Question 1

How often should the Statements of Standards for Attestation Engagements-16 (SSAE16)/International Standard on Assurance Engagements 3402 (ISAE3402) report of your vendors be reviewed?

Accepted Answer

The SSAE16/ISAE3402 reports are typically reviewed annually to ensure that vendors maintain adequate controls and compliance over time.

Question 2

Your incident response plan should include which of the following?

Accepted Answer

An incident response plan should include procedures for classification to properly identify and categorize incidents for appropriate handling and response.

Question 3

The security team has investigated the theft/loss of several unencrypted laptop computers containing sensitive corporate information. To prevent the loss of any additional corporate data, it is unilaterally decided by the CISO that all existing and future laptop computers will be encrypted. The help desk is then flooded with complaints about the slow performance of the laptops and users are upset. Which of the following best describes what the CISO did wrong?

Accepted Answer

The CISO failed to identify all stakeholders and their needs, leading to user dissatisfaction due to performance issues.

Question 4

Scenario: Your organization employs single sign-on (user name and password only) as a convenience to your employees to access organizational systems and data. Permission to individual systems and databases is vetted and approved through supervisors and data owners to ensure that only approved personnel can use particular applications or retrieve information. All employees have access to their own human resource information, including the ability to change their bank routing and account information and other personal details through the Employee Self-Service application. All employees have access to the organizational VPN. Recently, members of your organization have been targeted through a number of sophisticated phishing attempts, resulting in compromised credentials. What action can you take to prevent external misuse of compromised credentials while still allowing employees to manage their bank information?

Accepted Answer

Blocking access to the Employee Self-Service application via VPN prevents external misuse of compromised credentials while still allowing employees to manage their bank information through other means.

Question 5

When dealing with risk, the information security practitioner may choose to:

Accepted Answer

The answer of When dealing with risk, the information security...

Question 6

Which of the following methodologies references the recommended industry standard that all project managers should follow?

Accepted Answer

The Project Management Body of Knowledge (PMBOK) is the recommended industry standard that provides guidelines, best practices, and terminologies for project management.

Question 7

Scenario: Your program is developed around minimizing risk to information by focusing on people, technology, and operations. You have decided to deal with risk to information from people first. How can you minimize risk to your most sensitive information before granting access?

Accepted Answer

Conducting background checks helps ensure that individuals with a history of risky behavior or security breaches are not granted access to sensitive information, thus minimizing risk from people.

Question 8

Scenario: A CISO has several two-factor authentication systems under review and selects the one that is most sufficient and least costly. The implementation project planning is completed and the teams are ready to implement the solution. The CISO then discovers that the product it is not as scalable as originally thought and will not fit the organization's needs. The CISO discovers the scalability issue will only impact a small number of network segments. What is the next logical step to ensure the proper application of risk management methodology within the two-factor implementation project?

Accepted Answer

The next logical step is to determine if sufficient mitigating controls can be applied to address the scalability issue, ensuring that the risk is managed appropriately without compromising the overall security posture.

Question 9

The general ledger setup function in an enterprise resource package allows for setting accounting periods. Access to this function has been permitted to users in finance, the shipping department, and production scheduling. What is the most likely reason for such broad access?

Accepted Answer

The answer of The general ledger setup function in an...

Question 10

The process for management approval of the security certification process which states the risks and mitigation of such risks of a given IT system is called___________________.

Accepted Answer

Security accreditation is the process where management formally accepts the risks and mitigation strategies associated with an IT system, following a security certification.

Question 11

Your organization provides open guest wireless access with no captive portals. What can you do to assist with law enforcement investigations if one of your guests is suspected of committing an illegal act using your network?

Accepted Answer

D  Providing IP and MAC addresses can help identify the device used, while configuring logging on access points can provide records of network activity, aiding in investigations.

Question 12

To get an Information Security project back on schedule, which of the following will provide the MOST help?

Accepted Answer

Upper management support can provide the most help in getting an Information Security project back on schedule. This is because upper management has the authority to make decisions that can impact the project's schedule, such as approving additional resources or adjusting deadlines.

Question 13

Which of the following refers to the quantity or quality of project deliverables expanding from the original project plan?

Accepted Answer

Scope creep refers to the uncontrolled expansion of project deliverables or requirements beyond the original project plan.

Question 14

Which wireless encryption technology makes use of temporal keys?

Accepted Answer

WPA2 uses temporal keys as part of its encryption process to enhance security by frequently changing the keys used for encrypting data.

Question 15

The process of identifying and classifying assets is typically included in the________________.

Accepted Answer

The Business Impact Analysis (BIA) involves identifying and classifying assets to understand their importance and the impact of their loss or disruption on business operations.

Question 16

Which of the following conditions would be the MOST probable reason for a security project to be rejected by the executive board of an organization?

Accepted Answer

A negative NPV indicates that the project's costs outweigh its benefits, making it financially unattractive to the executive board.

Question 17

Which of the following is the MOST important component of any change management process?

Accepted Answer

The answer of Which of the following is the MOST...

Question 18

An anonymity network is a series of?

Accepted Answer

An anonymity network is a series of virtual network tunnels that help users maintain privacy and anonymity online by masking their IP addresses and encrypting their internet traffic.

Question 19

The ability to demand the implementation and management of security controls on third parties providing services to an organization is_________________________.

Accepted Answer

Vendor management involves overseeing and controlling third-party service providers, including ensuring they implement and manage appropriate security controls.

Question 20

A CISO has implemented a risk management capability within the security portfolio. Which of the following terms best describes this functionality?

Accepted Answer

A program is a group of related projects and activities managed in a coordinated way to obtain benefits and control not available from managing them individually, which aligns with implementing a risk management capability.

Exam 2: Certified Network Defender

How often should the Statements of Standards for Attestation Engagements-16 (SSAE16) /International Standard on Assurance Engagements 3402 (ISAE3402) report of your vendors be reviewed?