnel themselves.
- C. Blocking social media doesn't address the core social engineering vulnerability of human manipulation.
- D. Role-based access controls limit damage from compromised credentials but don't prevent social engineering attacks from occurring.
Question 186
The PRIMARY objective of timely declaration of a disaster is to:
Show answer and explanation
Correct answer: A. ensure the continuity of the organization’s essential services.
The primary objective of timely disaster declaration is to ensure the continuity of the organization's essential services. When a disaster is declared promptly, recovery processes and resources can be activated immediately to restore critical business functions, minimizing downtime and service disruption. This directly supports the organization's survival and operational continuity.
Why the other options are wrong
- B. Protecting physical assets is secondary; the focus is on restoring services and operations.
- C. While management engagement is important, it's a consequence of declaration, not the primary objective.
- D. Assessing deficiencies is a post-disaster activity, not the primary objective of timely declaration.
Question 187
Which of the following provides the MOST useful information for identifying security control gaps on an application server?
Show answer and explanation
Correct answer: B. Penetration testing
Penetration testing provides the most useful and practical information for identifying security control gaps on an application server. It actively attempts to exploit vulnerabilities and weaknesses in deployed controls, revealing actual gaps in real-world conditions. Risk assessments are theoretical, threat models are hypothetical, and internal audit reports may focus on compliance rather than technical control effectiveness.
Why the other options are wrong
- A. Risk assessments are theoretical and may not identify actual control gaps in implementation.
- C. Threat models are hypothetical frameworks and don't test actual deployed controls.
- D. Internal audit reports focus on compliance and control existence, not technical control effectiveness.
Question 188
Which of the following provides the MOST essential input for the development of an information security strategy?
Show answer and explanation
Correct answer: A. Results of an information security gap analysis
An information security gap analysis provides the MOST essential input because it identifies the difference between the current state of security and the desired state, directly informing what the security strategy must address. This gap analysis drives prioritization and resource allocation for the strategy. Performance measurements, technology assessments, and resource availability are all inputs, but understanding the gaps is foundational to developing a relevant and effective strategy.
Why the other options are wrong
- B. Performance measurement against goals shows current status but doesn't identify what strategy changes are needed.
- C. Technology risk assessment is narrower in scope and doesn't provide the comprehensive gap picture needed for strategy.
- D. Resource availability is a constraint to consider but doesn't drive the actual strategy direction.
Question 189
Which of the following is the MOST relevant factor when determining the appropriate escalation process in the incident response plan?
Show answer and explanation
Correct answer: A. Significance of the affected systems
The significance of affected systems is the most relevant factor for escalation decisions because it directly impacts business impact and determines the level of organizational response required. Critical systems require immediate senior management involvement, while less significant systems may be handled at lower escalation levels.
Why the other options are wrong
- B. Resource allocation is a consequence of escalation decisions, not a determinant.
- C. Resilience capability affects recovery strategy but not the escalation threshold determination.
- D. Replacement cost is secondary to assessing current operational impact of the incident.
Question 190
Which of the following is the MOST effective way to demonstrate alignment of information security strategy with business objectives?
Show answer and explanation
Correct answer: A. Balanced scorecard
A balanced scorecard is the most effective tool for demonstrating alignment of information security strategy with business objectives because it translates strategic goals into measurable performance indicators across multiple perspectives (financial, customer, internal process, learning), showing both how security initiatives support business outcomes and enabling tracking of alignment.
Why the other options are wrong
- B. Benchmarking compares performance to others but does not demonstrate internal alignment with business objectives.
- C. Heat maps visualize risk but do not directly demonstrate strategic alignment with business goals.
- D. Risk matrices assess and visualize risk but are not designed to show strategic alignment with business objectives.
Question 191
When preventive controls to appropriately mitigate risk are not feasible, which of the following is the MOST important action for the information security manager?
Show answer and explanation
Correct answer: D. Managing the impact
When preventive controls are not feasible, the most important action is managing the impact. This involves implementing detective and corrective controls, response plans, and mitigation strategies to minimize the consequences of risk materialization. Impact management (through containment, recovery, and response procedures) becomes the primary risk strategy when prevention is impossible.
Why the other options are wrong
- A. Identifying unacceptable risk levels is important but comes before determining that prevention is infeasible
- B. Assessing vulnerabilities is a preliminary analysis step, not an action following prevention failure
- C. Evaluating threats precedes the decision that prevention is infeasible and isn't an action at that point
Question 192
Which of the following is the GREATEST benefit of using cyber threat intelligence to improve an organization's patch management program?
Show answer and explanation
Correct answer: D. It provides information about exploited vulnerabilities to expedite patching.
Cyber threat intelligence provides real-world information about vulnerabilities being actively exploited, allowing organizations to prioritize patching efforts on the most critical threats. This enables faster response to actively exploited vulnerabilities before they cause damage, directly improving patch management effectiveness and reducing mean time to remediation.
Why the other options are wrong
- A. Risk tolerance is a business decision, not a benefit of threat intelligence.
- B. Intelligence informs patching prioritization, not replacing patches with workarounds.
- C. Intelligence doesn't reduce the number of patches needed; it prioritizes them.
Question 193
Which of the following is the BEST method to reduce the risk of an information security breach due to spear phishing?
Show answer and explanation
Correct answer: C. Establishing a company-wide information security awareness plan
Establishing a company-wide information security awareness plan is the BEST method to reduce spear phishing risk because spear phishing succeeds primarily through social engineering and human error. Users trained to recognize phishing tactics, verify sender identity, and handle suspicious emails are the strongest defense. Vulnerability management (A) and IPS (B) address different attack vectors, and log review (D) is reactive rather than preventive.
Why the other options are wrong
- A. Vulnerability management addresses technical exploits, not social engineering attacks like spear phishing.
- B. IPS systems detect network-based attacks but cannot prevent users from falling for phishing emails.
- D. Log review is a detective control after compromise; awareness programs prevent the attack from succeeding in the first place.
Question 194
A newly hired information security manager discovers that the cleanup of accounts for terminated employees happens only once a year. Which of the following should be the information security manager’s FIRST course of action?
Show answer and explanation
Correct answer: B. Perform a risk assessment.
A risk assessment should be the first step to quantify the exposure created by delayed account cleanup and determine the severity of the security gap. This assessment provides the data-driven justification needed to justify the cost and effort of process redesign and supports recommendations to management. Without understanding the risk, subsequent actions lack proper prioritization and business case foundation.
Why the other options are wrong
- A. Designing a new process before assessing risk may misallocate resources or over-engineer a solution.
- C. Reporting without a risk assessment lacks the data necessary to convince management of urgency.
- D. Updating policy is a downstream action that should follow risk analysis and management decision-making.
Question 195
In addition to executive sponsorship and business alignment, which of the following is MOST critical for information security governance?
Show answer and explanation
Correct answer: A. Ownership of security
Ownership of security is most critical for information security governance because it establishes clear accountability and responsibility for security decisions and outcomes across the organization. Without defined ownership, initiatives lack direction and accountability. Executive sponsorship and business alignment provide support and relevance, but ownership translates those into concrete responsibility. Auditability, training resources, and policy compliance are operational outcomes that depend on clear ownership structures.
Why the other options are wrong
- B. Auditability of systems is an operational control, not a governance pillar.
- C. Training resource allocation is an implementation concern, not fundamental to governance.
- D. Policy compliance is an outcome that results from good governance with clear ownership.
Question 196
Which of the following tasks would provide a newly appointed information security manager with the BEST view of the organization's existing security posture?
Show answer and explanation
Correct answer: C. Performing a risk assessment
A risk assessment provides the most comprehensive view of an organization's security posture by systematically identifying assets, threats, vulnerabilities, and their combinations to understand current security gaps and exposures. While BIA, policy review, and interviews all provide useful information, a risk assessment directly evaluates the organization's ability to protect assets and quantifies security gaps, making it the best starting point for a newly appointed security manager.
Why the other options are wrong
- A. BIA focuses on impact of downtime, not security posture.
- B. Policy review shows what should exist, not actual security state.
- D. Interviews provide subjective views but not a comprehensive security picture.
Question 197
Which of the following BEST indicates the effectiveness of the vendor risk management process?
Show answer and explanation
Correct answer: B. Increase in the percentage of vendors with a completed due diligence review
The best indicator of vendor risk management effectiveness is the percentage of vendors with completed due diligence reviews. Due diligence directly evaluates vendor security postures and risk levels, providing evidence that the organization has systematically assessed and managed vendor-related risks across its vendor base.
Why the other options are wrong
- A. Certifications are helpful but don't guarantee risk management effectiveness; many unvetted vendors may lack certifications.
- C. Security training is important but is only one aspect of vendor risk; it doesn't indicate comprehensive risk management.
- D. Breach reporting is a detection mechanism, not an indicator of effective risk management; prevention is preferable to breach response.
Question 198
An information security manager wants to implement a security information and event management (SIEM) system that will aggregate log data from all systems that control perimeter access. Which of the following would BEST support the business case for this initiative to senior management?
Show answer and explanation
Correct answer: C. Independent evidence of a SIEM system's ability to reduce risk
To convince senior management to invest in a SIEM system, the security manager needs independent evidence demonstrating the system's ability to reduce risk. This provides quantifiable, objective justification rather than examples, best practices, or infrastructure metrics alone, which don't directly prove business value or risk reduction capability.
Why the other options are wrong
- A. Industry examples are anecdotal and don't provide concrete evidence of risk reduction for this organization.
- B. Alignment with best practices is important but doesn't directly demonstrate tangible risk reduction benefits.
- D. Number of systems consolidated is a technical metric, not a business justification for risk reduction.
Question 199
Which of the following is an important criterion for developing effective key risk indicators (KRIs) to monitor information security risk?
Show answer and explanation
Correct answer: D. The indicator should possess a high correlation with a specific risk and be measured on a regular basis
Effective KRIs must possess a high correlation with a specific risk and be measured on a regular basis (not annually). This ensures they accurately reflect the actual risk state in near-real-time and support proactive decision-making. Regular measurement enables trend analysis and early warning, which is the purpose of leading indicators. Correlation ensures the metric actually predicts or represents the specific risk being monitored.
Why the other options are wrong
- A. KRIs should be forward-looking and measured regularly (not retrospectively or annually).
- B. KRIs should focus on business risk broadly, not just IT, and should measure risk not just IT performance.
- C. While alignment with KPIs is valuable, the critical feature is correlation with specific risks and regular measurement.
Question 200
Which of the following should be the PRIMARY basis for determining information security objectives?
Show answer and explanation
Correct answer: A. Business strategy
Business strategy should be the primary basis for determining information security objectives. Security objectives must align with and support what the organization is trying to achieve business-wise. While regulatory requirements, information security strategy, and data classification all inform security objectives, they are secondary considerations. Business strategy provides the overarching context that makes security initiatives relevant and valuable to the organization.
Why the other options are wrong
- B. Regulatory requirements are constraints that must be met but don't drive the primary objectives of the security program.
- C. Information security strategy should derive from business strategy, not serve as its basis.
- D. Data classification is a tool that supports security objectives but doesn't determine what those objectives should be.
Question 201
Which of the following security initiatives should be the FIRST step in helping an organization maintain compliance with privacy regulations?
Show answer and explanation
Correct answer: A. Implementing a data classification framework
Implementing a data classification framework is the foundational first step because you cannot effectively protect or manage data for privacy compliance without knowing what data you have, where it resides, and its sensitivity level. Classification enables targeted protection strategies and compliance efforts. Without this foundation, other security measures lack focus and direction.
Why the other options are wrong
- B. SIEM is a monitoring tool implemented after understanding what data needs protection.
- C. DLP is a technical control that requires knowledge of data classification to be effective.
