Q28. Which level of data destruction applies logical techniques to sanitize data in all user-addressable storage locations?

Q29. Control Objectives for Information and Related Technology (COBIT) is which of the following?

Q30. How often should an environment be monitored for cyber threats, risks, and exposures?

Q31. The executive board has requested that the CISO of an organization define and Key Performance Indicators (KPI) to measure the effectiveness of the security awareness program provided to call center employees. Which of the following can be used as a KPI?

Q32. The success of the Chief Information Security Officer is MOST dependent upon:

Q33. Which of the following is critical in creating a security program aligned with an organization’s goals?

Q34. Scenario: You are the CISO and have just completed your first risk assessment for your organization. You find many risks with no security controls, and some risks with inadequate controls. You assign work to your staff to create or adjust existing security controls to ensure they are adequate for risk mitigation needs.
When formulating the remediation plan, what is a required input?

Q35. Which of the following is MOST beneficial in determining an appropriate balance between uncontrolled innovation and excessive caution in an organization?

Q36. Scenario: You are the newly hired Chief Information Security Officer for a company that has not previously had a senior level security practitioner. The company lacks a defined security policy and framework for their Information Security Program. Your new boss, the Chief Financial Officer, has asked you to draft an outline of a security policy and recommend an industry/sector neutral information security control framework for implementation.
Which of the following industry / sector neutral information security control frameworks should you recommend for implementation?

Q37. Access Control lists (ACLs), Firewalls, and Intrusion Prevention Systems are examples of

Q38. Which of the following is used to establish and maintain a framework to provide assurance that information security strategies are aligned with organizational objectives?

Q39. As the new CISO at the company you are reviewing the audit reporting process and notice that it includes only detailed technical diagrams. What else should be in the reporting process?

Q40. The MOST common method to get an unbiased measurement of the effectiveness of an Information Security Management System (ISMS) is to

Q41. A CISO sees abnormally high volumes of exceptions to security requirements and constant pressure from business units to change security processes. Which of the following represents the MOST LIKELY cause of this situation?

Q42. Scenario: Your corporate systems have been under constant probing and attack from foreign IP addresses for more than a week. Your security team and security infrastructure have performed well under the stress. You are confident that your defenses have held up under the test, but rumors are spreading that sensitive customer data has been stolen and is now being sold on the Internet by criminal elements.
During your investigation of the rumored compromise you discover that data has been breached and you have discovered the repository of stolen data on a server located in a foreign country. Your team now has full access to the data on the foreign server.
What action should you take FIRST?

Q43. The exposure factor of a threat to your organization is defined by?

Q44. Which business stakeholder is accountable for the integrity of a new information system?

Q45. The executive board has requested that the CISO of an organization define and Key Performance Indicators (KPI) to measure the effectiveness of the security awareness program provided to call center employees.
Which of the following can be used as a KPI?

Q46. A person in your security team calls you at night and informs you that one of your web applications is potentially under attack from a cross-site scripting vulnerability. What do you do?

Q47. Which of the following is a benefit of information security governance?

Q48. Bob waits near a secured door, holding a box. He waits until an employee walks up to the secured door and uses the special card in order to access the restricted area of the target company. Just as the employee opens the door, Bob walks up to the employee (still holding the box) and asks the employee to hold the door open so that he can enter. What is the best way to undermine the social engineering activity of tailgating?

Q49. Which of the following reports should you as an IT auditor use to check on compliance with a service level agreement’s requirement for uptime?

Q50. You have implemented a new security control. Which of the following risk strategy options have you engaged in?

Q51. Scenario: An organization has made a decision to address Information Security formally and consistently by adopting established best practices and industry standards. The organization is a small retail merchant but it is expected to grow to a global customer base of many millions of customers in just a few years.
This global retail company is expected to accept credit card payments. Which of the following is of MOST concern when defining a security program for this organization?