QUESTION 19
After a risk assessment study, a bank with global operations decided to continue doing business in certain regions of the world where identity theft is rampant. The information security manager should encourage the business to:

QUESTION 20
In a large organization, defining recovery time objectives (RTOs) is PRIMARILY the responsibility of:

QUESTION 21
The MAIN reason for an information security manager to monitor industry level changes in the business and IT is to:

QUESTION 22
When integrating information security requirements into software development, which of the following practices should be FIRST in the development lifecycle?

QUESTION 23
Which of the following is the BEST method to defend against social engineering attacks?

QUESTION 24
An organization is in the process of adopting a hybrid data infrastructure, transferring all non-core applications to cloud service providers and maintaining all core business functions house. The information security manager has determined a defense in depth strategy should be used. Which of the following BEST describes this strategy?

QUESTION 25
Which of the following is done PRIMARILY to address the integrity of information?

QUESTION 26
Which of the following is MOST effective in preventing weaknesses from being introduced into existing production systems?

QUESTION 27
If civil litigation is a goal for an organizational response to a security incident, the PRIMARY step should be to:

QUESTION 28
The purpose of a corrective control is to:

QUESTION 29
An information security manager wants to document requirements detailing the minimum security controls required for user workstations.
Which of the following resources would be MOST appropriate for this purpose’?

QUESTION 30
Which of the following is the MOST important item to consider when evaluating products to monitor security across the enterprise?

QUESTION 31
Which of the following is characteristic of centralized information security management?

QUESTION 32
Which of the following would BEST assist an information security manager in measuring the existing level of development of security processes against their desired state?

QUESTION 33
An organization’s information security team presented the risk register at a recent information security steering committee meeting. Which of the following should be of MOST concern to the committee?

QUESTION 34
Who can BEST approve plans to implement an information security governance framework?

QUESTION 35
Which of the following BEST indicates the effectiveness of the vendor risk management process?

QUESTION 36
What is the BEST way to reduce the impact of a successful ransomware attack?

QUESTION 37
In the course of examining a computer system for forensic evidence, data on the suspect media were inadvertently altered. Which of the following should have been the FIRST course of action in the investigative process?

QUESTION 38
Senior management has endorsed a comprehensive information security policy. Which of the following should the organization do NEXT?

QUESTION 39
Which of the following is the FIRST step to establishing an effective information security program?

QUESTION 40
Which of the following metrics would be the MOST useful in measuring how well information security is monitoring violation logs?