- D. Security awareness training should follow policy and strategy development based on data insights.
Question 202
Which of the following is an information security manager's BEST recommendation to senior management following a breach at the organization's Software as a Service (SaaS) vendor?
Show answer and explanation
Correct answer: D. Update the vendor risk assessment
Following a breach at a SaaS vendor, the information security manager's best immediate recommendation is to update the vendor risk assessment. This allows the organization to re-evaluate the vendor's security posture, document what went wrong, and determine appropriate mitigation strategies. While legal counsel may be engaged and the contract may eventually be renegotiated based on findings, updating the risk assessment is the foundational step that informs all subsequent decisions about the vendor relationship.
Why the other options are wrong
- A. Engaging legal counsel is important but not the primary security management responsibility immediately after the breach.
- B. Terminating the relationship may be premature without first assessing the actual impact and risk.
- C. Renegotiating comes after understanding the full risk picture through an updated assessment.
Question 203
Organization A offers e-commerce services and uses secure transport protocol to protect Internet communication. To confirm communication with Organization A, which of the following would be the BEST for a client to verify?
Show answer and explanation
Correct answer: B. The certificate of the e-commerce server
A digital certificate issued by a trusted certificate authority binds the server's identity to its public key, so inspecting the certificate, its subject name, issuing CA, validity dates and revocation status, is the only reliable way for a client to confirm it is genuinely communicating with Organization A. All other indicators can be spoofed or reproduced by an attacker without proving identity.
Why the other options are wrong
- A. A URL can be spoofed, mistyped, or hijacked by DNS manipulation and proves nothing about the server's identity.
- C. An IP address can be spoofed or redirected and is not bound to any verified organizational identity.
- D. A browser indication merely shows an encrypted session exists; encryption can be established with an impostor site.
Question 204
When creating an incident response plan, the PRIMARY benefit of establishing a clear definition of a security incident is that it helps to:
Show answer and explanation
Correct answer: A. develop effective escalation and response procedures
A clear definition of what constitutes a security incident is essential for determining when to escalate, who to involve, and what response procedures to activate. Without this definition, the organization cannot consistently identify incidents or apply appropriate response actions. This enables the incident response team to make timely and consistent decisions about escalation and response procedures.
Why the other options are wrong
- B. Tabletop testing effectiveness depends on multiple factors beyond incident definition.
- C. Staffing and training needs can be assessed through various means independent of incident definition.
- D. While communication helps, the primary benefit is enabling consistent response decision-making.
Question 205
Which of the following BEST provides an information security manager with sufficient assurance that a service provider complies with the organization's information security requirements?
Show answer and explanation
Correct answer: B. The ability to audit the third-party supplier's IT systems and processes
The ability to audit the third-party supplier's IT systems and processes provides the BEST assurance because it offers direct, independent verification of actual compliance. Audits allow the organization to verify that controls are genuinely implemented and operating effectively, rather than relying on self-reported information or demonstrations. This direct access and verification capability provides the strongest foundation for assurance compared to other methods that are less comprehensive or independent.
Why the other options are wrong
- A. Demonstrations can be staged or highlight only favorable aspects; they don't provide comprehensive verification of all systems and processes.
- C. Self-assessments lack independence and cannot be verified to accurately reflect actual compliance.
- D. While third-party reports add credibility, they may not specifically address the organization's unique security requirements and don't provide direct audit rights.
Question 206
From an information security perspective, legal issues associated with a transborder flow of technology-related items are MOST often related to:
Show answer and explanation
Correct answer: B. encryption tools and personal data.
The most significant legal issues with transborder flow of technology relate to encryption tools and personal data protection. Many countries have strict regulations on exporting encryption technologies and transferring personal data across borders, creating compliance concerns with export controls, data protection laws, and privacy regulations. These restrictions are enforced by governments and regulatory bodies worldwide.
Why the other options are wrong
- A. Website transactions and taxation, while relevant to international commerce, are not the primary legal concern for technology transborder flows.
- C. Competition and free trade issues are not the primary legal concern from an information security perspective.
- D. Software patches and corporate data are not the primary transborder legal concern; personal data and encryption tools are the main focus.
Question 207
An information security manager developing an incident response plan MUST ensure it includes:
Show answer and explanation
Correct answer: C. criteria for escalation.
Criteria for escalation is a MUST-HAVE component of an incident response plan because it ensures incidents are properly routed to appropriate decision-makers based on severity, impact, and type. Escalation criteria enable timely executive notification, resource allocation, and coordination. This is a fundamental procedural element that every incident response plan requires regardless of organization type.
Why the other options are wrong
- A. Critical infrastructure diagrams are helpful context but not mandatory for basic incident response.
- B. BIA informs incident response strategy but isn't a required component of the plan itself.
- D. Critical data inventory is important but not a mandatory element of the incident response plan document.
Question 208
An information security manager has been tasked with developing materials to update the board, regulatory agencies, and the media about a security incident. Which of the following should the information security manager do FIRST?
Show answer and explanation
Correct answer: D. Determine the needs and requirements of each audience.
Determining the needs and requirements of each audience is the critical first step before developing communications. Different audiences (board, regulators, media) have different information needs, regulatory requirements, and concerns. Understanding these distinct requirements ensures that appropriate, compliant, and relevant messages are crafted for each group rather than creating one generic communication.
Why the other options are wrong
- A. The incident response plan should already be invoked as part of incident management, not as a first step for communications.
- B. Setting up communication channels is a logistical step that should follow determining what needs to be communicated.
- C. Creating a singular communication ignores that different audiences have different needs and regulatory requirements.
Question 209
An information security manager has become aware that a third-party provider is not in compliance with the statement of work (SOW). Which of the following is the BEST course of action?
Show answer and explanation
Correct answer: A. Assess the extent of the issue.
Assessing the extent of the issue is the best first course of action because it establishes the scope and severity of the non-compliance before taking further action. Understanding the nature and impact of the issue is necessary to determine appropriate next steps, whether that involves corrective action requests, escalation, legal involvement, or contract renegotiation. Acting without this assessment could result in overreaction or insufficient response.
Why the other options are wrong
- B. Reporting to legal before understanding the issue may be premature and could escalate unnecessarily.
- C. Notifying senior management without a clear assessment of the problem's scope and impact is inefficient.
- D. Initiating contract renegotiation should only occur after determining whether remediation or termination is necessary.
Question 210
Information security awareness programs are MOST effective when they are:
Show answer and explanation
Correct answer: C. customized for each target audience.
Customization for target audiences is MOST important for effectiveness because different roles, departments, and user groups face different security risks and need tailored messaging. While senior sponsorship (A) provides support, computer-based training (B) provides delivery method, and orientation timing (D) provides initial exposure, none of these are as critical to effectiveness as ensuring the message is relevant and resonant to each specific audience. Customized content drives higher engagement and retention.
Why the other options are wrong
- A. Senior management sponsorship is important for credibility and support but doesn't ensure effectiveness if content isn't tailored.
- B. Computer-based training is a delivery mechanism, not the key to effectiveness; content customization matters more than delivery method.
- D. Timing at orientation reaches new employees but doesn't address the ongoing needs of all staff or specialized audiences.
Question 211
Which of the following is the MOST important consideration when selecting members for an information security steering committee?
Show answer and explanation
Correct answer: D. Cross-functional composition
Cross-functional composition is the most important selection criterion because a security steering committee must represent diverse business areas to ensure decisions consider multiple perspectives, gain organizational buy-in, and align security with business objectives. Members should come from finance, operations, HR, IT, compliance, and other key departments. While security expertise, tenure, and business knowledge are valuable attributes, the composition structure itself, ensuring representation across functions, is most critical to effective governance.
Why the other options are wrong
- A. Security expertise alone is insufficient; committee needs business and operational perspectives from other departments.
- B. Tenure may indicate institutional knowledge but does not ensure the necessary cross-functional representation.
- C. Business expertise is important but must be paired with cross-functional representation to be effective.
Question 212
An organization's information security manager reads on social media that a recently purchased vendor product has been compromised and customer data has been posted online. What should the information security manager do FIRST?
Show answer and explanation
Correct answer: B. Validate the risk to the organization
Before activating full incident response procedures or performing detailed business impact analysis, the security manager must first validate whether the reported compromise actually affects the organization. This validation of risk determines if the incident is real, relevant, and requires escalation. Only after confirming the organization is actually impacted should formal incident response be activated.
Why the other options are wrong
- A. Activating the full incident response program prematurely wastes resources if the organization isn't actually affected.
- C. A BIA is thorough but is premature until the actual risk to this organization is validated.
- D. Notifying law enforcement before validating the risk is jumping ahead; first determine if this is a real threat to the organization.
Question 213
The MOST important element in achieving executive commitment to an information security governance program is:
Show answer and explanation
Correct answer: A. identified business drivers.
Identified business drivers are the most important element for executive commitment because they connect security governance directly to organizational strategy, revenue protection, and business objectives. Executives commit resources when they understand how security enables business success. While frameworks, strategies, and improvement models are useful tools, they lack the motivational power of clear business drivers tied to organizational priorities.
Why the other options are wrong
- B. Process improvement models are methodological tools, not drivers of executive commitment.
- C. Security strategies define implementation but don't justify executive investment as effectively as business drivers.
- D. Security frameworks provide structure but don't inherently communicate business value to executives.
Question 214
Which of the following BEST enables successful identification of a potential IT security incident?
Show answer and explanation
Correct answer: B. Event correlation
Event correlation is the most effective method for identifying potential IT security incidents because it connects disparate events and alerts from multiple sources to recognize attack patterns that individual alerts might miss. Correlation reduces false positives and detects sophisticated multi-stage attacks. While other tools contribute to incident identification, correlation provides the analytical capability to recognize incidents across the security infrastructure.
Why the other options are wrong
- A. Configuration management standards provide baseline definitions but don't actively detect incidents.
- C. NIDS detects network-based intrusions but cannot identify all incident types or correlate across domains.
- D. File integrity monitoring detects unauthorized file changes but is limited to host-based detection only.
Question 215
Which of the following would be MOST useful in determining how an organization will be affected by a new regulatory requirement for cloud services?
Show answer and explanation
Correct answer: B. Risk assessment
A risk assessment is most useful for determining how an organization will be affected by new regulatory requirements for cloud services. Risk assessment identifies which assets and processes would be impacted, evaluates the magnitude of compliance gaps, and determines the level of effort and resources needed to achieve compliance. This provides a comprehensive view of organizational impact.
Why the other options are wrong
- A. Data loss protection plans address one aspect but don't comprehensively assess regulatory impact.
- C. Asset inventory identifies what exists but doesn't evaluate how regulations affect operations.
- D. Data classification policy is foundational but doesn't assess the actual impact of new cloud regulations.
Question 216
An organization is about to purchase a rival organization. The PRIMARY reason for performing information security due diligence prior to making the purchase is to:
Show answer and explanation
Correct answer: A. determine the security exposures
The primary purpose of security due diligence in an acquisition is to determine and understand the security exposures of the target organization. This identifies liabilities, risks, and potential post-acquisition costs that affect the purchase decision itself and negotiating terms. Identifying security exposures is foundational, once exposures are known, integration planning, compliance assessment, and other considerations flow from that baseline understanding. This allows informed decision-making about whether to proceed and at what valuation.
Why the other options are wrong
- B. Assessing integration ability is important post-acquisition planning but is not the primary reason for due diligence, which is to identify exposures.
- C. Ensuring compliance with international standards is an operational objective but not the primary purpose of due diligence.
- D. Evaluating existing policies and standards is part of the due diligence process but is secondary to the primary goal of identifying exposures and risks.
