clapgeek logo
Which of the following is considered the foundation for the Enterprise Information Security Architecture (EISA)?
As the Business Continuity Coordinator of a financial services organization, you are responsible for ensuring assets are recovered timely in the event of a disaster. Which is the BEST Disaster Recovery performance indicator to validate that you are prepared for a disaster?
Which control is used to discourage the exploitation of a vulnerability or system?
Which of the following tests is an IS auditor performing when a sample of programs is selected to determine if the source and object versions are the same?
Which of the following functions MUST your Information Security Governance program include for formal organizational reporting?
What is the estimate of all direct and indirect costs associated with an asset or acquisition over its entire life cycle?
A security manager regualrly checks work areas after buisness hours for security violations; such as unsecured files or unattended computers with active sessions. This activity BEST demonstrates what part of a security program?
Which of the following terms is used to describe the estimate of all direct and indirect costs associated with an asset or acquisition over its entire life cycle?
The mean time to patch, number of virus outbreaks prevented, and number of vulnerabilities mitigated are examples of what type of performance metrics?
If a competitor wants to cause damage to your organization, steal critical secrets, or put you out of business,
they just have to find a job opening, prepare someone to pass the interview, have that person hired, and they
will be in the organization. How would you prevent such type of attacks?
When a CISO considers delaying or not remediating system vulnerabilities which of the following are MOST important to take into account?
A CISO wants to change the defense strategy to ward off attackers. To accomplish this the CISO is looking to a strategy where attackers are lured into a zone of a safe network where attackers can be monitored, controlled, quarantined, or eradicated.
Which of the following is the MOST effective way to measure the effectiveness of security controls on a perimeter network?
What is the primary difference between Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS)?
Physical security measures typically include which of the following types of controls?
Ciphertext is encrypted with a result being a compressed representation of the original data. What is this result called?
When dealing with a risk management process, asset classification is important because it will impact the overall:
Which of the following terms is used to describe the unexpected expansion of project deliverables?
Which of the following is the MOST effective method to measure the effectiveness of security controls in a perimeter network?
An auditor is reviewing the security classifications for a group of assets and finds that many of the assets are not correctly classified.
What should the auditor’s NEXT step be?
Which of the following would negatively impact a log analysis of a multinational organization?
What is the MOST important reason to have senior leadership endorse security policies?
With a focus on the review and approval aspects of board responsibilities, the Data Governance Council recommends that the boards provide strategic oversight regarding information and information security, include these four things:
Your IT auditor is reviewing significant events from the previous year and has identified some procedural oversights. Which of the following would be the MOST concerning?
An access point (AP) is discovered using Wireless Equivalent Protocol (WEP). The ciphertext sent by the AP is encrypted with the same key and cipher used by its stations. What authentication method is being used?
Scenario: An organization has recently appointed a CISO. This is a new role in the organization and it signals the increasing need to address security consistently at the enterprise level. This new CISO, while confident with skills and experience, is constantly on the defensive and is unable to advance the IT security centric agenda.
The CISO has been able to implement a number of technical controls and is able to influence the Information Technology teams but has not been able to influence the rest of the organization. From an organizational perspective, which of the following is the LIKELY reason for this?
Creating good security metrics is essential for a CISO. What would be the BEST sources for creating security metrics for baseline defenses coverage?
A department within your company has proposed a third party vendor solution to address an urgent, critical business need. As the CISO you have been asked to accelerate screening of their security control claims. Which of the following vendor provided documents is BEST to make your decision:
Which is the single MOST important factor for introducing digital evidence into a court of law?
A CISO has implemented a risk management capability within the security portfolio. Which of the following
terms best describes this functionality?
Which publication serves as a resource of enterprise security-based standards and BEST practices?
Scenario: As you begin to develop the program for your organization, you assess the corporate culture and determine that there is a pervasive opinion that the security program only slows things down and limits the performance of the “real workers.”
What must you do first in order to shift the prevailing opinion and reshape corporate culture to understand the value of information security to the organization?
Scenario: An organization has recently appointed a CISO. This is a new role in the organization and it signals the increasing need to address security consistently at the enterprise level. This new CISO, while confident with skills and experience, is constantly on the defensive and is unable to advance the IT security centric agenda.
Which of the following is the reason the CISO has not been able to advance the security agenda in this organization?
Quantitative Risk Assessments have the following advantages over qualitative risk assessments:
An audit was conducted and many critical applications were found to have no disaster recovery plans in place. You conduct a Business Impact Analysis (BIA) to determine impact to the company for each application. What should be the NEXT step?
