cciso-4

Which of the following is the main reason to follow a formal risk management process in an organization that hosts and uses privately identifiable information (PII) as part of its business models and processes?

• Need to comply with breach disclosure laws

• Fiduciary responsibility to safeguard credit information

• Need to transfer the risk associated with hosting PII data

• Need to better understand the risk associated with using PII data

Which is the most important benefit of an effective security governance process?

• Senior management participation in the incident response process

• Better vendor management

• Reduction of security breaches

• Reduction of liability and overall risk to the organization

What is the main purpose of the Incident Response Team?

• Communicate details of information security incidents

• Create effective policies detailing program activities

• Ensure efficient recovery and reinstate repaired systems

• Provide effective employee awareness programs

When project costs continually increase throughout implementation due to large or rapid changes in customer or user requirements, this is commonly known as:

• Prototype issues

• Cost/benefit adjustments

• Scope creep

• Expectations management

An organization has decided to address information security formally and consistently by adopting established best practices and industry standards. The organization is a small retail merchant, but it is expected to grow to a global customer base of many millions of customers in just a few years. The organization has already been subject to a significant amount of credit card fraud. Which of the following is the most likely reason for this fraud?

• Ineffective security awareness program

• Lack of technical controls when dealing with credit card data

• Lack of compliance to the Payment Card Industry (PCI) standards

• Security practices not in alignment with ISO 27000 frameworks

Which of the following information would most likely be reported at the board level within an organization?

• Significant risks and security incidents that have been discovered since the last assembly of the
  membership

• The numbers and types of cyberattacks experienced by the organization since the last
  assembly of the membership

• System scanning trends and results as they pertain to insider and external threat sources

• The capabilities of a security program in terms of staffing support

A CISO has implemented a risk management capability within the security portfolio. Which of the following terms best describes this functionality?

• Service

• Program

• Cost center

• Portfolio

You work as a project manager and are planning for risk mitigation. You need to quickly identify high-level risks that will need more in-depth analysis. Which one of the following approaches would you use?

• Risk mitigation

• Estimate activity duration

• Quantitative analysis

• Qualitative analysis

Which of the following are primary concerns for management about assessing internal control objectives?

• Communication, Reliability, Cost

• Confidentiality, Compliance, Cost

• Confidentiality, Availability, Integrity

• Compliance, Effectiveness, Efficiency

The security team has investigated the theft/loss of several unencrypted laptop computers containing sensitive corporate information. To prevent the loss of any additional corporate data, it is unilaterally decided by the CISO that all existing and future laptop computers will be encrypted. The help desk is then flooded with complaints about the slow performance of the laptops and users are upset. Which of the following best describes what the CISO did wrong?

• Used 1024 bit encryption when 256 bit would have sufficed

• Used hardware encryption instead of software encryption

• Failed to identify all stakeholders and their needs

• Deployed the encryption solution in an inadequate manner