Question 217
In a cloud technology environment, which of the following would pose the GREATEST challenge to the investigation of security incidents?
Show answer and explanation
Correct answer: B. Access to the hardware
Access to the hardware poses the GREATEST challenge in investigating security incidents in cloud environments. In cloud infrastructure, customers typically have no direct access to physical hardware and must rely entirely on the cloud provider's cooperation and logs, severely limiting forensic capabilities and investigation scope.
Why the other options are wrong
- A. Non-standard logs are challenging but can be mapped and analyzed with proper tools.
- C. Data encryption requires keys but investigation can proceed with provider cooperation.
- D. Compressed data can be decompressed; access to underlying hardware remains the fundamental barrier.
Question 218
Which of the following would provide the HIGHEST level of confidence in the integrity of data when sent from one party to another?
Show answer and explanation
Correct answer: B. Require files to be digitally signed before they are transmitted.
Digital signatures provide cryptographic proof of both the integrity and authenticity of data. They use asymmetric cryptography to create a verifiable fingerprint that proves the data hasn't been altered and confirms who sent it. This directly addresses integrity of the data itself. Hardening infrastructure protects the channel but not the data. Multi-factor authentication verifies identity but not data integrity. Secure connections protect data in transit but don't provide proof of integrity.
Why the other options are wrong
- A. Infrastructure hardening protects the transmission channel but doesn't verify that data itself hasn't been altered.
- C. Multi-factor authentication verifies user identity, not the integrity of the data being transmitted.
- D. Secure connections provide confidentiality and protect against eavesdropping but don't verify data integrity after delivery.
Question 219
A recent audit found that an organization's new user accounts are not set up uniformly. Which of the following is MOST important for the information security manager to review?
Show answer and explanation
Correct answer: D. Standards
Standards define specific, mandatory technical requirements and configurations that must be consistently applied. When new user accounts are not uniform, the issue is that technical standards for account setup are either missing or not being followed. Standards are the prescriptive control documents that enforce consistency. Policies provide high-level direction, guidelines offer recommendations, and controls implement enforcement, but standards specifically define the uniform requirements that ensure consistency.
Why the other options are wrong
- A. Policies provide direction but are typically higher-level than the specific account setup requirements.
- B. Automated controls implement standards but don't define what should be uniform in the first place.
- C. Guidelines are recommendations, not mandatory requirements, so they won't ensure uniformity.
Question 220
Determining the risk for a particular threat/vulnerability pair before controls are applied can be expressed as:
Show answer and explanation
Correct answer: D. a function of the likelihood and impact, should a threat exploit a vulnerability.
Risk is fundamentally defined as a function of both likelihood (probability that a threat will exploit a vulnerability) and impact (magnitude of harm if exploitation occurs). This is the standard risk formula: Risk = Likelihood × Impact. Before controls are applied, this represents inherent risk.
Why the other options are wrong
- A. Likelihood alone does not define risk; impact must also be considered.
- B. Impact alone does not define risk; likelihood must also be factored in.
- C. This describes residual risk after controls are applied, not inherent risk before controls.
Question 221
Company A, a cloud service provider, is in the process of acquiring Company B to gain new benefits by incorporating their technologies within its cloud services. Which of the following should be the PRIMARY focus of Company A's information security manager?
Show answer and explanation
Correct answer: C. Company B's security policies
When acquiring another company, the information security manager's primary focus must be understanding Company B's existing security policies to identify gaps, conflicts, and integration requirements. This assessment is foundational to planning the security integration and determining what changes, updates, or remediation are needed. While alignment costs, organizational structure, and security architecture are all relevant downstream considerations, understanding the target company's current security posture is the essential first step.
Why the other options are wrong
- A. Cost alignment is a secondary concern after understanding the actual security requirements and gaps.
- B. Organizational structure is less critical than understanding actual security controls and policies.
- D. Company A's architecture context is important but secondary to assessing what must be integrated from Company B.
Question 222
Which of the following should be the PRIMARY consideration when implementing a data loss prevention (DLP) solution?
Show answer and explanation
Correct answer: C. Data classification
Data classification is the PRIMARY consideration when implementing a DLP solution because you cannot effectively protect data if you don't know what data exists, where it resides, or how sensitive it is. Classification provides the foundation for all DLP policies and rules. Without proper data classification, DLP implementations will either over-protect non-sensitive data or fail to protect critical assets.
Why the other options are wrong
- A. Data ownership is important for governance but is secondary to knowing what data needs to be protected.
- B. Storage capabilities are a technical consideration but don't inform what protection policies should be implemented.
- D. Tool selection comes after determining what needs to be protected based on data classification.
Question 223
Which of the following is the BEST way to determine if a recent investment in access control software was successful?
Show answer and explanation
Correct answer: B. A comparison of security incidents before and after software installation
The most objective way to measure whether an access control investment was successful is to compare security incidents before and after implementation. This provides empirical evidence of impact. Senior management acceptance (A) is subjective; a BIA (C) doesn't measure the specific control's effectiveness; and reviewing KRIs (D) measures tracking but not actual success. Incident reduction is the ultimate measure of control effectiveness.
Why the other options are wrong
- A. Management acceptance is subjective and doesn't prove actual security improvement
- C. BIA assesses criticality but doesn't measure this specific control's effectiveness
- D. KRI implementation measures monitoring, not the control's actual effectiveness
Question 224
Capacity planning would prevent:
Show answer and explanation
Correct answer: C. application failures arising from insufficient hardware resources.
Capacity planning directly prevents application failures arising from insufficient hardware resources by ensuring systems are sized appropriately to handle expected loads. This is the core purpose of capacity planning, forecasting and provisioning adequate resources to maintain system performance and availability under anticipated demand conditions.
Why the other options are wrong
- A. Scheduled security maintenance downtime is typically planned and intentional, not prevented by capacity planning.
- B. Capacity planning addresses normal resource demand; DDoS attacks represent malicious traffic that exceeds normal planning assumptions.
- D. Buffer overflow vulnerabilities are software security issues prevented through secure coding and patching, not capacity planning.
Question 225
Which of the following is the BEST way to obtain reliable information to help an incident response team maintain awareness of emerging security threats and vulnerabilities?
Show answer and explanation
Correct answer: A. Subscribe to a reputed threat intelligence group.
Subscribing to a reputed threat intelligence group is the BEST way to obtain reliable, curated, and actionable information about emerging threats and vulnerabilities. Professional threat intelligence services provide vetted, timely information from trusted sources specifically designed to help organizations maintain awareness and respond proactively.
Why the other options are wrong
- B. Engaging with social media hacking groups is unethical, illegal, and provides unreliable information.
- C. SIEM alerts show internal events and known issues but don't provide external emerging threat awareness.
- D. Vulnerability scanners identify known vulnerabilities in your environment but don't provide intelligence about emerging threats in the broader landscape.
Question 226
Which of the following is the MOST important security feature an information security manager would need for a mobile device management (MDM) program?
Show answer and explanation
Correct answer: B. Ability to remotely wipe devices
While inventory, location tracking, and update capabilities are all valuable MDM features, the ability to remotely wipe devices is the most critical security feature. Remote wipe capability protects against data breaches when devices are lost, stolen, or compromised, and is essential for enforcing security standards when employees leave or devices are non-compliant.
Why the other options are wrong
- A. Device inventory is important but less critical for immediate security than data protection.
- C. Location tracking helps recover devices but doesn't protect data if device is compromised.
- D. Update capability is maintenance-focused rather than addressing critical security threats.
Question 227
What is the PRIMARY benefit of using key performance indicators (KPIs) for information security risk management?
Show answer and explanation
Correct answer: A. Set targets against which the organization's information security function can be evaluated.
Key Performance Indicators establish measurable targets and benchmarks against which the security function's performance and effectiveness can be evaluated and monitored over time. KPIs enable organizations to assess whether security objectives are being met and to identify areas requiring improvement.
Why the other options are wrong
- B. Preventing events is about risk mitigation controls, not the primary benefit of KPIs themselves.
- C. Identifying past events relates to incident detection and forensics, not the primary purpose of KPIs.
- D. Setting organizational objectives is part of strategy development, not the primary benefit of KPIs which measure against already-set targets.
Question 228
Which of the following should be done FIRST when establishing an information security governance framework?
Show answer and explanation
Correct answer: A. Gain an understanding of the business and cultural attributes.
Before implementing any security framework, it is essential to first understand the organization's business objectives, culture, risk tolerance, and operational environment. This foundational understanding ensures that the security governance framework will be aligned with business needs and realistic within the organizational context. Without this understanding, subsequent decisions about tools, controls, and resources would be made without proper context.
Why the other options are wrong
- B. Third-party reviews are valuable but come after establishing the framework's foundation and initial implementation.
- C. Cost-benefit analysis should follow understanding the business context and requirements, not precede it.
- D. Evaluating tools and skills is premature without first understanding the business and cultural attributes.
Question 229
Which of the following is the BEST indication of information security strategy alignment with the business?
Show answer and explanation
Correct answer: D. Number of business objectives directly supported by information security initiatives
The percentage of business objectives directly supported by information security initiatives is the BEST indication of alignment because it measures how security efforts map to actual business goals. Direct support of business objectives demonstrates that security is not an isolated function but is strategically integrated with organizational priorities. The other options measure inputs (budget, training attendance) or operational outputs (incident resolution) rather than true strategic alignment.
Why the other options are wrong
- A. Attendance at awareness sessions measures training participation, not strategy alignment.
- B. Budget allocation percentage doesn't confirm alignment with business objectives.
- C. Incident SLA compliance is operational execution, not strategic business alignment.
Question 230
An information security manager is implementing a bring your own device (BYOD) program. Which of the following would BEST ensure that users adhere to the security standards?
Show answer and explanation
Correct answer: B. Deploy a device management solution.
A device management solution provides technical enforcement of security standards through configuration management, compliance monitoring, and remote enforcement capabilities. This ensures adherence regardless of user awareness or willingness, making it the BEST approach for guaranteeing compliance with BYOD security standards.
Why the other options are wrong
- A. Publishing on intranet is informational but does not technically enforce compliance.
- C. An acceptable use policy establishes rules but relies on user compliance; it lacks enforcement mechanisms.
- D. Monitoring detects violations but does not prevent non-compliant devices from connecting or operating.
Question 231
Which of the following is MOST important when designing an information security governance framework?
Show answer and explanation
Correct answer: C. Aligning with the information security strategy
Aligning the information security governance framework with the organization's information security strategy is most important because the framework must support and enable the achievement of strategic objectives. The framework structure, processes, and controls should directly support the organization's defined security strategy and goals. While assessing current state, resources, and industry practices are important inputs, they inform how to achieve alignment with strategy, making strategy alignment the primary consideration.
Why the other options are wrong
- A. Assessing resource availability is important for feasibility but doesn't drive the fundamental design of the governance framework.
- B. Assessing current state is useful context but is subordinate to aligning with overall strategy.
- D. Industry best practices are valuable benchmarks but must be adapted to support the organization's specific strategy, not be the primary design driver.
Question 232
Which of the following should an information security manager perform FIRST when an organization's residual risk has increased?
Show answer and explanation
Correct answer: B. Assess the business impact.
When an organization's residual risk has increased, an information security manager should FIRST assess the business impact. Before implementing any solutions, transferring risk, or communicating to leadership, the manager must understand the scope and severity of the increased risk and its potential effects on business operations. This assessment provides the foundation for all subsequent risk management decisions.
Why the other options are wrong
- A. Implementing measures before assessing impact could be inefficient or misdirected.
- C. Transferring risk is a treatment option that should only be considered after understanding the impact.
- D. Communicating to senior management should follow impact assessment so leadership can make informed decisions.
