Which of the following activities results in change requests?

A.

Preventive actions

B.

Inspection

C.

Defect repair

D.

Corrective actions

Which is the BEST solution to monitor, measure, and report changes to critical data in a system?

A.

Application logs

B.

File integrity monitoring

C.

SNMP traps

D.

Syslog

Which of the following BEST describes an international standard framework that is based on the security model Information Technology—Code of Practice for Information Security Management?

A.

International Organization for Standardization 27001

B.

National Institute of Standards and Technology Special Publication SP 800-12

C.

Request For Comment 2196

D.

National Institute of Standards and Technology Special Publication SP 800-26

Which of the following best represents a calculation for Annual Loss Expectancy (ALE)?

A.

Single loss expectancy multiplied by the annual rate of occurrence

B.

Total loss expectancy multiplied by the total loss frequency

C.

Value of the asset multiplied by the loss expectancy

D.

Replacement cost multiplied by the single loss expectancy

Creating good security metrics is essential for a CISO. What would be the BEST sources for creating security metrics for baseline defenses coverage?

A.

Servers, routers, switches, modem

B.

Firewall, exchange, web server, intrusion detection system (IDS)

C.

Firewall, anti-virus console, IDS, syslog

D.

IDS, syslog, router, switches

Which of the following is the MOST important goal of risk management?

A.

Identifying the risk

B.

Finding economic balance between the impact of the risk and the cost of the control

C.

Identifying the victim of any potential exploits

D.

Assessing the impact of potential threats

When a CISO considers delaying or not remediating system vulnerabilities which of the following are MOST important to take into account?

A.

Threat Level, Risk of Compromise, and Consequences of Compromise

B.

Risk Avoidance, Threat Level, and Consequences of Compromise

C.

Risk Transfer, Reputational Impact, and Consequences of Compromise

D.

Reputational Impact, Financial Impact, and Risk of Compromise

The mean time to patch, number of virus outbreaks prevented, and number of vulnerabilities mitigated are examples of what type of performance metrics?

A.

Risk metrics

B.

Management metrics

C.

Operational metrics

D.

Compliance metrics

An audit was conducted and many critical applications were found to have no disaster recovery plans in place. You conduct a Business Impact Analysis (BIA) to determine impact to the company for each application. What should be the NEXT step?

A.

Determine the annual loss expectancy (ALE)

B.

Create a crisis management plan

Which of the following is the MOST important reason to measure the effectiveness of an Information Security Management System (ISMS)?

A.

Meet regulatory compliance requirements

B.

Better understand the threats and vulnerabilities affecting the environment

C.

Better understand strengths and weaknesses of the program

D.

Meet legal requirements