To get an Information Security project back on schedule, which of the following will provide the MOST help?
In accordance with best practices and international standards, how often is security awareness training provided to employees of an organization?
Scenario: You are the CISO and have just completed your first risk assessment for your organization. You find many risks with no security controls, and some risks with inadequate controls. You assign work to your staff to create or adjust existing security controls to ensure they are adequate for risk mitigation needs.
When formulating the remediation plan, what is a required input?
Which security technologies are MOST critical to implementing a zero trust model?
Scenario: An organization has made a decision to address Information Security formally and consistently by adopting established best practices and industry standards. The organization is a small retail merchant but it is expected to grow to a global customer base of many millions of customers in just a few years.
This global retail company is expected to accept credit card payments. Which of the following is of MOST concern when defining a security program for this organization?
A CISO implements smart cards for credential management, and as a result has reduced costs associated with help desk operations supporting password resets. This demonstrates which of the following principles?
Who is PRIMARILY responsible for declaring a disaster and initiating processes to facilitate the recovery of critical assets in an organization?
Which of the following is a PRIMARY purpose of a Security Operations Center (SOC)?
During the last decade, what trend has caused the MOST serious issues in relation to physical security?
Which of the following is of MOST importance when security leaders of an organization are required to align security to influence the culture of an organization?
What is the MOST important result of the management response within the audit process?
Which of the following information would MOST likely be reported at the board-level within an organization?
Which of the following terms is defined as the friction or opposition resulting from actual or perceived differences or incompatibilities?
The organization does not have the time to remediate the vulnerability; however it is critical to release the application. Which of the following needs to be further evaluated to help mitigate the risks?
Which of the following metrics would be MOST effective for measuring the effectiveness of a newly implemented change control process?
When measuring the effectiveness of an Information Security Management System which one of the following would be MOST LIKELY used as a metric framework?
What type of attack requires the least amount of technical equipment and has the highest success rate?
A person in your security team calls you at night and informs you that one of your web applications is potentially under attack from a cross-site scripting vulnerability. What do you do?
Which of the following is considered the MOST effective tool against social engineering?
Which of the following is the MOST effective method to counter phishing attacks?
What are the primary reasons for the development of a business case for a security project?
Which of the following is used to lure attackers into false environments so they can be monitored, contained, or blocked from reaching critical systems?
Which of the following is critical for maintaining a successful information security management program?
A key cybersecurity feature of a Personal Identification Verification (PIV) Card is:
Creating a secondary authentication process for network access would be an example of?
When information security falls under the Chief Information Officer (CIO), what is their MOST essential role?
A security officer wants to implement a vulnerability scanning program. The officer is uncertain of the state of vulnerability resiliency within the organization’s large IT infrastructure. What would be the BEST approach to minimize scan data output while retaining a realistic view of system vulnerability?
Which of the following is the MOST important benefit of an effective security governance process?
The remediation of a specific audit finding is deemed too expensive and will not be implemented. Which of the following is a TRUE statement?
When gathering security requirements for an automated business process improvement program, which of the following is MOST important?
The purpose of NIST SP 800-53 as part of the NIST System Certification and Accreditation Project is to establish a set of standardized, minimum security controls for IT systems addressing low, moderate, and high levels of concern for
As the Chief Information Security Officer, you want to ensure data shared securely, especially when shared with
third parties outside the organization. What protocol provides the ability to extend the network perimeter with
the use of encapsulation and encryption?
What is the GREATEST benefit of having an effective security governance process?
What is the PRIMARY guideline when analyzing the cost of a security control versus the cost of the asset?
When entering into a third party vendor agreement for security services, at what point in the process is it BEST to understand and validate the security posture and compliance level of the vendor?
Assigning the role and responsibility of Information Assurance to a dedicated and independent security group is an example of:
Which risk analysis method is the MOST effective for determining the exact financial impact of risks in an organization?
The executive board has requested that the CISO of an organization define and Key Performance Indicators (KPI) to measure the effectiveness of the security awareness program provided to call center employees. Which of the following can be used as a KPI?
What organizational structure combines the functional and project structures to create a hybrid of the two?
What is the BEST approach for managing shared elements from multiple regulations and standards?
When gathering security requirements for an automated business process improvement program, which of the following is MOST important?