Question 233
To inform a risk treatment decision, which of the following should the information security manager compare with the organization's risk appetite?
Show answer and explanation
Correct answer: D. Level of residual risk
When making risk treatment decisions, the residual risk (the risk remaining after treatment) must be compared against the organization's risk appetite to determine if the treatment is sufficient. Risk appetite defines the organization's tolerance for risk, making it the appropriate baseline for comparison. Gap analysis results (A) relate to current state vs. target state, configuration parameters (C) are implementation details, and treatment level (B) is the decision outcome, not the comparison point.
Why the other options are wrong
- A. Gap analysis results inform the current state but are not compared directly to risk appetite.
- B. Level of treatment is the decision being made, not what is compared to appetite.
- C. Configuration parameters are technical details unrelated to risk appetite comparison.
Question 234
An organization plans to utilize Software as a Service (SaaS) and is in the process of selecting a vendor. What should the information security manager do FIRST to support this initiative?
Show answer and explanation
Correct answer: C. Define information security requirements and processes.
Before evaluating any specific vendor, the security manager must first define what security requirements and processes the organization needs. This establishes the baseline criteria against which all vendors will be measured. Without defined requirements, reviewing assessment reports (A), benchmarking (B), or analyzing risks (D) would lack context and direction. Requirements definition is the foundational first step in any vendor selection process.
Why the other options are wrong
- A. Reviewing reports is valuable but should follow requirement definition to ensure assessments are evaluated against organizational needs.
- B. Benchmarking is premature without first understanding what security requirements matter most to the organization.
- D. Risk analysis and controls should be based on defined requirements, making it a later step in the process.
Question 235
Which of the following is necessary to ensure consistent protection for an organization’s information assets?
Show answer and explanation
Correct answer: A. Control assessment
Control assessment is necessary to ensure consistent protection because it systematically evaluates whether existing controls are operating effectively and adequately protecting information assets across the organization. Assessment is the mechanism that verifies and maintains consistent protection standards. While other options are relevant to security programs, control assessment is the most direct method to ensure consistent application of protections.
Why the other options are wrong
- B. Data ownership establishes responsibility but doesn't ensure consistent protection mechanisms.
- C. Regulatory requirements set external requirements but don't directly ensure consistent internal protection.
- D. Classification mode/scheme organizes data but doesn't itself ensure protection consistency across assets.
Question 236
An information security manager of an e-commerce business is reviewing the results of a business continuity plan (BCP) review. Which of the following findings should be the MOST immediate concern?
Show answer and explanation
Correct answer: D. The recovery time objective (RTO) was not met during a recent power outage.
An RTO that was not met during an actual outage represents a critical failure in the organization's ability to recover operations within acceptable timeframes. This is an operational reality check showing the plan cannot meet business requirements, whereas options A, B, and C are process/planning issues that, while important, do not directly indicate failure to meet recovery objectives during an actual incident.
Why the other options are wrong
- A. Budget overruns on testing are a resource management issue, not a direct threat to recovery capability.
- B. A delayed BIA is a planning/scheduling issue that should be remediated but is not as urgent as a failed RTO.
- C. Lack of recent testing is a concern, but an actual power outage provided a real-world test that failed the RTO requirement.
Question 237
An organization is considering the deployment of encryption software and systems organization-wide. The MOST important consideration should be whether:
Show answer and explanation
Correct answer: D. the implementation supports the business strategy
The most important consideration when deploying encryption organization-wide is whether the implementation supports the business strategy. Without alignment to business objectives, encryption deployment may be ineffective, costly, or create operational friction. While other factors like key recovery and classification policies are important, they are secondary to ensuring the encryption solution actually serves the organization's strategic needs and can be successfully integrated into business operations.
Why the other options are wrong
- A. Classification policy is important but comes after establishing that encryption supports business strategy.
- B. Business exceptions to standards indicate weak planning rather than being a primary consideration.
- C. Key recovery is critical for operations but is an operational detail, not the most important strategic consideration.
Question 238
Which of the following is the BEST course of action when confidential information is inadvertently disseminated outside the organization?
Show answer and explanation
Correct answer: B. Declare an incident
When confidential information is inadvertently disseminated outside the organization, the best course of action is to declare an incident. This activates the incident response process, ensures proper notification procedures are followed, triggers investigations, and allows for appropriate remediation and legal/compliance responses.
Why the other options are wrong
- A. Changing encryption keys does not address the already-disseminated data or containment.
- C. Reviewing compliance requirements is necessary but comes during the incident response, not as the first action.
- D. While communication may be necessary, it must follow the incident declaration and assessment process to ensure proper handling.
Question 239
Which of the following is MOST appropriate to add to a dashboard for the purpose of illustrating an organization's risk level to senior management?
Show answer and explanation
Correct answer: D. Risk heat map
A risk heat map is the most appropriate dashboard addition for illustrating organizational risk level to senior management. Heat maps visually represent the organization's risk profile by showing the distribution and magnitude of risks across different areas or dimensions, making it immediately clear where the greatest risks exist. This provides senior management with a clear, intuitive understanding of overall risk posture at a glance.
Why the other options are wrong
- A. Risk and control testing results are detailed technical information, not an appropriate high-level risk level visualization.
- B. Incident counts are historical operational metrics, not a forward-looking indicator of organizational risk level.
- C. Budget variance shows spending performance but does not illustrate the organization's actual risk level.
Question 240
Which of the following would BEST enable an organization to aggregate information from different systems to allow for centralized categorization of incidents?
Show answer and explanation
Correct answer: D. Security information and event management (SIEM)
A Security Information and Event Management (SIEM) system is specifically designed to aggregate logs and events from multiple systems and sources, normalize the data, correlate events, and provide centralized categorization and analysis of security incidents across the entire infrastructure.
Why the other options are wrong
- A. IDS detects intrusions but does not aggregate information from different systems for centralized incident categorization.
- B. APIs enable system communication but are not specifically designed for incident aggregation and categorization.
- C. IPS prevents intrusions but does not provide centralized aggregation and categorization of incident information.
Question 241
To overcome the perception that security is a hindrance to business activities, it is important for an information security manager to:
Show answer and explanation
Correct answer: C. promote the relevance and contribution of security
To overcome the perception that security is a hindrance to business, the information security manager must actively promote the relevance and contribution of security to business objectives and outcomes. This means demonstrating how security enables business success, protects assets, and reduces risk rather than focusing on barriers and compliance alone. Building alignment between security and business goals changes the organizational perspective.
Why the other options are wrong
- A. Focusing only on compliance reinforces the perception of security as a burden rather than a business enabler.
- B. Reiterating necessity without connecting to business value perpetuates the hindrance perception.
- D. Relying on senior management to enforce security doesn't address or change the underlying perception.
Question 242
Which of the following should be an information security manager's MAIN concern if the same digital signing certificate is able to be used by two or more users?
Show answer and explanation
Correct answer: B. Inability to validate identity of sender
The inability to validate the identity of the sender is the greatest concern because digital signing certificates derive their value from non-repudiation, proving that a specific individual signed a message. When multiple users share a certificate, you cannot definitively attribute a signature to any particular person, completely undermining the authentication and non-repudiation properties that make digital signatures legally and operationally valid.
Why the other options are wrong
- A. Digital signatures create hashes; they do not encrypt them, so this concern is technically incorrect.
- C. Certificate alteration is a separate integrity issue, not the primary concern of shared certificates.
- D. Segregation of duties is a control principle, but the immediate threat is loss of sender identity verification.
Question 243
When evaluating vendors for sensitive data processing, which of the following should be the FIRST step to ensure the correct level of information security is provided?
Show answer and explanation
Correct answer: B. Include information security criteria as part of vendor selection.
The FIRST step in vendor evaluation for sensitive data processing must be to establish information security criteria as part of the vendor selection process itself. This ensures security is built into the vendor evaluation framework from the beginning. Only after establishing these criteria can metrics be developed, reports be meaningfully reviewed, or contracts be properly drafted. Security must be a fundamental selection criterion, not an afterthought.
Why the other options are wrong
- A. Metrics are developed after security criteria are established, making this a secondary step.
- C. Third-party reports review existing vendors but presupposes that selection criteria have already been defined.
- D. Contracts are drafted based on established criteria; contractual clauses should reflect pre-defined security requirements.
Question 244
Which of the following should be the MOST important consideration when reviewing an information security strategy?
Show answer and explanation
Correct answer: B. New business initiatives
New business initiatives fundamentally drive security strategy because the organization's security posture must adapt to support new business directions, technologies, and operational models. Business initiatives create new risks and requirements that security strategy must address. This forward-looking perspective ensures security enables business objectives rather than being reactive to incidents or audits.
Why the other options are wrong
- A. Budget changes are a result of strategy, not the most important driver for reviewing strategy itself.
- C. Audit findings address compliance gaps but don't provide the strategic direction that business initiatives do.
- D. Incidents are reactive; strategy should anticipate and prevent issues rather than be driven by recent events.
Question 245
Which of the following is the MOST important function of an information security steering committee?
Show answer and explanation
Correct answer: D. Obtaining multiple perspectives from the business
The MOST important function of an information security steering committee is obtaining multiple perspectives from the business. A steering committee serves as a governance body that brings together stakeholders from different business units to align security initiatives with business needs, ensure executive sponsorship, and make strategic decisions that balance security with business objectives. This cross-functional perspective is essential.
Why the other options are wrong
- A. Data classification is an operational task, not a primary steering committee function.
- B. Defining security standards for logical access is a technical implementation detail, not strategic governance.
- C. Developing risk assessment processes is important but is more operational than obtaining the multiple business perspectives needed for strategic oversight.
Question 246
When integrating security risk management into an organization it is MOST important to ensure:
Show answer and explanation
Correct answer: B. business units approve the risk management methodology.
Business unit approval of the risk management methodology is most important when integrating security risk management into an organization. Risk management only works effectively when business units understand, accept, and support the methodology being used. Without business buy-in, the risk management process will face resistance and won't be properly integrated into business decision-making. Business approval ensures the methodology is practical, feasible, and aligned with how the organization actually operates.
Why the other options are wrong
- A. Following an established framework is good practice but doesn't ensure organizational integration and acceptance.
- C. Defining the risk treatment process is important but comes after establishing an approved methodology.
- D. Documented policies are necessary but documentation alone doesn't ensure integration without business unit approval.
Question 247
When defining and communicating roles and responsibilities between an organization and cloud service provider, which of the following situations would present the GREATEST risk to the organization's ability to ensure information risk is managed appropriately?
Show answer and explanation
Correct answer: B. The organization believes the provider accepted responsibility for issues affecting security that the provider did not accept
If the organization incorrectly believes the provider accepted responsibility for security matters that the provider actually did not accept, critical security gaps will exist with no party accountable. This misalignment creates dangerous blind spots where security controls are assumed to be in place but are not, representing the greatest risk to appropriate risk management. The organization may operate under false assumptions of protection.
Why the other options are wrong
- A. A custom RACI is non-standard but can still clearly document responsibilities if well-designed.
- C. Identified gaps allow the organization to recognize missing responsibilities and address them proactively.
- D. Duplication of effort is wasteful but does not create unmanaged risk; responsibilities are still covered.
Question 248
An information security manager has identified a major security event with potential noncompliance implications. Who should be notified FIRST?
Show answer and explanation
Correct answer: C. Senior management
Senior management should be notified FIRST when a major security event with noncompliance implications is identified. Senior management has the authority and responsibility to direct the organization's response, determine which regulatory and other authorities must be notified, and make strategic decisions about remediation and disclosure. They set the direction for all subsequent notifications.
Why the other options are wrong
- A. Internal audit should be involved but is not the first notification point; senior management directs the audit response.
- B. Public relations would communicate externally only after senior management determines the response strategy.
