CISSP Domain 1

All of the following items should be included in a Business Impact Analysis (BIA) questionnaire EXCEPT questions that

• determine the risk of a business interruption occurring

• determine the technological dependence of the business processes

• Identify the operational impacts of a business interruption

• Identify the financial impacts of a business interruption

Which of the following represents the GREATEST risk to data confidentiality?

• Network redundancies are not implemented

• Security awareness training is not completed

• Backup tapes are generated unencrypted

• Users have administrative privileges

A While investigating a malicious event, only six days of audit logs from the last month were available. Whatpolicy should be updated to address this problem

• Retention

• Reporting

• Recovery

• Remediation

When assessing an organization’s security policy according to standards established by the International Organization for Standardization (ISO) 27001 and 27002, when can management responsibilities be defined?

• Only when assets are clearly defined

• Only when standards are defined

• Only when controls are put in place

• Only procedures are defined

An important principle of defense in depth is that achieving information security requires a balanced focus on which PRIMARY elements?

• Development, testing, and deployment

• Prevention, detection, and remediation

• People, technology, and operations

• Certification, accreditation, and monitoring

A control to protect from a Denial-of-Service (DoS) attach has been determined to stop 50% of attacks, and additionally reduces the impact of an attack by 50%. What is the residual risk?

• 25%

• 50%

• 75%

• 100%

Which of the following entails identification of data and links to business processes, applications, and data stores as well as assignment of ownership responsibilities?

• Security Governance

• Risk Management

• Security Portfolio Management

• Risk Assessment

Which of the following mandates the amount and complexity of security controls applied to a security risk?

• Security Vulnerability

• Risk Tolerate

• Risk Mitigation

• Security Staff

A security professional determines that a number of outsourcing contracts inherited from a previous merger do not adhere to the current security requirements. Which of the following BEST minimizes the risk of this happening again?

• Define additional security controls directly after the merger

• Include a procurement officer in the merger team

• Verify all contracts before a merger occurs

• Assign a compliancy officer to review the merger conditions

Which of the following is a direct monetary cost of a security incident?

• Morale

• Reputation

• Equipment

• Information