As a new CISO at a large healthcare company you are told that everyone has to badge in to get in the building. Below your office window you notice a door that is normally propped open during the day for groups of people to take breaks outside. Upon looking closer you see there is no badge reader. What should you do?
Control Objectives for Information and Related Technology (COBIT) is which of the following?
Access Control lists (ACLs), Firewalls, and Intrusion Prevention Systems are examples of
What is the BEST practice for having vendors verify controls within their services or products to protect customer data and systems?
A CISO wants to change the defense strategy to ward off attackers. To accomplish this the CISO is looking to a strategy where attackers are lured into a zone of a safe network where attackers can be monitored, controlled, quarantined, or eradicated.
Most of your security projects are behind schedule and over budget, but they align with the security program goals and are correctly scoped. What should you do next?
Your IT auditor is reviewing significant events from the previous year and has identified some procedural oversights. Which of the following would be the MOST concerning?
A new CISO just started with a company and on the CISO's desk is the last complete Information Security Management audit report. The audit report is over two years old. After reading it, what should be the CISO's FIRST priority?
Step-by-step procedures to regain normalcy in the event of a major earthquake is PRIMARILY covered by which of the following plans?
Which of the following represents the BEST reason for an organization to use the Control Objectives for Information and Related Technology (COBIT) as an Information Technology (IT) framework?
Your company has a “no right to privacy” notice on all logon screens for your information systems and users sign an Acceptable Use Policy informing them of this condition. A peer group member and friend comes to you and requests access to one of her employee’s email account. What should you do? (choose the BEST answer):
Risk appetite directly affects what part of a vulnerability management program?
The security team has investigated the theft/loss of several unencrypted laptop computers containing sensitive corporate information. To prevent the loss of any additional corporate data it is unilaterally decided by the CISO that all existing and future laptop computers will be encrypted. Soon, the help desk is flooded with complaints about the slow performance of the laptops and users are upset. What did the CISO do wrong? (choose the BEST answer):
An application vulnerability assessment has identified a security flaw in an application. This is a flaw that was previously identified and remediated on a prior release of the application. Which of the following is MOST likely the reason for this recurring issue?
Which of the following controls is MOST critical for protecting Artificial Intelligence (AI) systems?
What is the name of a formal statement that defines the strategy, approach, or expectations related to specific concerns within an organization:
If a Virtual Machine’s (VM) data is being replicated and that data is corrupted, this corruption will automatically
be replicated to the other machine(s). What would be the BEST control to safeguard data integrity?
The alerting, monitoring and life-cycle management of security related events is typically handled by the
The BEST organization to provide a comprehensive, independent and certifiable perspective on established security controls in an environment is
The organization does not have the time to remediate the vulnerability; however it is critical to release the application. Which of the following needs to be further evaluated to help mitigate the risks?
Which of the following methods are used to define contractual obligations that force a vendor to meet customer expectations?
Which of the following is the MOST important to share with an Information Security Steering Committee:
Which of the following tests is an IS auditor performing when a sample of programs is selected to determine if the source and object versions are the same?
If your organization operates under a model of "assumption of breach", you should:
What type of document defines the strategy, approach, and expectations within an organization?
SCENARIO: Critical servers show signs of erratic behavior within your organization’s intranet. Initial information indicates the systems are under attack from an outside entity. As the Chief Information Security Officer (CISO), you decide to deploy the Incident Response Team (IRT) to determine the details of this incident and take action according to the information available to the team.
In what phase of the response will the team extract information from the affected systems without altering original data?
What can you do to assist with law enforcement investigations if someone on your guest wireless network is suspected of committing an illegal act using your network?
Which of the following is the MOST important for a CISO to understand when identifying threats?
Which of the following represents the BEST method for obtaining business unit acceptance of security controls within an organization?
Which of the following MOST heavily influences the information security governance model?
The MOST common method to get an unbiased measurement of the effectiveness of an Information Security Management System (ISMS) is to
When entering into a third party vendor agreement for security services, at what point in the process is it BEST to understand and validate the security posture and compliance level of the vendor?