- D. Regulatory authorities are notified according to senior management's direction and the organization's assessment, not first.
Question 249
Which of the following has the MOST influence on the information security investment process?
Show answer and explanation
Correct answer: B. Organizational risk appetite
Organizational risk appetite has the most influence on the security investment process because it determines how much risk the organization is willing to accept, which directly shapes budget allocation and priorities. Risk appetite drives the level of security controls needed and the corresponding investment required. While KPIs, governance frameworks, and policies support the process, they are all constrained by and aligned with the organization's risk appetite, making it the primary driver of investment decisions.
Why the other options are wrong
- A. KPIs measure security performance but are outcomes of investment decisions rather than the primary driver.
- C. IT governance frameworks provide structure but operate within the risk appetite defined by the organization.
- D. Security policies guide controls but are themselves informed by risk appetite and risk tolerance.
Question 250
The MOST important objective of security awareness training for business staff is to:
Show answer and explanation
Correct answer: D. modify behavior.
The MOST important objective of security awareness training is to modify behavior. While understanding threats, reducing audit findings, and increasing compliance are beneficial outcomes, the fundamental goal is to change how employees act and make security decisions in their daily work. Behavior change is the underlying objective that enables all other outcomes.
Why the other options are wrong
- A. Understanding intrusion methods is educational content but not the primary objective of awareness training.
- B. Reducing audit findings is a potential byproduct, not the primary training objective.
- C. Increasing compliance is a result of behavior change, but not the primary objective itself.
Question 251
When performing a data classification project, an information security manager should:
Show answer and explanation
Correct answer: A. assign information criticality and sensitivity.
When performing a data classification project, the information security manager's primary responsibility is to assign information criticality and sensitivity. This is the core function of classification, determining how important and sensitive data is so appropriate protection levels can be applied. Identifying owners, custodians, and assigning access privileges are downstream activities that depend on the classification results.
Why the other options are wrong
- B. Identifying custodians typically occurs after classification to assign guardianship responsibilities.
- C. Identifying owners is important but occurs concurrently or after establishing the classification framework.
- D. Assigning access privileges is a consequence of classification, not part of the classification project itself.
Question 252
Which of the following is the BEST way to enhance training for incident response teams?
Show answer and explanation
Correct answer: D. Perform post-incident reviews.
Post-incident reviews (also called lessons learned sessions or post-mortems) are the most effective way to enhance incident response team training because they provide real-world learning directly tied to actual incidents the organization experienced. These reviews identify what worked, what didn't, and how to improve processes and skills. This hands-on, experience-based learning is more impactful than other approaches.
Why the other options are wrong
- A. Interviews with organizational units inform requirements but don't directly enhance team training.
- B. KPIs measure performance but don't inherently provide training or skill development.
- C. Emergency response exercises are valuable but less directly tied to lessons learned than post-incident reviews of actual incidents.
Question 253
The PRIMARY reason to create and externally store the disk hash value when performing forensic data acquisition from a hard disk is to:
Show answer and explanation
Correct answer: A. validate the integrity during analysis
The hash value is created and stored externally to validate the integrity of forensic data during analysis. Cryptographic hashes prove that data has not been altered between acquisition and analysis, which is critical for maintaining the evidential value and chain of custody. While backups, restoration, and confidentiality are valid concerns, they are not the primary reason for creating external hash values in forensic procedures.
Why the other options are wrong
- B. Hashes are not a backup mechanism; backups serve a different purpose than integrity validation.
- C. Hashes validate that data has not changed; they do not restore accidentally modified data.
- D. Hashes validate integrity and authenticity, not confidentiality.
Question 254
The information security manager of a multinational organization has been asked to consolidate the information security policies of its regional locations. Which of the following would be of GREATEST concern?
Show answer and explanation
Correct answer: C. Conflicting legal requirements
Conflicting legal requirements between regions create a fundamental constraint that cannot be easily resolved through policy consolidation. Security policies must comply with local laws, and where legal requirements conflict, a single unified policy may violate regulations in certain jurisdictions. Threat environments and work culture can be accommodated within flexible policies, and reporting lines are organizational rather than technical concerns.
Why the other options are wrong
- A. Varying threats can be addressed with flexible policies that accommodate different risk profiles.
- B. Reporting lines are organizational structure issues, not policy content barriers.
- D. Cultural differences can be accommodated through thoughtful policy design and change management.
Question 255
Which of the following is the PRIMARY objective of a business impact analysis (BIA)?
Show answer and explanation
Correct answer: B. Determine recovery priorities.
The primary objective of a BIA is to determine recovery priorities by identifying critical business functions, assessing the impact of their loss, and ranking them by importance to organizational continuity. This prioritization directly informs the recovery strategy and resource allocation for business continuity and disaster recovery planning.
Why the other options are wrong
- A. Control effectiveness confirmation is the objective of a control assessment or audit, not BIA.
- C. RPO definition is a secondary outcome derived from BIA priorities, not the primary objective.
- D. Vulnerability analysis is the purpose of risk assessment, not BIA.
Question 256
Which of the following is MOST important to consider when determining the effectiveness of the information security governance program?
Show answer and explanation
Correct answer: A. Key performance indicators (KPIs)
Key Performance Indicators (KPIs) are most important for determining effectiveness because they measure actual outcomes and performance of the security governance program. KPIs directly assess whether the program is achieving its objectives. Maturity models assess current state, KRIs measure risk trends, and risk tolerance defines appetite, but KPIs specifically measure program effectiveness.
Why the other options are wrong
- B. Maturity models assess current capability level but don't directly measure effectiveness.
- C. Risk tolerance defines acceptable risk levels but doesn't measure program effectiveness.
- D. KRIs monitor emerging risks but don't measure the effectiveness of governance controls.
Question 257
An incident response team recently encountered an unfamiliar type of cyber event. Though the team was able to resolve the issue, it took a significant amount of time to identify. What is the BEST way to help ensure similar incidents are identified more quickly in the future?
Show answer and explanation
Correct answer: B. Perform a post-incident review.
Performing a post-incident review is the best way to improve future incident identification because it analyzes what happened, why it took time to identify, and what gaps existed in detection capabilities. This structured reflection leads to concrete improvements such as updated detection signatures, new monitoring rules, or training adjustments that directly address the identification delay experienced with the unfamiliar cyber event.
Why the other options are wrong
- A. Establishing performance metrics alone does not address the underlying cause of slow identification.
- C. Threat analysis is useful but does not necessarily identify why this specific incident was hard to detect.
- D. Implementing a SIEM may help but is a solution without first understanding the actual detection gaps through post-incident review.
Question 258
Using which of the following metrics will BEST help to determine the resiliency of IT infrastructure security controls?
Show answer and explanation
Correct answer: C. Number of successful disaster recovery tests
Successful disaster recovery tests directly measure the ability of IT infrastructure security controls to withstand and recover from disruptions, which is the core definition of resiliency. Testing validates that controls function properly under adverse conditions and that the organization can restore critical functions. Outstanding audit issues, incident counts, and software updates are monitoring or maintenance activities but don't directly measure resilience capacity.
Why the other options are wrong
- A. Outstanding audit issues indicate control gaps but don't measure resilience or recovery capability.
- B. Incident disruptions are a symptom of failed resilience, not a measure of resilience itself.
- D. Software updates are preventive maintenance but don't validate actual resilience or recovery capability.
Question 259
Which of the following is the MOST important incident management consideration for an organization subscribing to a cloud service?
Show answer and explanation
Correct answer: D. An agreement on the definition of a security incident
When managing incidents involving cloud services, establishing a clear agreement on the definition of what constitutes a security incident is most critical. Without agreed-upon definitions, the organization and cloud provider may not coordinate effectively on incident detection, reporting, and response. This foundational agreement is essential for any cloud incident management process, particularly given the shared responsibility model of cloud services.
Why the other options are wrong
- A. Data classification is important but is a prerequisite activity separate from incident management coordination.
- B. Personnel expertise is important but is secondary to having agreed incident definitions and protocols with the cloud provider.
- C. A SIEM is a useful tool but is not specific to cloud incident management and is less critical than agreed incident definitions.
Question 260
Which of the following is MOST important to ensuring that incident management plans are executed effectively?
Show answer and explanation
Correct answer: D. The incident response team has the appropriate training.
For incident management plans to be executed effectively, the incident response team must possess the appropriate training and skills. Without proper training, even well-designed plans cannot be implemented effectively. While management support (A) and maturity assessments (B) are valuable, and MSPs (C) can assist, the team's training and competency are essential for successful execution of any incident response plan.
Why the other options are wrong
- A. Management support is important but doesn't directly ensure effective execution if the team lacks training.
- B. A maturity assessment is useful for planning but not essential for effective execution of existing plans.
- C. Engaging an MSSP is optional and not universally necessary for effective incident management.
Question 261
What is the PRIMARY objective of performing a vulnerability assessment following a business system update?
Show answer and explanation
Correct answer: D. Review the effectiveness of controls.
The PRIMARY objective of performing a vulnerability assessment following a business system update is to review the effectiveness of controls. After an update is deployed, the security team must verify that the update was successful, that it addressed the intended vulnerabilities, and that it did not introduce new security gaps. This assessment confirms that the control changes are working as designed.
Why the other options are wrong
- A. Improving the change control process is a secondary benefit, not the primary objective of the assessment.
- B. Updating the threat landscape is ongoing work, not specifically triggered by a system update.
- C. Determining operational losses relates to incident response, not post-update assessment.
Question 262
Which of the following is an information security manager's FIRST priority after a high-profile system has been compromised?
Show answer and explanation
Correct answer: D. Preserve incident-related data.
After a system compromise, the FIRST priority is to preserve incident-related data for forensic investigation and legal purposes. Preserving evidence allows the organization to understand how the breach occurred, who was affected, and what data was exposed. Without preserved data, investigation becomes severely hampered. While system restoration is important operationally, forensic preservation must occur first to avoid losing critical evidence.
Why the other options are wrong
- A. Improvements come after understanding the incident through investigation.
- B. Identifying malware is part of investigation but comes after evidence preservation.
- C. Restoration is a critical operational priority but must not occur until forensic data is secured and preserved.
Question 263
Which of the following is the MOST effective way to ensure information security policies are understood?
Show answer and explanation
Correct answer: D. Provide regular security awareness training.
Regular security awareness training is the most effective way to ensure information security policies are understood because it provides repeated, interactive education that improves comprehension, retention, and behavioral change. Training directly addresses understanding through explanation, discussion, and reinforcement, whereas documentation alone is passive, job descriptions provide context but limited detail, and whistle-blower programs address reporting rather than understanding.
Why the other options are wrong
- A. Whistle-blower programs address reporting violations, not ensuring policy understanding.
- B. Documentation is necessary but insufficient; many employees do not read or comprehend written procedures without reinforcement.
- C. Job descriptions establish accountability but do not effectively teach policy content or procedures.
Question 264
Which of the following is the BEST justification for making a revision to a password policy?
Show answer and explanation
Correct answer: A. A risk assessment
A risk assessment is the best justification for revising a password policy because it identifies specific vulnerabilities, threats, and business impacts that warrant policy changes. Risk assessments provide objective, documented evidence of the need for change. While industry best practices, audit recommendations, and vendor recommendations may inform decisions, they should be grounded in an organization's own risk assessment.
Why the other options are wrong
- B. Industry best practice alone doesn't justify organizational change without local risk context
- C. Audit recommendations require supporting risk analysis to determine organizational applicability
- D. Vendor recommendations serve vendor interests and require risk-based evaluation before adoption
Question 265
When implementing a security policy for an organization handling personally identifiable information (PII), the MOST important objective should be:
Show answer and explanation
Correct answer: B. regulatory compliance
When handling personally identifiable information, regulatory compliance is the most important objective because PII is subject to numerous legal requirements (GDPR, CCPA, HIPAA, etc.). Non-compliance results in legal liability, fines, and reputational damage. While encryption, training, and availability are all important security controls, they must be implemented within a framework that ensures regulatory compliance.
