Exam 2: Certified Network Defender

Question 1

From an information security perspective, information that no longer supports the main purpose of the business should be:

A) protected under the information classification policy
B) analyzed under the data ownership policy
C) assessed by a business impact analysis.
D) analyzed under the retention policy.

Answer 1

D

Question 2

The single most important consideration to make when developing your security program, policies, and processes is:

A) Alignment with the business
B) Budgeting for unforeseen data compromises
C) Establishing your authority as the Security Executive
D) Streaming for efficiency

Answer 2

A

Question 3

The FIRST step in establishing a security governance program is to?

A) Obtain senior level sponsorship
B) Conduct a workshop for all end users.
C) Conduct a risk assessment.
D) Prepare a security budget.

Answer 3

A

Question 4

An organization's Information Security Policy is of MOST importance because_____________.

A) It defines a process to meet compliance requirements
B) It establishes a framework to protect confidential information
C) It communicates management's commitment to protecting information resources
D) It is formally acknowledged by all employees and vendors

Question 5

A security manager regularly checks work areas after business hours for security violations; such as unsecured files or unattended computers with active sessions. This activity BEST demonstrates what part of a security program?

A) Compliance management
B) Audit validation
C) Physical control testing
D) Security awareness training

Question 6

An organization licenses and uses personal information for business operations, and a server containing that information has been compromised. What kind of law would require notifying the owner or licensee of this incident?

A) Consumer right disclosure
B) Data breach disclosure
C) Special circumstance disclosure
D) Security incident disclosure

Question 7

When dealing with Security Incident Response procedures, which of the following steps come FIRST when reacting to an incident?

A) Eradication
B) Escalation
C) Containment
D) Recovery

Question 8

When briefing senior management on the creation of a governance process, the MOST important aspect should be:

A) knowledge required to analyze each issue
B) information security metrics
C) linkage to business area objectives
D) baseline against which metrics are evaluated

Question 9

When managing an Information Security Program, which of the following is of MOST importance in order to influence the culture of an organization?

A) Compliance with local privacy regulations
B) An independent Governance, Risk and Compliance organization
C) Support Legal and HR teams
D) Alignment of security goals with business goals

Question 10

Which of the following is the MAIN reason to follow a formal risk management process in an organization that hosts and uses privately identifiable information (PII) as part of their business models and processes?

A) Need to comply with breach disclosure laws
B) Fiduciary responsibility to safeguard credit information
C) Need to transfer the risk associated with hosting PII data
D) Need to better understand the risk associated with using PII data

Question 11

What is the relationship between information protection and regulatory compliance?

A) That all information in an organization must be protected equally.
B) The information required to be protected by regulatory mandate does not have to be identified in the organizations data classification policy.
C) There is no relationship between the two.
D) That the protection of some information such as National ID information is mandated by regulation and other information such as trade secrets are protected based on business need.

Question 12

In accordance with best practices and international standards, how often is security awareness training provided to employees of an organization?

A) Every 18 months
B) Every 12 months
C) High risk environments 6 months, low risk environments 12 months
D) Every 6 months

Question 13

When dealing with a risk management process, asset classification is important because it will impact the overall:

A) Threat identification
B) Risk treatment
C) Risk monitoring
D) Risk tolerance

Question 14

Which of the following is a benefit of information security governance?

A) Direct involvement of senior management in developing control processes
B) Reduction of the potential for civil and legal liability
C) Questioning the trust in vendor relationships
D) Increasing the risk of decisions based on incomplete management information

Question 15

One of the MAIN goals of a Business Continuity Plan is to_______________.

A) Ensure all infrastructure and applications are available in the event of a disaster
B) Assign responsibilities to the technical teams responsible for the recovery of all data
C) Provide step by step plans to recover business processes in the event of a disaster
D) Allow all technical first-responders to understand their roles in the event of a disaster.

Question 16

Who in the organization determines access to information?

A) Compliance officer
B) Legal department
C) Data Owner
D) Information security officer

Question 17

An organization has defined a set of standard security controls. This organization has also defined the circumstances and conditions in which they must be applied. What is the NEXT logical step in applying the controls in the organization?