Who is responsible for oversight of an information security program within an organization?
What are the four groups that are critical to the success of evaluating and approving contracts during the negotiation phase?
Which of the following can the company implement in order to avoid this type of security issue in the future?
Which International Organization for Standardization (ISO) below BEST describes the performance of risk management, and includes a five-stage risk management methodology.
ABC Limited has recently suffered a security breach with customers’ social security number available on the dark web for sale. The CISO, during the time of the incident, has been fired, and you have been hired as the replacement. The analysis of the breach found that the absence of an insider threat program, lack of least privilege policy, and weak access control was to blame. You would like to implement key performance indicators to mitigate the risk.
Which metric would meet the requirement?
When a CISO considers delaying or not remediating system vulnerabilities which of the following are MOST important to take into account?
Which of the following is the MAIN security concern for public cloud computing?
Which of the following is the MOST important component of any change management process?
Optical biometric recognition such as retina scanning provides access to facilities through reading the unique characteristics of a person’s eye.
However, authorization failures can occur with individuals who have?
An organization has a stated requirement to block certain traffic on networks. The implementation of controls will disrupt a manufacturing process and cause unacceptable delays, resulting in sever revenue disruptions. Which of the following is MOST likely to be responsible for accepting the risk until mitigating controls can be implemented?
A vendor delivering services refuses to make changes to work that is unsatisfactory and resulted in a failed quality test. Which of the following is the BEST course of action?
What should an organization do to ensure that they have an effective Business Continuity Plan?
An organization has a number of Local Area Networks (LANs) linked to form a single Wide Area Network
(WAN). Which of the following would BEST ensure network continuity?
Ciphertext is encrypted with a result being a compressed representation of the original data. What is this result called?
Physical security measures typically include which of the following components?
To make sure that the actions of all employees, applications, and systems follow the organization’s rules and regulations can BEST be described as which of the following?
Which of the following is considered one of the most frequent failures in project management?
You have recently drafted a revised information security policy. From whom should you seek endorsement in order to have the GREATEST chance for adoption and implementation throughout the entire organization?
Which of the following set of processes is considered to be one of the cornerstone cycles of the International Organization for Standardization (ISO) 27001 standard?
During a cyber incident, which of the following non-security personnel will MOST likely be required to assist the incident response team?
A security manager regualrly checks work areas after buisness hours for security violations; such as unsecured files or unattended computers with active sessions. This activity BEST demonstrates what part of a security program?
Providing oversight of a comprehensive information security program for the entire organization is the primary responsibility of which group under the InfoSec governance framework?
The Health Insurance Portability and Accountability Act (HIPAA) requires an agreement between Cloud Service Providers (CCSP) and the covered entity. Based on HIPAA. which document must be completed between the covered entity and the CCSP?
A CISO has recently joined an organization with a poorly implemented security program. The desire is to base the security program on a risk management approach. Which of the following is a foundational requirement in order to initiate this type of program?
In defining a strategic security plan for an organization, what should a CISO first analyze?
Scenario: Most industries require compliance with multiple government regulations and/or industry standards to meet data protection and privacy mandates.
What is one proven method to account for common elements found within separate regulations and/or standards?
An auditor is reviewing the security classifications for a group of assets and finds that many of the assets are not correctly classified.
What should the auditor’s NEXT step be?
An organization’s firewall technology needs replaced. A specific technology has been selected that is less costly than others and lacking in some important capabilities. The security officer has voiced concerns about sensitive data breaches but the decision is made to purchase. What does this selection indicate?
Which of the following is the PRIMARY purpose of International Organization for Standardization (ISO) 27001?
The effectiveness of social engineering penetration testing using phishing can be used as a Key Performance Indicator (KPI) for the effectiveness of an organization’s
Simon had all his systems administrators implement hardware and software firewalls to ensure network
security. They implemented IDS/IPS systems throughout the network to check for and stop any unauthorized
traffic that may attempt to enter. Although Simon and his administrators believed they were secure, a hacker
group was able to get into the network and modify files hosted on the company's website. After searching
through the firewall and server logs, no one could find how the attackers were able to get in. He decides that
the entire network needs to be monitored for critical and essential file changes. This monitoring tool alerts
administrators when a critical file is altered. What tool could Simon and his administrators implement to
accomplish this?