Why the other options are wrong
- A. Strong encryption is a control that supports compliance but is not the primary objective itself.
- C. Security awareness training is important but supports compliance rather than being the primary objective.
- D. Data availability is a security principle but is secondary to the legal imperative of regulatory compliance for PII.
Question 266
An organization has recently acquired a smaller company located in a different geographic region. Which of the following is the BEST approach for addressing conflicts between the parent organization's security standards and local regulations affecting the acquired company?
Show answer and explanation
Correct answer: C. Create a local version of the parent organization's standards
Creating a localized version of the parent organization's standards that incorporates local regulatory requirements represents the best balanced approach. This allows the organization to maintain consistent security posture while respecting mandatory local compliance obligations. It avoids the pitfalls of completely adopting one standard over another and ensures neither security nor compliance is compromised.
Why the other options are wrong
- A. Adopting only the acquired company's standards would weaken the parent organization's security posture.
- B. Ignoring local regulations creates legal and compliance violations in the acquired company's region.
- D. Creating a global version of local regulations is impractical and may conflict with parent organization's standards in other regions.
Question 267
Which of the following should be the PRIMARY driver for selecting and implementing appropriate controls to address the risk associated with weak user passwords?
Show answer and explanation
Correct answer: A. The organization's risk tolerance
The organization's risk tolerance is the primary driver for selecting controls because it defines the acceptable level of risk the organization is willing to bear. Control selection must align with this risk appetite, if risk tolerance is low, stronger controls are required. Culture, cost, and management direction all influence decisions, but they must be evaluated against the organization's defined risk tolerance.
Why the other options are wrong
- B. Culture influences how controls are implemented but doesn't define what level of risk is acceptable.
- C. Cost is a constraint but shouldn't override the organization's risk tolerance requirements.
- D. Management direction should align with the organization's risk tolerance, not replace it.
Question 268
Deciding the level of protection a particular asset should be given is BEST determined by:
Show answer and explanation
Correct answer: B. a risk analysis.
A risk analysis comprehensively evaluates both threats and vulnerabilities alongside asset value and likelihood to determine the appropriate level of protection needed. Risk analysis produces the quantitative and qualitative basis for protection decisions. While risk appetite influences the decision, a risk analysis is what objectively determines what level of protection is needed based on the actual risk profile of each asset.
Why the other options are wrong
- A. Risk appetite is a policy guideline that constrains how much risk to accept, but does not determine what protection level each asset needs.
- C. A threat assessment alone does not account for asset value, vulnerability, or likelihood necessary to determine appropriate protection.
- D. A vulnerability assessment alone does not include asset value or threat likelihood needed to determine appropriate protection levels.
Question 269
When determining an acceptable risk level, which of the following is the MOST important consideration?
Show answer and explanation
Correct answer: B. System criticalities
System criticalities are the MOST important consideration when determining acceptable risk levels because the organization's tolerance for risk must be directly proportional to the business impact if that system fails or is compromised. Critical systems that support core business functions require lower acceptable risk levels, while less critical systems may have higher tolerance. This drives prioritization more fundamentally than scores, matrices, or threat profiles.
Why the other options are wrong
- A. Vulnerability scores measure exposure but don't directly establish acceptable risk levels without understanding what systems are critical.
- C. Risk matrices are tools for analysis but are built upon criticality considerations, not the primary input.
- D. Threat profiles inform risk assessment but don't directly determine what risk levels are acceptable for the business.
Question 270
Which of the following is the BEST course of action if the business activity residual risk is lower than the acceptable risk level?
Show answer and explanation
Correct answer: B. Monitor the effectiveness of controls.
When residual risk is lower than the acceptable risk level, the controls are working better than required. The BEST action is to monitor the effectiveness of controls to ensure they continue performing at this level and to maintain the achieved risk position. You don't need to update frameworks, re-review probability/impact, or revisit inherent risk, the situation is acceptable, so ongoing monitoring and maintenance of effective controls is appropriate.
Why the other options are wrong
- A. The risk assessment framework doesn't need updating when results are acceptable.
- C. Probability and impact have already been properly assessed if residual risk is acceptable.
- D. Inherent risk doesn't change; focusing on maintaining control effectiveness is the right priority.
Question 271
Which of the following should be the MAIN outcome from monitoring key performance indicators (KPIs) for a corporate security management program?
Show answer and explanation
Correct answer: C. Data for the organization to assess progress
The main outcome of monitoring security KPIs should be data that allows the organization to assess progress toward its security goals and objectives. KPIs are measurement tools designed to provide visibility into performance and enable informed decision-making about the security program. This assessment capability is the fundamental purpose of establishing KPI monitoring.
Why the other options are wrong
- A. A balanced scorecard is a tool for presenting KPIs, not the main outcome of monitoring them.
- B. While security awareness is important, it is not the main outcome of KPI monitoring across a corporate program.
- D. Optimal value delivery is aspirational but not the direct outcome of monitoring; assessment of progress is.
Question 272
Which of the following is the BEST method to protect consumer private information for an online public website?
Show answer and explanation
Correct answer: B. Encrypt consumer data in transit and at rest
Encrypting consumer data in transit and at rest is the BEST comprehensive method to protect private information because it addresses the two most critical exposure points, data moving across networks and data stored on servers. This protects data regardless of other security gaps and is a defense-in-depth fundamental. While strong authentication (A), secure transport (C), and masking (D) are useful, encryption provides the broadest protection across all states of data.
Why the other options are wrong
- A. Strong authentication protects account access but doesn't protect data itself from exposure.
- C. Secure transport layer only protects data in transit, not at rest.
- D. Masking is useful for display/analytics but doesn't prevent unauthorized access to actual data values.
Question 273
When a critical system incident is reported, the FIRST step of the incident handler should be to:
Show answer and explanation
Correct answer: C. validate the incident.
The first step in incident handling must be to validate that an actual security incident has occurred, not a false alarm or misconfiguration. Validating the incident ensures appropriate resources are allocated and prevents unnecessary escalation. Once validated, the handler can then determine scope, notify parties, and take containment actions in proper sequence.
Why the other options are wrong
- A. Powering off the system prematurely destroys forensic evidence and should only occur after validation and analysis.
- B. While determining scope is important, validation must come first to confirm an incident actually occurred.
- D. Notification occurs after validation and initial assessment, not as the absolute first step.
Question 274
Which of the following should be an information security manager's FIRST course of action when developing an incident management and response plan?
Show answer and explanation
Correct answer: B. Conduct a gap analysis
A gap analysis is the logical first step when developing an incident management and response plan. It identifies the current state, desired state, and deficiencies in existing incident handling capabilities. This assessment informs what needs to be developed or improved. Reassessing risk appetite, updating risk registers, and revising BCP are subsequent actions that depend on understanding existing gaps.
Why the other options are wrong
- A. Risk appetite assessment should follow gap analysis to understand current capabilities.
- C. Risk register updates should come after understanding gaps in incident management.
- D. BCP revision is a secondary consideration that follows incident plan development.
Question 275
An external security audit has reported multiple instances of control noncompliance. Which of the following is MOST important for the information security manager to communicate to senior management?
Show answer and explanation
Correct answer: A. The impact of noncompliance on the organization's risk profile
The MOST important communication to senior management is the impact of noncompliance on the organization's risk profile. Executive leadership needs to understand the business risk created by the control gaps to make informed decisions about resource allocation and remediation priorities. This connects technical findings to business impact, which is essential for management decision-making.
Why the other options are wrong
- B. An accountability report addresses process but not the critical business impact.
- C. Root cause analysis is helpful for remediation but does not address the risk impact on the organization.
- D. A mitigation plan is valuable but should follow the risk impact assessment, not precede it.
Question 276
Which of the following is the GREATEST benefit of integrating information security program requirements into vendor management?
Show answer and explanation
Correct answer: C. The ability to reduce risk in the supply chain
Integrating security requirements into vendor management directly reduces supply chain risk by ensuring vendors meet security standards, implement necessary controls, and operate in compliance with organizational security expectations. This addresses vulnerabilities introduced through third-party relationships.
Why the other options are wrong
- A. Meeting compliance requirements is a specific outcome, not the greatest benefit overall.
- B. Defining SLAs is a component of vendor management but addresses availability, not primary risk reduction.
- D. Performance improvement is a secondary benefit compared to risk reduction.
Question 277
Which of the following is the PRIMARY driver for determining the classification of application systems?
Show answer and explanation
Correct answer: B. The extent that compromise can affect revenue
The primary driver for classifying application systems is the extent to which compromise can affect the organization's revenue and business operations. This business impact assessment determines the criticality level and appropriate security controls. While cost of repair, regulatory requirements, and access control are all relevant security considerations, they are secondary to understanding the potential business impact of a compromise.
Why the other options are wrong
- A. Cost of repair is a consequence measure, not the primary classification driver
- C. Regulatory requirements affect implementation but don't determine the primary classification basis
- D. Need-to-know access control is an implementation principle, not a classification driver
Question 278
What should a global information security manager do FIRST when informed that a new regulation with significant impact will go into effect soon?
Show answer and explanation
Correct answer: D. Perform a gap analysis.
A gap analysis should be performed first because it establishes what the organization currently has in place versus what the regulation requires, providing a clear roadmap of what needs to be implemented, modified, or enhanced. This foundational assessment prioritizes all subsequent activities, including resource planning and business case development, making it the logical starting point for regulatory response.
Why the other options are wrong
- A. Vulnerability assessment is operational and should follow gap analysis to identify specific technical remediation needs.
- B. BIA is important for understanding impacts but follows gap analysis to know which processes require analysis.
- C. Privacy impact assessment is relevant only if the regulation involves privacy; gap analysis is universally applicable first.
Question 279
An information security manager has identified the organization is not in compliance with new legislation that will soon be in effect. Which of the following is MOST important to consider when determining additional controls to be implemented?
Show answer and explanation
Correct answer: C. The cost of noncompliance
The cost of noncompliance is the most important consideration because it directly impacts the business decision about control implementation. Understanding potential fines, legal liability, reputational damage, and operational impacts from noncompliance allows the organization to make informed decisions about which controls to implement and how to prioritize resources. This business-focused metric drives appropriate control selection.
Why the other options are wrong
- A. Information security strategy guides overall direction but doesn't specifically determine which controls are needed for compliance.
- B. Risk appetite helps determine risk acceptance levels but doesn't directly address compliance obligations.
- D. Security policy documents requirements but doesn't provide the business justification for implementation decisions.
Question 280
The effectiveness of an information security governance framework will BEST be enhanced if:
Show answer and explanation
Correct answer: D. risk management is built into operational and strategic activities
The most effective way to enhance a governance framework is to embed risk management throughout both operational and strategic activities. This ensures that security and risk considerations are woven into decision-making at all organizational levels, creating a sustainable governance structure. While consultant reviews, auditor empowerment, and compliance culture all contribute, building risk management into core business activities is the most foundational enhancement.
Why the other options are wrong
- A. Consultant reviews are external validation but don't fundamentally enhance internal governance.
- B. Auditor empowerment is important but is a component of governance, not the primary enhancement.
- C. Compliance culture is valuable but is secondary to integrating risk management into strategy and operations.
Question 281
Which of the following is a PRIMARY responsibility of the information security governance function?