John is the project manager for a large project in his organization. A new change request has been proposed that will affect several areas of the project. One area of the project change impact is on work that a vendor has already completed. The vendor is refusing to make the changes as they’ve already completed the project work they were contracted to do. What can John do in this instance?
Scenario: Your organization employs single sign-on (user name and password only) as a convenience to your employees to access organizational systems and data. Permission to individual systems and databases is vetted and approved through supervisors and data owners to ensure that only approved personnel can use particular applications or retrieve information. All employees have access to their own human resource information, including the ability to change their bank routing and account information and other personal details through the Employee Self-Service application. All employees have access to the organizational VPN.
Once supervisors and data owners have approved requests, information system administrators will implement
Which of the following best describes the sensors designed to project and detect a light beam across an area?
During an audit, what should the auditor do after identifying threats and potential impact?
What is the name of a formal statement that defines the strategy, approach, or expectations related to specific concerns within an organization:
What process evaluates technical and non-technical security controls to validate that an implementation meets a specific set of security requirements?
What standard provides a framework for information security risk management within organizations?
As the Chief Information Security Officer, you are performing an assessment of security posture to understand
what your Defense-in-Depth capabilities are. Which network security technology examines network traffic flows
to detect and actively stop vulnerability exploits and attacks?
What should an organization do to ensure that they have an effective Business Continuity Plan?
Which of the following is the MOST effective method for discovering common technical vulnerabilities within the
IT environment?
A global retail company is creating a new compliance management process. Which of the following regulations is of MOST importance to be tracked and managed by this process?
What is a difference from the list below between quantitative and qualitative Risk Assessment?
ABC Limited has recently suffered a security breach with customers’ social security number available on the dark web for sale. The CISO, during the time of the incident, has been fired, and you have been hired as the replacement. The analysis of the breach found that the absence of an insider threat program, lack of least privilege policy, and weak access control was to blame. You would like to implement key performance indicators to mitigate the risk.
Which metric would meet the requirement?
The newly appointed CISO of an organization is reviewing the IT security strategic plan. Which of the following is the MOST important component of the strategic plan?
When gathering security requirements for an enterprise software solution, which of the following is MOST important?
You are having a penetration test done on your company network and the leader of the team says they discovered all the network devices because no one had changed the Simple Network Management Protocol (SNMP) community strings from the defaults. Which of the following is a default community string?
During the course of a risk analysis your IT auditor identified threats and potential impacts. Next, your IT auditor should:
Your company has a “no right to privacy” notice on all logon screens for your information systems and users sign an Acceptable Use Policy informing them of this condition. A peer group member and friend comes to you and requests access to one of her employee’s email account. What should you do? (choose the BEST answer):
What would be the MOST likely reason a CISO sees abnormally high volumes of security exceptions within a number of business functions?
How often should the Statements of Standards for Attestation Engagements-16 (SSAE16)/International Standard on Assurance Engagements 3402 (ISAE3402) report of your vendors be reviewed?
Knowing the potential financial loss an organization is willing to suffer if a system fails is a determination of which of the following?
Which of the following are the MOST important factors for proactively determining system vulnerabilities?
You have been promoted to the CISO of a big-box retail store chain reporting to the Chief Information Officer (CIO). The CIO’s first mandate to you is to develop a cybersecurity compliance framework that will meet all the store’s compliance requirements.
Which of the following compliance standard is the MOST important to the organization?
What is the MAIN reason for conflicts between Information Technology and Information Security programs?
The security team has investigated the theft/loss of several unencrypted laptop computers containing sensitive corporate information. To prevent the loss of any additional corporate data it is unilaterally decided by the CISO that all existing and future laptop computers will be encrypted. Soon, the help desk is flooded with complaints about the slow performance of the laptops and users are upset. What did the CISO do wrong? (choose the BEST answer):
Which technology can provide a computing environment without requiring a dedicated hardware backend?
Which of the following statements below regarding Key Performance indicators (KPIs) are true?
SQL injection is a very popular and successful injection attack method. Identify the basic SQL injection text:
Which of the following best represents a calculation for Annual Loss Expectancy (ALE)?
What is a critical initial step when creating a Business Continuity Plan (BCP)?
Scenario: Your organization employs single sign-on (user name and password only) as a convenience to your employees to access organizational systems and data. Permission to individual systems and databases is vetted and approved through supervisors and data owners to ensure that only approved personnel can use particular applications or retrieve information. All employees have access to their own human resource information, including the ability to change their bank routing and account information and other personal details through the Employee Self-Service application. All employees have access to the organizational VPN.