A) Determine the risk tolerance
B) Perform an asset classification
C) Analyze existing controls on systems
D) Create an architecture gap analysis

Question 18

Which of the following should be determined while defining risk management strategies?

A) Organizational objectives and risk tolerance
B) Enterprise disaster recovery plans
C) Risk assessment criteria
D) IT architecture complexity

Question 19

A method to transfer risk is to______________.

A) Implement redundancy
B) Move operations to another region
C) Alignment with business operations
D) Purchase breach insurance

Question 20

The PRIMARY objective of security awareness is to:

A) Encourage security-conscious behavior
B) Put employees on notice in case follow-up action for noncompliance is necessary
C) Ensure that security policies are read.

Question 21

The establishment of a formal risk management framework and system authorization program is essential. The LAST step of the system authorization process is:

A) Getting authority to operate the system from executive management
B) Contacting the Internet Service Provider for an IP scope
C) Changing the default passwords
D) Conducting a final scan of the live system and mitigating all high and medium level vulnerabilities

Question 22

Which of the following is considered the MOST effective tool against social engineering?

A) Effective Security Vulnerability Management Program
B) Anti-malware tools
C) Effective Security awareness program
D) Anti-phishing tools

Question 23

You have implemented a new security control. Which of the following risk strategy options have you engaged in?

A) Risk Transfer
B) Risk Mitigation
C) Risk Avoidance
D) Risk Acceptance

Question 24

An organization's firewall technology needs replaced. A specific technology has been selected that is less costly than others and lacking in some important capabilities. The security officer has voiced concerns about sensitive data breaches but the decision is made to purchase. What does this selection indicate?

A) A high threat environment
B) I low vulnerability environment
C) A high risk tolerance environment
D) A low risk tolerance environment

Question 25

A company wants to fill a Chief Information Security Officer position in the organization. They need to define and implement a more holistic security program. Which of the following qualifications and experience would be MOST desirable to find in a candidate?

A) Industry certifications, technical knowledge and program management skills
B) Multiple references, strong background check and industry certifications
C) Multiple certifications, strong technical capabilities and lengthy resume
D) College degree, audit capabilities and complex project management

Question 26

Which of the following most commonly falls within the scope of an information security governance steering committee?

A) Vetting information security policies
B) Approving access to critical financial systems
C) Interviewing candidates for information security specialist positions
D) Developing content for security awareness programs

Question 27

Which of the following are the MOST important factors for proactively determining system vulnerabilities?

A) Subscribe to vendor mailing list to get notification of system vulnerabilities
B) Configure firewall, perimeter router and Intrusion Prevention System (IPS)
C) Conduct security testing, vulnerability scanning, and penetration testing
D) Deploy Intrusion Detection System (IDS) and install anti-virus on systems

Question 28

You have purchased a new insurance policy as part of your risk strategy. Which of the following risk strategy options have you engaged in?

A) Risk Mitigation
B) Risk Acceptance
C) Risk Avoidance
D) Risk Transfer

Question 29

Risk is defined as:

A) Quantitative plus qualitative impact
B) Asset loss times likelihood of event
C) Advisory plus capability plus vulnerability
D) Threat times vulnerability divided by control

Question 30

Which of the following best represents a calculation for Annual Loss Expectancy (ALE)?

A) Value of the asset multiplied by the loss expectancy
B) Replacement cost multiplied by the single loss expectancy
C) Single loss expectancy multiplied by the annual rate of occurrence
D) Total loss expectancy multiplied by the total loss frequency

Question 31

Which of the following intellectual Property components is focused on maintaining brand recognition?

A) Trademark
B) Research Logs
C) Copyright
D) Patent

Question 32

The Information Security Management program MUST protect:

A) Against distributed denial of service attacks
B) Intellectual property released into the public domain
C) all organizational assets
D) critical business processes and/or revenue streams

Question 33

Risk that remains after risk mitigation is known as_____________.

A) Accepted risk
B) Residual risk
C) Non-tolerated risk
D) Persistent risk

Question 34

In which of the following cases, would an organization be more prone to risk acceptance vs. risk mitigation?