Show answer and explanation
Correct answer: B. Advising senior management on optimal levels of risk appetite and tolerance
The PRIMARY responsibility of information security governance is strategic, advising senior management on risk appetite and tolerance levels. This is a governance function that sets the tone for the organization's security posture. While options A, C, and D are important security activities, they are tactical or operational responsibilities rather than primary governance functions. Governance focuses on direction-setting and oversight at the executive level.
Why the other options are wrong
- A. Administering awareness training is an operational implementation task, not a primary governance responsibility.
- C. Defining security strategies is important but is secondary to establishing risk appetite and tolerance frameworks.
- D. Supporting emerging technologies is a technical consideration, not a primary governance function.
Question 282
The PRIMARY advantage of performing black-box control tests as opposed to white-box control tests is that they:
Show answer and explanation
Correct answer: C. simulate real-world attacks
Black-box testing simulates real-world attacks by testing systems without knowledge of internal architecture or implementation details, which is exactly how actual attackers operate. This approach tests the system from an external perspective, providing more realistic threat scenarios than white-box testing that requires detailed internal knowledge.
Why the other options are wrong
- A. White-box testing actually requires more IT staff preparation due to the need for code review and architectural understanding.
- B. Black-box and white-box tests identify different threats; white-box may identify more internal vulnerabilities while black-box identifies real-world attack vectors.
- D. Both testing approaches can cause production issues if not carefully managed; this is not a distinguishing advantage.
Question 283
During a security assessment, an information security manager finds a number of security patches were not installed on a server hosting a critical business application. The application owner did not approve the patch installation to avoid interrupting the application. Which of the following should be the information security manager's FIRST course of action?
Show answer and explanation
Correct answer: C. Communicate the potential impact to the application owner.
The information security manager's FIRST course of action should be to communicate the potential impact to the application owner. Before escalating or reporting, the manager must inform the application owner of the specific risks created by missing patches and attempt to work collaboratively toward a solution. This direct communication allows the owner to understand the security exposure and make an informed decision about accepting the risk or approving patch installation.
Why the other options are wrong
- A. Reporting to the steering committee is premature without first engaging the owner directly.
- B. Determining mitigation options should follow communication with the owner about impact.
- D. Escalating to senior management should be a later step if the owner refuses to address the issue.
Question 284
Which of the following BEST enables the deployment of consistent security throughout international branches within a multinational organization?
Show answer and explanation
Correct answer: C. Establishment of security governance
Establishment of security governance creates the framework, policies, standards, and oversight structures needed to ensure consistent security practices across all international branches. Governance provides the centralized direction and accountability mechanisms necessary for consistency in a decentralized multinational environment.
Why the other options are wrong
- A. Remediation addresses past audit findings but doesn't establish the foundational governance needed for consistent deployment across branches.
- B. Decentralization would fragment rather than ensure consistency; the opposite approach is needed.
- D. Maturity of processes is a result of good governance, not the primary enabler of consistent deployment.
Question 285
Which of the following is the MOST effective defense against malicious insiders compromising confidential information?
Show answer and explanation
Correct answer: D. Role-based access control
Role-based access control (RBAC) is the most effective defense against malicious insiders compromising confidential information because it implements the principle of least privilege, ensuring employees only access information necessary for their role. This preventive control actively limits exposure during employment. While background checks and audits help identify risk and detect compromise, and termination procedures address departing employees, RBAC provides continuous, real-time protection against unauthorized access by insiders.
Why the other options are wrong
- A. Audits detect but do not prevent insider compromise.
- B. Background checks occur before employment and cannot prevent current insiders from misusing access.
- C. Termination procedures address only departing employees, not active insiders.
Question 286
Which of the following is the MOST important consideration when reporting on the status of information security activities?
Show answer and explanation
Correct answer: C. The report is tailored to stakeholder needs
The most important consideration when reporting on information security activities is ensuring the report is tailored to stakeholder needs. Different stakeholders (executives, board, operational teams) require different information, levels of detail, and perspectives. Effective communication requires matching content and format to the audience's specific needs and decision-making requirements.
Why the other options are wrong
- A. Comprehensiveness alone is not most important; reports can be comprehensive yet ineffective if not tailored to audience needs.
- B. While regular updates are important, they are secondary to ensuring the content meets stakeholder needs.
- D. Industry standard structure is helpful for consistency but less critical than meeting stakeholder information needs.
Question 287
Which of the following has the GREATEST impact on the viability of an information security roadmap?
Show answer and explanation
Correct answer: B. Management support
Management support has the greatest impact on the viability of an information security roadmap. Without executive buy-in, funding, prioritization, and organizational alignment cannot be achieved, making even well-designed roadmaps impossible to execute. Regulatory requirements, threats, and resources are important constraints, but management support determines whether the organization actually commits to executing the roadmap.
Why the other options are wrong
- A. Regulatory requirements are constraints to consider but don't drive viability if management won't support the roadmap.
- C. Threat landscape informs priorities but cannot drive execution without management commitment.
- D. Resource availability is important but depends on management support to secure those resources.
Question 288
Which of the following provides the MOST comprehensive information related to an organization's current risk profile?
Show answer and explanation
Correct answer: B. Risk register
The risk register provides the most comprehensive information about an organization's current risk profile. It contains identified risks, their likelihood, impact, mitigation strategies, and status, a complete inventory of known risks. While risk assessment results inform the register, gap analysis shows deficiencies, and heat maps visualize data, the risk register itself is the authoritative, comprehensive document that captures the full risk landscape.
Why the other options are wrong
- A. Gap analysis results show specific deficiencies but don't provide a complete risk profile.
- C. Heat maps visualize risk data but are typically a simplified, graphical representation of the register.
- D. Risk assessment results are inputs to the register but don't inherently present the comprehensive current profile.
Question 289
Which of the following has the GREATEST influence on an organization's information security strategy?
Show answer and explanation
Correct answer: C. The organization's risk tolerance
An organization's risk tolerance has the greatest influence on information security strategy because it determines how much risk the organization is willing to accept and therefore shapes the level of investment, control rigor, and acceptance thresholds across all security decisions. Risk tolerance directly translates to strategic priorities and resource allocation.
Why the other options are wrong
- A. Industry standards provide guidance and benchmarks but do not override organizational decision-making authority.
- B. Organizational structure supports strategy execution but does not drive the strategy itself.
- D. Awareness supports implementation but has less foundational influence on strategy than risk tolerance.
Question 290
Which of the following is the MOST effective approach to ensure IT processes are performed in compliance with the information security policies?
Show answer and explanation
Correct answer: A. Ensuring that key controls are embedded in the processes
Embedding key security controls directly into IT processes ensures compliance through technical and procedural design rather than relying on training, awareness, or resource allocation. This approach makes compliance automatic and reduces dependency on human behavior or management oversight. Built-in controls provide consistent enforcement regardless of turnover, training effectiveness, or resource variations.
Why the other options are wrong
- B. Training helps but doesn't guarantee compliance if controls aren't embedded in the actual process design.
- C. Resources are necessary but insufficient without actual control mechanisms embedded in processes.
- D. Risk identification and management is important but less direct than embedding controls into the processes themselves.
Question 291
An organization has just updated its backup capability to a new cloud-based solution. Which of the following tests will MOST effectively verify this change is working as intended?
Show answer and explanation
Correct answer: C. Parallel testing
Parallel testing is MOST effective for verifying a new backup system works correctly because it runs the new cloud-based solution alongside the existing system simultaneously, allowing for direct comparison of results and validation that the new system functions properly before full cutover. This approach minimizes risk and provides concrete evidence of functionality.
Why the other options are wrong
- A. Simulation testing uses models rather than actual systems and doesn't verify real backup/restore operations.
- B. Tabletop testing is discussion-based and theoretical, not a practical verification of system functionality.
- D. Black box testing validates functional behavior without knowledge of internal workings, but parallel testing better validates the backup system's actual recovery capabilities.
Question 292
An event occurred that resulted in the activation of the business continuity plan (BCP). All employees were notified during the event, and they followed the plan. However, two major suppliers missed deadlines because they were not aware of the disruption. What is the BEST way to prevent a similar situation in the future?
Show answer and explanation
Correct answer: C. Perform testing of the BCP communication plan.
The BEST way to prevent suppliers from missing disruption notifications in the future is to perform testing of the BCP communication plan. This directly addresses the identified gap, suppliers weren't notified. Testing the communication plan includes external stakeholders and validates that all necessary parties, including critical suppliers, receive timely notifications during an event.
Why the other options are wrong
- A. Enforcing SLAs addresses performance but doesn't solve the notification problem if suppliers don't know about the disruption.
- B. Vulnerability assessment is unrelated to communication gaps during business continuity events.
- D. Providing the full BCP document to suppliers may overwhelm them; a tested communication plan is more practical and effective.
Question 293
Which of the following BEST demonstrates that an anti-phishing campaign is effective?
Show answer and explanation
Correct answer: B. Decreased number of incidents that have occurred
The best demonstration that an anti-phishing campaign is effective is a decreased number of phishing incidents that have actually occurred. This is the ultimate measure of success, fewer employees falling victim to phishing attacks indicates the campaign has improved awareness and behavior. Incident reduction is the tangible outcome that proves the campaign works in practice.
Why the other options are wrong
- A. Attendance at awareness sessions does not correlate directly with campaign effectiveness or behavior change.
- C. The number of phishing emails received is not controllable by the organization and does not reflect campaign effectiveness.
- D. Feedback on the campaign measures perception, not actual effectiveness in preventing incidents.
Question 294
Which of the following is the BEST indication of a mature information security program?
Show answer and explanation
Correct answer: B. Security incidents are managed properly.
A mature information security program is characterized by proper management and handling of security incidents, which demonstrates effective processes, response capabilities, and continuous improvement. This is the core indicator of maturity because it shows the organization can identify, respond to, and learn from security events. While other metrics like budget management and audit findings may improve, the ability to properly manage incidents indicates foundational maturity across detection, response, and remediation capabilities.
Why the other options are wrong
- A. Budget spending being under budget doesn't indicate maturity; it could indicate underfunding.
- C. Resource optimization is important but is a supporting function rather than the primary indicator of program maturity.
- D. Reduced audit findings may result from maturity but are an outcome, not the core indicator of a mature program.
Question 295
An organization has experienced multiple instances of privileged users misusing their access. Which of the following processes would be MOST helpful in identifying such violations?
Show answer and explanation
Correct answer: D. Log review
Log review is the most direct method to identify actual instances of privileged user misuse. By examining detailed logs of user activities, system access, and commands executed, the organization can detect and document specific violations of policy or unauthorized actions. This provides concrete evidence of misconduct.
Why the other options are wrong
- A. Policy exception review addresses approved deviations, not unauthorized misuse.
- B. Access control review evaluates configurations, not actual usage violations.
- C. Security assessments are broad evaluations, not targeted detection of specific violations.
Question 296
An organization has established a bring your own device (BYOD) program. Which of the following is the MOST important security consideration when allowing employees to use personal devices for corporate applications remotely?
Show answer and explanation
Correct answer: A. Mandatory controls for maintaining security policy
Mandatory controls for maintaining security policy are the most important consideration for BYOD programs because they enforce organizational security requirements regardless of device type or ownership. Without mandatory technical and administrative controls, personal devices represent an uncontrolled security risk. Operating system support, awareness training, and secure development are secondary to establishing and enforcing baseline security controls that protect corporate data.
Why the other options are wrong
- B. OS support is a technical requirement but does not enforce security policies
- C. Awareness training is necessary but insufficient without technical controls
- D. Development practices are important but not the primary BYOD consideration
Question 297
Which of the following BEST prepares a computer incident response team for a variety of information security scenarios?