When information security falls under the Chief Information Officer (CIO), what is their MOST essential role?
Scenario: You are the CISO and have just completed your first risk assessment for your organization. You find many risks with no security controls, and some risks with inadequate controls. You assign work to your staff to create or adjust existing security controls to ensure they are adequate for risk mitigation needs.
You have identified potential solutions for all of your risks that do not have security controls. What is the NEXT step?
Which of the following provides an independent assessment of a vendor’s internal security controls and overall posture?
An IT auditor has recently discovered that because of a shortage of skilled operations personnel, the security administrator has agreed to work one late night shift a week as the senior computer operator. The most appropriate course of action for the IT auditor is to:
During the 3rd quarter of a budget cycle, the CISO noticed she spent more than was originally planned in her
annual budget. What is the condition of her current budgetary posture?
Which of the following terms is used to describe the estimate of all direct and indirect costs associated with an asset or acquisition over its entire life cycle?
According to the National Institute of Standards and Technology (NIST) SP 800-40, which of the following considerations are MOST important when creating a vulnerability management program?
When dealing with a risk management process, asset classification is important because it will impact the overall:
Acceptable levels of information security risk tolerance in an organization should be determined by?
Which of the following best describes an access control process that confirms the identity of the entity seeking
access to a logical or physical area?
The executive board has requested that the CISO of an organization define and Key Performance Indicators (KPI) to measure the effectiveness of the security awareness program provided to call center employees. Which of the following can be used as a KPI?
In MOST organizations which group periodically reviews network intrusion detection system logs for all systems as part of their daily tasks?
Which of the following is the MOST effective method to measure the effectiveness of security controls in a perimeter network?
Which of the following international standards can be BEST used to define a Risk Management process in an organization?
What are the security features that control how users and systems communicate and interact with other systems and resources?
Scenario: Your organization employs single sign-on (user name and password only) as a convenience to your employees to access organizational systems and data. Permission to individual systems and databases is vetted and approved through supervisors and data owners to ensure that only approved personnel can use particular applications or retrieve information. All employees have access to their own human resource information, including the ability to change their bank routing and account information and other personal details through the Employee Self-Service application. All employees have access to the organizational VPN.
What type of control is being implemented by supervisors and data owners?
What is the BEST way to achieve on-going compliance monitoring in an organization?
SCENARIO: A CISO has several two-factor authentication systems under review and selects the one that is most sufficient and least costly. The implementation project planning is completed and the teams are ready to implement the solution. The CISO then discovers that the product it is not as scalable as originally thought and will not fit the organization’s needs.
The CISO is unsure of the information provided and orders a vendor proof of concept to validate the system’s scalability. This demonstrates which of the following?
Scenario: You are the CISO and have just completed your first risk assessment for your organization. You find many risks with no security controls, and some risks with inadequate controls. You assign work to your staff to create or adjust existing security controls to ensure they are adequate for risk mitigation needs.
When adjusting the controls to mitigate the risks, how often should the CISO perform an audit to verify the controls?
Which of the following statements below regarding Key Performance indicators (KPIs) are true?
Security related breaches are assessed and contained through which of the following?
One of your executives needs to send an important and confidential email. You want to ensure that the message cannot be read by anyone but the recipient. Which of the following keys should be used to encrypt the message?
Scenario: You are the newly hired Chief Information Security Officer for a company that has not previously had a senior level security practitioner. The company lacks a defined security policy and framework for their Information Security Program. Your new boss, the Chief Financial Officer, has asked you to draft an outline of a security policy and recommend an industry/sector neutral information security control framework for implementation.
Which of the following industry / sector neutral information security control frameworks should you recommend for implementation?