A) The organization uses exclusively a qualitative process to measure risk
B) The organization's risk tolerance is low
C) The organization uses exclusively a quantitative process to measure risk
D) The organization's risk tolerance is high

Question 35

The framework that helps to define a minimum standard of protection that business stakeholders must attempt to achieve is referred to as a standard of:

A) Due Compromise
B) Due process
C) Due Care
D) Due Protection

Question 36

Dataflow diagrams are used by IT auditors to:

A) Graphically summarize data paths and storage processes.
B) Order data hierarchically
C) Highlight high-level data definitions
D) Portray step-by-step details of data generation.

Question 37

When managing the security architecture for your company you must consider:

A) Budget
B) Security and IT Staff size
C) Company values
D) All of the above

Question 38

Developing effective security controls is a balance between:

A) Technology and Vendor Management
B) Operations and Regulations
C) Risk Management and Operations
D) Corporate Culture and Job Expectations

Question 39

Which of the following is a benefit of a risk-based approach to audit planning?

A) Resources are allocated to the areas of the highest concern
B) Scheduling may be performed months in advance
C) Budgets are more likely to be met by the IT audit staff
D) Staff will be exposed to a variety of technologies

Question 40

When measuring the effectiveness of an Information Security Management System which one of the following would be MOST LIKELY used as a metric framework?

A) ISO 27001
B) ISO 27004
C) PRINCE2
D) ITILv3

Question 41

Which of the following is used to establish and maintain a framework to provide assurance that information security strategies are aligned with organizational objectives?

A) Governance
B) Compliance
C) Awareness
D) Management

Question 42

Risk appetite directly affects what part of a vulnerability management program?

A) Scope
B) Schedule
C) Staff
D) Scan tools

Question 43

What is the main purpose of the Incident Response Team?

A) Communicate details of information security incidents
B) Create effective policies detailing program activities
C) Ensure efficient recovery and reinstate repaired systems
D) Provide current employee awareness programs

Question 44

You work as a project manager for TYU project. You are planning for risk mitigation. You need to quickly identify high-level risks that will need a more in-depth analysis. Which of the following activities will help you in this?

A) Risk mitigation
B) Estimate activity duration
C) Quantitative analysis
D) Qualitative analysis

Question 45

When choosing a risk mitigation method what is the MOST important factor?

A) Approval from the board of directors
B) Metrics of mitigation method success
C) Cost of the mitigation is less than a risk
D) Mitigation method complies with PCI regulations

Question 46

Which of the following provides an audit framework?

A) Control Objectives for IT (COBIT)
B) International Organization Standard (ISO) 27002
C) Payment Card Industry -Data Security Standard (PCI-DSS)
D) National Institute of Standards and technology (NIST) SP 800-30

Question 47

As a new CISO at a large healthcare company you are told that everyone has to badge in to get in the building. Below your office window you notice a door that is normally propped open during the day for groups of people to take breaks outside. Upon looking closer you see there is no badge reader. What should you do?

A) Post a guard at the door to maintain physical security
B) Close and chain the door shut and send a company-wide memo banning the practice
C) Have a risk assessment performed
D) Nothing, this falls outside your area of influence

Question 48

Which of the following is the MOST important goal of risk management?

A) Finding economic balance between the impact of the risk and the cost of the control
B) Identifying the victim of any potential exploits
C) Identifying the risk
D) Assessing the impact of potential threats

Question 49

During the course of a risk analysis your IT auditor identified threats and potential impacts. Next, your IT auditor should:

A) Identify and assess the risk assessment process used by management.
B) Identify and evaluate existing controls.
C) Identify information assets and the underlying systems.
D) Disclose the threats and impacts to management.

Question 50

What is the SECOND step to creating a risk management methodology according to the National Institute of Standards and Technology (NIST) SP 800-30 standard?

A) Mitigate risk
B) Perform a risk assessment
C) Determine appetite
D) Evaluate risk avoidance criteria

Question 51

Payment Card Industry (PCI) compliance requirements are based on what criteria?

A) The size of the organization processing credit card data
B) The types of cardholder data retained
C) The duration card holder data is retained
D) The number of transactions performed per year by an organization

Question 52

As the new CISO at the company you are reviewing the audit reporting process and notice that it includes only detailed technical diagrams. What else should be in the reporting process?