Show answer and explanation
Correct answer: A. Tabletop exercises
Tabletop exercises are the best method to prepare incident response teams for a variety of scenarios. They simulate realistic security incidents in a controlled environment, allowing teams to practice procedures, identify gaps, and improve coordination without the costs and risks of live drills or penetration tests.
Why the other options are wrong
- B. Forensics certification develops individual expertise but doesn't prepare the team for varied scenarios.
- C. Penetration tests validate security defenses but don't specifically prepare the response team for incident handling.
- D. Disaster recovery drills focus on business continuity, not incident response team preparedness.
Question 298
Which of the following BEST facilitates the effective execution of an incident response plan?
Show answer and explanation
Correct answer: D. The response team is trained on the plan.
A response team trained on the plan is the most critical factor for effective incident response execution. Even a well-designed plan is ineffective if the team doesn't understand it, practice it, or know their roles and responsibilities. Training ensures team members can quickly and correctly execute the plan during an actual incident when stress and time pressure are factors. Without training, knowledge gaps will cause delays and errors regardless of plan quality.
Why the other options are wrong
- A. Industry best practice supports good design but doesn't ensure the team can execute it.
- B. Alignment with DRP is important for coordination but doesn't ensure the incident response team knows how to execute their plan.
- C. Risk assessment results inform the plan scope but don't ensure effective execution by the response team.
Question 299
When collecting admissible evidence, which of the following is the MOST important requirement?
Show answer and explanation
Correct answer: C. Chain of custody
Chain of custody is the most important requirement when collecting admissible evidence. Chain of custody establishes the documented, unbroken record of evidence handling from collection through presentation, which is essential for evidence to be admissible in legal or formal proceedings. Without proper chain of custody, evidence can be challenged as potentially tampered with, contaminated, or unreliable, rendering it inadmissible regardless of its actual relevance. The other options are important but secondary to this fundamental requirement.
Why the other options are wrong
- A. Need to know determines access to information but is not the primary requirement for evidence admissibility.
- B. Due diligence is a general principle but does not specifically address the mechanics of maintaining admissible evidence.
- D. Preserving audit logs is part of evidence handling but is subordinate to the overall chain of custody requirement.
Question 300
Which of the following is the BEST method for determining whether a firewall has been configured to provide a comprehensive perimeter defense?
Show answer and explanation
Correct answer: C. A validation of the current firewall rule set
Validating the current firewall rule set is the best method for determining comprehensive perimeter defense. A thorough review of the rule set ensures all necessary ports are properly controlled, policies are correctly implemented, and rules align with security requirements. This systematic approach addresses configuration comprehensiveness better than testing methods, which may miss issues or be incomplete.
Why the other options are wrong
- A. Port scans test current state but do not validate whether configuration is comprehensive or intentional.
- B. DoS testing assesses performance under attack but does not validate rule comprehensiveness.
- D. Ping tests are too basic and do not reveal whether firewall rules provide comprehensive defense.
Question 301
Which of the following is the MAIN objective of a risk management program?
Show answer and explanation
Correct answer: B. Reduce risk to the level of the organization's risk appetite
The main objective of a risk management program is to reduce risk to the level of the organization's risk appetite (or risk tolerance). Risk management is not about eliminating all risk, that's impractical and unnecessary, but rather managing it to align with what the organization is willing to accept. This balanced approach enables business operations while maintaining acceptable risk levels.
Why the other options are wrong
- A. Liability reduction is a benefit but not the primary objective of risk management.
- C. Reducing risk to maximum extent possible is unrealistic and conflicts with business objectives.
- D. Incident response costs are secondary; risk management focuses on risk optimization, not just cost reduction.
Question 302
An organization is conducting a post-incident review to determine the root cause of an information security incident. Which of the following situations would be MOST harmful to this investigation?
Show answer and explanation
Correct answer: C. Systems logs were cleared by the administrator to free up space on the affected systems.
Cleared system logs destroy critical evidence needed to conduct root cause analysis and determine how the incident occurred. This makes investigation impossible and is the most harmful situation. While unencrypted logs and failed antivirus updates are suboptimal, they still preserve evidence. An outdated incident response plan doesn't destroy existing evidence.
Why the other options are wrong
- A. Unencrypted logs on tape are undesirable but the evidence still exists.
- B. Failed antivirus updates are a security issue but preserve evidence for analysis.
- D. An outdated plan is a process problem, not an evidence destruction problem.
Question 303
The PRIMARY reason for using metrics as part of an information security program is to help management:
Show answer and explanation
Correct answer: A. determine whether objectives are being met.
The primary purpose of metrics is to determine whether security program objectives are being met. Metrics provide measurable evidence of progress toward goals and enable management to assess program effectiveness and ROI. This is the fundamental reason organizations use metrics, to evaluate success and guide decision-making.
Why the other options are wrong
- B. Visualizing trends is a secondary benefit of metrics, not the primary purpose.
- C. Baselines are established before metrics are used; metrics measure progress against baselines.
- D. Tracking financial impact is one type of metric but not the primary reason for using metrics overall.
Question 304
To prevent ransomware attacks, it is MOST important to ensure:
Show answer and explanation
Correct answer: A. adequate backup and restoration processes are in place.
Adequate backup and restoration processes are the most critical safeguard against ransomware attacks because they provide recovery capability if infection occurs. Even if an attacker encrypts data, reliable backups allow the organization to restore systems without paying ransom. While awareness training, security appliances, and firewalls help prevent infection, they cannot guarantee prevention. Backups provide the essential safety net that makes ransomware attacks survivable regardless of prevention effectiveness.
Why the other options are wrong
- B. Awareness training reduces but cannot eliminate ransomware risk, as sophisticated attacks bypass user vigilance.
- C. Security appliances provide detection and prevention capabilities but cannot guarantee stopping all ransomware attacks.
- D. Updated firewalls help prevent external access but cannot stop ransomware delivered through email or other vectors.
Question 305
Which of the following is the BEST way for an organization to determine the maturity level of its information security program?
Show answer and explanation
Correct answer: B. Validate the effectiveness of implemented security controls.
Validating the effectiveness of implemented security controls provides the most direct measurement of maturity because it determines whether controls are actually achieving their intended outcomes. Maturity is demonstrated through control effectiveness rather than awareness scores, policy alignment, or incident trends. Effective controls indicate a mature program; ineffective controls indicate gaps regardless of other metrics.
Why the other options are wrong
- A. Awareness testing indicates training effectiveness but does not measure whether security controls are working as intended.
- C. Policy alignment with standards shows compliance with best practices but does not validate that implemented controls are actually effective.
- D. Incident trending shows historical outcomes but is a lagging indicator; control effectiveness is a more direct measure of program maturity.
Question 306
The MAIN purpose of influenced by a business impact guideline for use within a large, international organization is to:
Show answer and explanation
Correct answer: B. ensure that all business units have the same strategic security goals.
The main purpose of security guidelines in a large, international organization is to ensure that all business units have the same strategic security goals, providing alignment and consistency across the enterprise while allowing flexibility in implementation. Guidelines establish what security objectives must be achieved, whereas procedures specify how to achieve them. This approach allows different business units to adapt implementation to local contexts and regulations while maintaining unified security posture and objectives.
Why the other options are wrong
- A. Preferred practices are too prescriptive; guidelines should establish goals, not mandate specific practices.
- C. Identical procedures are inappropriate for international organizations with different regulatory and cultural contexts.
- D. While evidence for auditors is a benefit, it is not the main purpose of guidelines.
Question 307
What should be the FIRST step when implementing data loss prevention (DLP) technology?
Show answer and explanation
Correct answer: C. Classify the organization's data
Data classification is the foundational first step before implementing DLP technology. Without understanding what data exists, where it resides, and how sensitive it is, an organization cannot effectively configure DLP policies or determine which controls are needed. Business cases, vendor due diligence, and cost-benefit analyses all depend on having classified data first.
Why the other options are wrong
- A. A business case requires understanding of data assets and their value, which comes after classification.
- B. Vendor evaluation should occur after understanding requirements, which stem from data classification.
- D. Cost-benefit analysis cannot be performed without knowing what data needs protection and associated risks.
Question 308
The PRIMARY objective of a risk response strategy should be:
Show answer and explanation
Correct answer: C. appropriate control selection.
The primary objective of a risk response strategy is to select appropriate controls that will mitigate identified risks to acceptable levels. While threat reduction, management buy-in, and compliance are all important considerations, appropriate control selection is the core purpose of risk response planning, ensuring risks are addressed effectively and efficiently.
Why the other options are wrong
- A. Threat reduction is a consequence of control implementation, not the primary objective of strategy selection.
- B. Management buy-in is necessary for implementation success but not the primary objective of response strategy.
- D. Regulatory compliance is one driver but not the primary objective of risk response strategy.
Question 309
Which of the following would BEST support an information security manager's efforts to obtain management approval for an identity and access management (IAM) system implementation?
Show answer and explanation
Correct answer: D. A business case proposal for the solution
A business case proposal is the most effective tool for obtaining management approval because it articulates the investment in terms executives understand: business benefits, costs, ROI, and alignment with organizational strategy. While security incidents, policies, and audit findings provide justification context, the business case synthesizes this evidence into a persuasive, decision-ready document that demonstrates why the investment should be made from a business perspective.
Why the other options are wrong
- A. A recent incident provides motivation but lacks the comprehensive business analysis needed to justify a major technology investment.
- B. An established policy shows requirements but does not make the business case for why this specific solution should be purchased now.
- C. An audit finding identifies compliance gaps but is insufficient alone to secure approval without demonstrating business value and implementation logistics.
Question 310
Which of the following BEST enables effective information security governance?
Show answer and explanation
Correct answer: A. Security-aware corporate culture
A security-aware corporate culture is the foundation that enables effective information security governance. Without cultural awareness and buy-in across the organization, even the best technologies, metrics, and assessments will fail to achieve their objectives. Culture drives behavior, compliance, and support for security initiatives, making it the most enabling factor for governance effectiveness.
Why the other options are wrong
- B. Advanced technologies are tools that support governance but cannot substitute for cultural understanding and commitment.
- C. Vulnerability assessments are tactical security activities that feed into governance but do not enable it.
- D. Security metrics measure governance effectiveness but are not what enable governance to function in the first place.
Question 311
Which of the following should be of MOST concern to an information security manager reviewing the organization’s disaster recovery plan (DRP)?
Show answer and explanation
Correct answer: D. The response plan document has not been updated with the latest notification list details.
An outdated notification list directly impacts the ability to execute the disaster recovery plan effectively. If key personnel cannot be reached due to incorrect contact information, the response will fail at the critical first stage. This is an immediate operational deficiency that must be corrected before any disaster occurs.
Why the other options are wrong
- A. Training is important but can be conducted and repeated; lack of training does not immediately prevent plan execution.
- B. Using external consultants for testing is a valid approach and does not indicate a plan deficiency.
- C. While six months without testing is a concern, this is still within acceptable intervals for some organizations and is less critical than inability to contact the team.
Question 312
Which of the following is the MOST effective way to protect the authenticity of data in transit?
Show answer and explanation
Correct answer: A. Digital signature
A digital signature is the most effective mechanism for protecting data authenticity in transit because it provides both authentication (proves who sent it) and non-repudiation (sender cannot deny sending it). Digital signatures use private keys to sign data, allowing recipients to verify authenticity with the public key. Hash values alone don't prove authenticity without signing, and keys alone don't authenticate data.
Why the other options are wrong
- B. Hash values alone provide integrity detection but not authentication of origin.
- C. Private keys are components of digital signatures but don't authenticate data by themselves.
- D. Public keys are used to verify signatures but don't themselves protect authenticity.
That was 312 of 1,250.
The full ISACA CISM pack has all 1,250 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 625 free as one PDF by email. Get the Half Pack →