When obtaining new products and services, why is it essential to collaborate with lawyers, IT security professionals, privacy professionals, security engineers, suppliers, and others?
Scenario: An organization has made a decision to address Information Security formally and consistently by adopting established best practices and industry standards. The organization is a small retail merchant but it is expected to grow to a global customer base of many millions of customers in just a few years.
This global retail company is expected to accept credit card payments. Which of the following is of MOST concern when defining a security program for this organization?
Which of the following metrics would be MOST effective for measuring the effectiveness of a newly implemented change control process?
Your company has limited resources to spend on security initiatives. The Chief Financial Officer asks you to prioritize the protection of information resources based on their value to the company. It is essential that you be able to communicate in language that your fellow executives will understand. You should:
Which of the following would provide a view into the current liabilities of a company?
What is an approach to estimating the strengths and weaknesses of alternatives used to determine options, which provide the BEST approach to achieving benefits while preserving savings called?
A security manager has created a risk program. Which of the following is a critical part of ensuring the program is successful?
What framework of rules and practices is used by a Board of Directors to provide accountability, fairness, and transparency in the organization’s interactions with its shareholders?
The Security Operations Center (SOC) just purchased a new intrusion prevention system (IPS) that needs to be deployed in-line for best defense. The IT group is concerned about putting the new IPS in-line because it might negatively impact network availability. What would be the BEST approach for the CISO to reassure the IT group?
Which of the following is the BEST solution to monitor, measure, and report changes to critical data in a system or repository?
What would be the MOST likely reason a CISO sees abnormally high volumes of security exceptions within a number of business functions?
Scenario: An organization has made a decision to address Information Security formally and consistently by adopting established best practices and industry standards. The organization is a small retail merchant but it is expected to grow to a global customer base of many millions of customers in just a few years.
The organization has already been subject to a significant amount of credit card fraud. Which of the following is the MOST likely reason for this fraud?
Of the following, what is the MOST significant factor to consider when an organization retains sensitive customer data and leverages it to enhance the marketing of the organization’s products and services?
Which of the following is a critical operational component of an Incident Response Program (IRP)?
What is defined as the friction or opposition resulting from actual or perceived differences or incompatibilities?
Which of the following is a PRIMARY task of a risk management function within the security program?
A Chief Information Security Officer received a list of high, medium, and low impact audit findings. Which of the following represents the BEST course of action?
Which of the following best describes the sensors designed to project and detect a light beam across an area?
Scenario: Your company has many encrypted telecommunications links for their world-wide operations. Physically distributing symmetric keys to all locations has proven to be administratively burdensome, but symmetric keys are preferred to other alternatives.
How can you reduce the administrative burden of distributing symmetric keys for your employer?
Scenario: Your organization employs single sign-on (user name and password only) as a convenience to your employees to access organizational systems and data. Permission to individual systems and databases is vetted and approved through supervisors and data owners to ensure that only approved personnel can use particular applications or retrieve information. All employees have access to their own human resource information, including the ability to change their bank routing and account information and other personal details through the Employee Self-Service application. All employees have access to the organizational VPN.
Once supervisors and data owners have approved requests, information system administrators will implement
As the Chief Information Security Officer, you are performing an assessment of security posture to understand
what your Defense-in-Depth capabilities are. Which network security technology examines network traffic flows
to detect and actively stop vulnerability exploits and attacks?
Why is it crucial to engage legal assistance when acquiring new products and services?
From an information security perspective, information that no longer supports the main purpose of the business should be:
When measuring the effectiveness of an Information Security Management System which one of the following would be MOST LIKELY used as a metric framework?
Of the following, what is the FIRST step when developing an information security program?
Which of the following is the MOST important benefit of an effective security governance process?
When deploying an Intrusion Prevention System (IPS) the BEST way to get maximum protection from the system is to deploy it
A recommended method to document the respective roles of groups and individuals for a given process is to:
You are the CISO of a commercial social media organization. The leadership wants to rapidly create new methods of sharing customer data through creative linkages with mobile devices. You have voiced concern about privacy regulations but the velocity of the business is given priority. Which of the following BEST describes this organization?