A) Names and phone numbers of those who conducted the audit
B) Executive summary
C) Penetration test agreement
D) Business charter

Question 53

When creating a vulnerability scan schedule, who is the MOST critical person to communicate with in order to ensure impact of the scan is minimized?

A) The asset manager
B) The project manager
C) The asset owner
D) The data custodian

Question 54

IT control objectives are useful to IT auditors as they provide the basis for understanding the:

A) The audit control checklist
B) Technique for securing information
C) Desired results or purpose of implementing specific control procedures.
D) Security policy

Question 55

The amount of risk an organization is willing to accept in pursuit of its mission is known as______________.

A) risk transfer
B) risk mitigation
C) risk acceptance
D) risk tolerance

Question 56

What is the MAIN reason for conflicts between Information Technology and Information Security programs?

A) The effective implementation of security controls can be viewed as an inhibitor to rapid Information technology implementations.
B) Technology Governance is focused on process risks whereas Security Governance is focused on business risk.
C) Technology governance defines technology policies and standards while security governance does not.
D) Security governance defines technology best practices and Information Technology governance does not.

Question 57

Which of the following tests is an IS auditor performing when a sample of programs is selected to determine if the source and object versions are the same?

A) Substantive test of program library controls
B) A compliance test of the program compiler controls
C) A compliance test of program library controls
D) A substantive test of the program compiler controls

Question 58

Which of the following represents the HIGHEST negative impact resulting from an ineffective security governance program?

A) Improper use of information resources
B) Reduction of budget
C) Decreased security awareness
D) Fines for regulatory non-compliance

Question 59

An organization information security policy serves to___________________.

A) define security configurations for systems
B) establish budgetary input in order to meet compliance requirements
C) establish acceptable systems and user behavior
D) define relationship with external law enforcement agencies

Question 60

Which of the following is a critical operational component of an Incident Response Program (IRP)?

A) Monthly program tests to ensure resource allocation is sufficient for supporting the needs of the organization.
B) Weekly program budget reviews to ensure the percentage of program funding remains constant.
C) Annual review of program charters, policies, procedures and organizational agreements.
D) Daily monitoring of vulnerability advisories relating to your organization's deployed technologies.

Question 61

A security officer wants to implement a vulnerability scanning program. The officer is uncertain of the state of vulnerability resiliency within the organization's large IT infrastructure. What would be the BEST approach to minimize scan data output while retaining a realistic view of system vulnerability?

A) Decrease the vulnerabilities within the scan tool settings
B) Scan a representative sample of systems
C) Filter the scan output so only pertinent data is analyzed
D) Perform the scans only during off-business hours

Question 62

When a critical vulnerability has been discovered on production systems and needs to be fixed immediately, what is the BEST approach for a CISO to mitigate the vulnerability under tight budget constraints?

A) Schedule an emergency meeting and request the finding to fix the issue
B) Take the system off line until budget is available
C) Transfer financial resources from other critical programs
D) Deploy countermeasures and compensation controls until the budget is available

Question 63

In MOST organizations which group periodically reviews network intrusion detection system logs for all systems as part of their daily tasks?

A) Internal Audit
B) Information Security
C) Compliance
D) Database Administration

Question 64

A new CISO just started with a company and on the CISO's desk is the last complete Information Security Management audit report. The audit report is over two years old. After reading it, what should be the CISO's FIRST priority?

A) Review the recommendations and follow up to see if audit implemented the changes
B) Meet with audit team to determine a timeline for corrections
C) Have internal audit conduct another audit to see what has changed.
D) Contract with an external audit company to conduct an unbiased audit

Question 65

When deploying an Intrusion Prevention System (IPS) the BEST way to get maximum protection from the system is to deploy it___________

A) In-lie and turn on alert mode to stop malicious traffic.
B) In promiscuous mode and block malicious traffic.
C) In promiscuous mode and only detect malicious traffic.
D) In-line and turn on blocking mode to stop malicious traffic.

Question 66

Which of the following is a weakness of an asset or group of assets that can be exploited by one or more threats?

