Question 1

Which of the following is used to establish and maintain a framework to provide assurance that information security strategies are aligned with organizational objectives?

Accepted Answer

Governance is responsible for establishing and maintaining a framework to ensure that information security strategies align with organizational objectives.

Question 2

Risk appetite directly affects what part of a vulnerability management program?

Accepted Answer

Risk appetite determines the level of risk an organization is willing to accept, which directly influences the scope of the vulnerability management program by defining which vulnerabilities need to be addressed and to what extent.

Question 3

What is the main purpose of the Incident Response Team?

Accepted Answer

The main purpose of the Incident Response Team is to ensure efficient recovery and reinstate repaired systems after an incident has occurred.

Question 4

You work as a project manager for TYU project. You are planning for risk mitigation. You need to quickly identify high-level risks that will need a more in-depth analysis. Which of the following activities will help you in this?

Accepted Answer

Qualitative analysis helps in quickly identifying high-level risks by assessing their impact and likelihood, allowing for prioritization and determining which risks need more detailed analysis.

Question 5

When choosing a risk mitigation method what is the MOST important factor?

Accepted Answer

The most important factor in choosing a risk mitigation method is ensuring that the cost of the mitigation is less than the potential impact of the risk. This ensures that resources are used efficiently and that the mitigation is economically justified.

Question 6

Which of the following provides an audit framework?

Accepted Answer

COBIT provides a comprehensive framework for developing, implementing, monitoring, and improving IT governance and management practices, which includes audit frameworks.

Question 7

As a new CISO at a large healthcare company you are told that everyone has to badge in to get in the building. Below your office window you notice a door that is normally propped open during the day for groups of people to take breaks outside. Upon looking closer you see there is no badge reader. What should you do?

Accepted Answer

A risk assessment will help identify the potential security risks associated with the door being propped open and guide appropriate actions to mitigate those risks.

Question 8

Which of the following is the MOST important goal of risk management?

Accepted Answer

The most important goal of risk management is to find an economic balance between the impact of the risk and the cost of the control, ensuring that resources are used efficiently to mitigate risks.

Question 9

During the course of a risk analysis your IT auditor identified threats and potential impacts. Next, your IT auditor should:

Accepted Answer

The next step after identifying threats and potential impacts is to identify and evaluate existing controls to determine if they are adequate to mitigate the identified risks.

Question 10

What is the SECOND step to creating a risk management methodology according to the National Institute of Standards and Technology (NIST) SP 800-30 standard?

Accepted Answer

The answer of What is the SECOND step to creating...

Question 11

Payment Card Industry (PCI) compliance requirements are based on what criteria?

Accepted Answer

PCI compliance requirements are primarily based on the number of transactions an organization processes per year, which determines the level of compliance and validation requirements.

Question 12

As the new CISO at the company you are reviewing the audit reporting process and notice that it includes only detailed technical diagrams. What else should be in the reporting process?

Accepted Answer

An executive summary should be included in the audit reporting process to provide a high-level overview of the findings and recommendations, making it accessible to non-technical stakeholders and decision-makers.

Question 13

When creating a vulnerability scan schedule, who is the MOST critical person to communicate with in order to ensure impact of the scan is minimized?

Accepted Answer

The asset owner is responsible for the asset and understands its importance and usage, making them crucial in scheduling scans to minimize impact.

Question 14

IT control objectives are useful to IT auditors as they provide the basis for understanding the:

Accepted Answer

IT control objectives help IT auditors understand the desired results or purpose of implementing specific control procedures, guiding them in evaluating the effectiveness of these controls.

Question 15

The amount of risk an organization is willing to accept in pursuit of its mission is known as______________.

Accepted Answer

Risk tolerance refers to the level of risk an organization is willing to accept in pursuit of its objectives.

Question 16

What is the MAIN reason for conflicts between Information Technology and Information Security programs?

Accepted Answer

The main reason for conflicts is that security controls can slow down IT implementations, as they often require additional steps and considerations that can delay projects.

Question 17

Which of the following tests is an IS auditor performing when a sample of programs is selected to determine if the source and object versions are the same?

Accepted Answer

A compliance test of program library controls is performed to ensure that the source and object versions of programs are the same, verifying adherence to procedures and controls.

Question 18

Which of the following represents the HIGHEST negative impact resulting from an ineffective security governance program?

Accepted Answer

Fines for regulatory non-compliance represent the highest negative impact as they can result in significant financial losses and damage to the organization's reputation.

Question 19

An organization information security policy serves to___________________.

Accepted Answer

An information security policy primarily serves to establish acceptable systems and user behavior, outlining the rules and guidelines for protecting the organization's information assets.

Question 20

Which of the following is a critical operational component of an Incident Response Program (IRP)?

Accepted Answer

Daily monitoring of vulnerability advisories is crucial for an Incident Response Program as it helps in identifying and addressing potential threats promptly, ensuring the security of the organization's systems.

Exam 2: Certified Network Defender