Recently, members of your organization have been targeted through a number of sophisticated phishing attempts and have compromised their system credentials. What action can you take to prevent the misuse of compromised credentials to change bank account information from outside your organization while still allowing employees to manage their bank information?
Payment Card Industry (PCI) compliance requirements are based on what criteria?
A university recently hired a CISO. One of the first tasks is to develop a continuity of operations plan (COOP).
In developing the business impact assessment (BIA), which of the following MOST closely relate to the data backup and restoral?
An organization has a number of Local Area Networks (LANs) linked to form a single Wide Area Network
(WAN). Which of the following would BEST ensure network continuity?
IT control objectives are useful to IT auditors as they provide the basis for understanding the:
Which one of the following BEST describes which member of the management team is accountable for the day-to-day operation of the information security program?
What is the MOST effective approach to gaining business unit approval of security controls within an organization?
While designing a secondary data center for your company what document needs to be analyzed to determine to how much should be spent on building the data center?
Controls that were implemented to correct prior audit findings are insufficient. Before adjusting controls, what original document should be reviewed?
Which of the following provides the BEST approach to achieving positive outcomes while preserving savings?
An organization’s firewall technology needs replaced. A specific technology has been selected that is less costly than others and lacking in some important capabilities. The security officer has voiced concerns about sensitive data breaches but the decision is made to purchase. What does this selection indicate?
A system is designed to dynamically block offending Internet IP-addresses from requesting services from a secure website. This type of control is considered
Which of the following MOST heavily influences the information security governance model?
Which of the following represents the BEST method for obtaining business unit acceptance of security controls within an organization?
Which of the following best describes the purpose of the International Organization for Standardization (ISO) 27002 standard?
As the CISO, you have been tasked with the execution of the company’s key management program. You
MUST ensure the integrity of encryption keys at the point of generation. Which principal of encryption key
control will ensure no single individual can constitute or re-constitute a key?
What is the SECOND step to creating a risk management methodology according to the National Institute of Standards and Technology (NIST) SP 800-30 standard?
A system was hardened at the Operating System level and placed into the production environment. Months later an audit was performed and it identified insecure configuration different from the original hardened state. Which of the following security issues is the MOST likely reason leading to the audit findings?
Which risk assessment method would you use in order to rapidly determine risk within a business process?
When performing a forensic investigation, what are the two MOST common data sources for obtaining evidence from a computer and mobile devices?
When managing the critical path of an IT security project, which of the following is MOST important?
When assessing internal control objectives, what are the auditor's PRIMARY concerns?
What Enterprise Architecture Framework is business-centric and is composed of eight phases?
What is the term describing the act of inspecting all real-time Internet traffic (i.e., packets) traversing a major Internet backbone without introducing any apparent latency?
Which of the following is considered one of the most frequent failures in project management?
Which of the following is an IT governance framework that allows managers to bridge the gap between control requirements, technical issues, and business risks?
Which of the following reports should you as an IT auditor use to check on compliance with a service level agreement’s requirement for uptime?
When you develop your audit remediation plan what is the MOST important criteria?
Which of the following is the MAIN security concern for public cloud computing?
SCENARIO: A CISO has several two-factor authentication systems under review and selects the one that is most sufficient and least costly. The implementation project planning is completed and the teams are ready to implement the solution. The CISO then discovers that the product it is not as scalable as originally thought and will not fit the organization’s needs.
What is the MOST logical course of action the CISO should take?
The governing body that defines best practices for the collection of digital evidence is the:
A security professional has been promoted to be the CISO of an organization. The first task is to create a security policy for this organization. The CISO creates and publishes the security policy. This policy however, is ignored and not enforced consistently. Which of the following is the MOST likely reason for the policy shortcomings?
Which of the following is considered to be an IT governance framework and a supporting toolset that allows for managers to bridge the gap between control requirements, technical issues, and business risks?
The CIO of an organization has decided to assign the responsibility of internal IT audit to the IT team. This is consider a bad practice MAINLY because
In what phase of an incident management process will malware antivirus signatures be distributed to infrastructure?
A cloud computing environment that is bound together by technology that allows data and applications to be shared between public and private clouds is BEST referred to as a?
What is defined as the friction or opposition resulting from actual or perceived differences or incompatibilities?
Which of the following is the MOST logical method of deploying security controls within an organization?
TESTED 05 Jan 2026