A) Vulnerability
B) Threat
C) Exploitation
D) Attack vector

Question 67

When should IT security project management be outsourced?

A) On projects not forecasted in the yearly budget
B) When organizational resources are limited
C) When the benefits of outsourcing outweigh the inherent risks of outsourcing
D) On new, enterprise-wide security initiatives

Question 68

Assigning the role and responsibility of Information Assurance to a dedicated and independent security group is an example of:

A) Detective Controls
B) Proactive Controls
C) Organizational Controls
D) Preemptive Controls

Question 69

According to ISO 27001, of the steps for establishing an Information Security Governance program listed below, which comes first?

A) Decide how to manage risk
B) Define Information Security Policy
C) Identify threats, risks, impacts and vulnerabilities
D) Define the budget of the Information Security Management System

Question 70

An international organization is planning a project to implement encryption technologies to protect company confidential information. This organization has data centers on three continents. Which of the following would be considered a MAJOR constraint for the project?

A) Compliance to local hiring laws
B) Encryption import/export regulations
C) Local customer privacy laws
D) Time zone differences

Question 71

Which of the following activities is the MAIN purpose of the risk assessment process?

A) Creating an inventory of information assets
B) Calculating the risks to which assets are exposed in their current setting
C) Classifying and organizing information assets into meaningful groups
D) Assigning value to each information asset

Question 72

What should an organization do to ensure that they have a sound Business Continuity (BC) Plan?

A) Conduct a Disaster Recovery (RD) exercise every year to test the plan
B) Conduct periodic tabletop exercises to refine the BC plan
C) Test every three years to ensure that things work as planned
D) Outsource the creation and execution of the BC plan to a third party vendor

Question 73

The risk found after a control has been fully implemented is called:

A) Total Risk
B) Transferred Risk
C) Residual Risk
D) Post Implementation Risk

Question 74

Creating a secondary authentication process for network access would be an example of?

A) Defense in depth cost enumerated costs
B) Nonlinearities in physical security performance metrics
C) System hardening and patching requirements
D) Anti-virus for mobile devices

Question 75

The executive board has requested that the CISO of an organization define and Key Performance Indicators (KPI) to measure the effectiveness of the security awareness program provided to call center employees. Which of the following can be used as a KPI?

A) Number of successful social engineering attempts on the call center
B) Number of callers who abandon the call before speaking with a representative
C) Number of callers who report a lack of customer service from the call center
D) Number of callers who report security issues.

Question 76

Which of the following is the MOST effective way to measure the effectiveness of security controls on a perimeter network?

A) Perform a vulnerability scan of the network
B) Internal Firewall ruleset reviews
C) Implement network intrusion prevention systems
D) External penetration testing by a qualified third party

Question 77

The effectiveness of social engineering penetration testing using phishing can be used as a Key Performance Indicator (KPI) for the effectiveness of an organization's

A) Risk Management Program
B) Anti-Spam controls
C) Identity and Access Management Program
D) Security Awareness Program

Question 78

You are the Chief Information Security Officer of a large, multinational bank and you suspect there is a flaw in a two factor authentication token management process. Which of the following represents your BEST course of action?

A) Determine program ownership to implement compensating controls
B) Send a report to executive peers and business unit owners detailing your suspicions
C) Validate that security awareness program content includes information about the potential vulnerability
D) Conduct a throughout risk assessment against the current implementation to determine system functions

Question 79

Which of the following represents the BEST reason for an organization to use the Control Objectives for Information and Related Technology (COBIT) as an Information Technology (IT) framework?

A) Information Security (IS) procedures often require augmentation with other standards
B) Implementation of it eases an organization's auditing and compliance burden
C) It provides for a consistent and repeatable staffing model for technology organizations
D) It allows executives to more effectively monitor IT implementation costs

Question 80

Which of the following BEST describes an international standard framework that is based on the security model Information Technology-Code of Practice for Information Security Management?

A) National Institute of Standards and technology Special Publication SP 800-12
B) Request for Comment 2196
C) International Organization for Standardization 27001
D) National Institute of Standards and technology Special Publication SP 800-26