After a risk assessment is performed, a particular risk is considered to have the potential of costing the organization 1.2 Million USD. This is an example of
Which of the following conditions would be the MOST probable reason for a security project to be rejected by the executive board of an organization?
Risk appetite is typically determined by which of the following organizational functions?
When working in the Payment Card Industry (PCI), how often should security logs be review to comply with the standards?
What is the MOST important result of the management response within the audit process?
Which control is used to discourage the exploitation of a vulnerability or system?
The single most important consideration to make when developing your security program, policies, and processes is:
As a CISO you need to understand the steps that are used to perform an attack against a network. Put each step into the correct order.
1.Covering tracks
2.Scanning and enumeration
3.Maintaining Access
4.Reconnaissance
5.Gaining Access
Which of the following is the MOST important result of a business-aligned security program?
A recent audit has identified control exceptions and recommends implementing technology and processes to remediate the finding. Which of the following is the MOST likely reason for the organization to reject the recommendation?
What process evaluates technical and non-technical security controls to validate that an implementation meets a specific set of security requirements?
Which of the following is MOST beneficial in determining an appropriate balance between uncontrolled innovation and excessive caution in an organization?
The process of creating a system which divides documents based on their security level to manage access to private data is known as
With a focus on the review and approval aspects of board responsibilities, the Data Governance Council recommends that the boards provide strategic oversight regarding information and information security, include these four things:
Which of the following is the BEST reason for having a formal Request for Proposal (RFP) process?
A security officer wants to implement a vulnerability scanning program. The officer is uncertain of the state of vulnerability resiliency within the organization’s large IT infrastructure. What would be the BEST approach to minimize scan data output while retaining a realistic view of system vulnerability?
When assessing internal control objectives, what are the auditor's PRIMARY concerns?
When performing a forensic investigation, what are the two MOST common data sources for obtaining evidence from a computer and mobile devices?
What principle is used when a CISO evaluates controls to ensure they satisfy the organization’s operational needs?
What type of attack requires the least amount of technical equipment and has the highest success rate?
An access point (AP) is discovered using Wireless Equivalent Protocol (WEP). The ciphertext sent by the AP is encrypted with the same key and cipher used by its stations. What authentication method is being used?
As the CISO for your company you are accountable for the protection of information resources commensurate with:
Which of the following is the MOST effective technology to counter phishing attacks?
Which of the following standards would be used for creating a Business Continuity Plan?
Which of the following provides the BEST approach to achieving positive outcomes while preserving savings?
A security professional has been promoted to be the CISO of an organization. The first task is to create a security policy for this organization. The CISO creates and publishes the security policy. This policy however, is ignored and not enforced consistently. Which of the following is the MOST likely reason for the policy shortcomings?
The CIO of an organization has decided to assign the responsibility of internal IT audit to the IT team. This is consider a bad practice MAINLY because
While Cost Benefit Analysis (CBA) is the easiest calculation among financial tools, what is its main weakness?
A newly appointed security officer finds data leakage software licenses that had never been used. The officer decides to implement a project to ensure it gets installed, but the project gets a great deal of resistance across the organization. Which of the following represents the MOST likely reason for this situation?
You are the CISO for an investment banking firm. The firm is using artificial intelligence (AI) to assist in approving clients for loans.
Which control is MOST important to protect AI products?
Which publication serves as a resource of enterprise security-based standards and BEST practices?
What Enterprise Architecture Framework is business-centric and is composed of eight phases?
As the CISO, you are the project sponsor for a highly visible log management project. The objective of the project is to centralize all the enterprise logs into a security information and event management (SIEM) system. You requested the results of the performance quality audits activity.
The performance quality audit activity is done in what project management process group?
The ability to demand the implementation and management of security controls on third parties providing services to an organization is
DumpsMate's team of experts is always available to respond your queries on exam preparation. Get professional answers on any topic of the certification syllabus. Our experts will thoroughly satisfy you.
TESTED 03 Feb 2026
