QUESTION 161
Which of the following is considered one of the most frequent failures in project management?

QUESTION 162
Which of the following functions evaluates patches used to close software vulnerabilities and perform validation of new systems to assure compliance with security?

QUESTION 163
A global health insurance company is concerned about protecting confidential information. Which of the following is of MOST concern to this organization?

QUESTION 164
Which of the following should be determined while defining risk management strategies?

QUESTION 165
How often should the Statements of Standards for Attestation Engagements-16 (SSAE16)/International Standard on Assurance Engagements 3402 (ISAE3402) report of your vendors be reviewed?

QUESTION 166
A CISO has recently joined an organization with a poorly implemented security program. The desire is to base the security program on a risk management approach. Which of the following is a foundational requirement in order to initiate this type of program?

QUESTION 167
One of your executives needs to send an important and confidential email. You want to ensure that the message cannot be read by anyone but the recipient.
Which of the following keys should be used to encrypt the message?

QUESTION 168
SCENARIO: Critical servers show signs of erratic behavior within your organization’s intranet. Initial information indicates the systems are under attack from an outside entity. As the Chief Information Security Officer (CISO), you decide to deploy the Incident Response Team (IRT) to determine the details of this incident and take action according to the information available to the team.
In what phase of the response will the team extract information from the affected systems without altering original data?

QUESTION 169
The process for management approval of the security certification process which states the risks and mitigation of such risks of a given IT system is called___________________.

QUESTION 170
Which of the following is a symmetric encryption algorithm?

QUESTION 171
Which of the following is a benefit of a risk-based approach to audit planning?

QUESTION 172
An employee successfully avoids becoming a victim of a sophisticated spear phishing attack due to knowledge gained through the corporate information security awareness program. What type of control has been effectively utilized?

QUESTION 173
An organization is looking for a framework to measure the efficiency and effectiveness of their Information Security Management System. Which of the following international standards can BEST assist this organization?

QUESTION 174
The process for management approval of the security certification process which states the risks and mitigation of such risks of a given IT system is called

QUESTION 175
Scenario: You are the newly hired Chief Information Security Officer for a company that has not previously had a senior level security practitioner. The company lacks a defined security policy and framework for their Information Security Program. Your new boss, the Chief Financial Officer, has asked you to draft an outline of a security policy and recommend an industry/sector neutral information security control framework for implementation.
Which of the following industry / sector neutral information security control frameworks should you recommend for implementation?

QUESTION 176
Step-by-step procedures to regain normalcy in the event of a major earthquake is PRIMARILY covered by which of the following plans?

QUESTION 177
Scenario: Your organization employs single sign-on (user name and password only) as a convenience to your employees to access organizational systems and data. Permission to individual systems and databases is vetted and approved through supervisors and data owners to ensure that only approved personnel can use particular applications or retrieve information. All employees have access to their own human resource information, including the ability to change their bank routing and account information and other personal details through the Employee Self-Service application. All employees have access to the organizational VPN.
What type of control is being implemented by supervisors and data owners?

QUESTION 178
When dealing with a risk management process, asset classification is important because it will impact the overall:

QUESTION 179
An international organization is planning a project to implement encryption technologies to protect company confidential information. This organization has data centers on three continents. Which of the following would be considered a MAJOR constraint for the project?

QUESTION 180
Creating a secondary authentication process for network access would be an example of?

QUESTION 181
You are just hired as the new CISO and are being briefed on all the Information Security projects that your section has on going. You discover that most projects are behind schedule and over budget.
Using the best business practices for project management you determine that the project correct aligns with the company goals. What needs to be verified FIRST?