clapgeek logo
A person in your security team calls you at night and informs you that one of your web applications is potentially under attack from a cross-site scripting vulnerability. What do you do?
Which of the following is considered one of the most frequent failures in project management?
Which of the following information may be found in table top exercises for incident response?
Which of the following functions evaluates risk present in IT initiatives and/or systems when implementing an information security program?
A CISO has recently joined an organization with a poorly implemented security program. The desire is to base the security program on a risk management approach. Which of the following is a foundational requirement in order to initiate this type of program?
To get an Information Security project back on schedule, which of the following will provide the MOST help?
Which of the following will be MOST helpful for getting an Information Security project that is behind schedule back on schedule?
Creating a secondary authentication process for network access would be an example of?
How often should an environment be monitored for cyber threats, risks, and exposures?
The remediation of a specific audit finding is deemed too expensive and will not be implemented. Which of the following is a TRUE statement?
Which of the following is a term related to risk management that represents the estimated frequency at which a threat is expected to transpire?
Which of the following is considered to be an IT governance framework and a supporting toolset that allows for managers to bridge the gap between control requirements, technical issues, and business risks?
Which of the following best describes the purpose of the International Organization for Standardization (ISO) 27002 standard?
If your organization operates under a model of "assumption of breach", you should:
Which of the following represents the HIGHEST negative impact resulting from an ineffective security governance program?
As the Risk Manager of an organization, you are task with managing vendor risk assessments. During the assessment, you identified that the vendor is engaged with high profiled clients, and bad publicity can jeopardize your own brand.
Which is the BEST type of risk that defines this event?
At which point should the identity access management team be notified of the termination of an employee?
You have purchased a new insurance policy as part of your risk strategy. Which of the following risk strategy options have you engaged in?
What is the relationship between information protection and regulatory compliance?
Which of the following is a MAJOR consideration when an organization retains sensitive customer data and uses this data to better target the organization’s products and services?
A business unit within your organization intends to deploy a new technology in a manner that places it in violation of existing information security standards. What immediate action should the information security manager take?
Scenario: As you begin to develop the program for your organization, you assess the corporate culture and determine that there is a pervasive opinion that the security program only slows things down and limits the performance of the “real workers.”
Which group of people should be consulted when developing your security program?
As the CISO, you have been tasked with the execution of the company’s key management program. You
MUST ensure the integrity of encryption keys at the point of generation. Which principal of encryption key
control will ensure no single individual can constitute or re-constitute a key?
The amount of risk an organization is willing to accept in pursuit of its mission is known as
Which of the following reports should you as an IT auditor use to check on compliance with a service level agreement’s requirement for uptime?
When a CISO considers delaying or not remediating system vulnerabilities which of the following are MOST important to take into account?
Which of the following is the MOST important reason to measure the effectiveness of an Information Security Management System (ISMS)?
Scenario: Your company has many encrypted telecommunications links for their world-wide operations. Physically distributing symmetric keys to all locations has proven to be administratively burdensome, but symmetric keys are preferred to other alternatives.
Symmetric encryption in general is preferable to asymmetric encryption when:
Which of the following is a primary method of applying consistent configurations to IT systems?
Scenario: Your program is developed around minimizing risk to information by focusing on people, technology, and operations.
An effective way to evaluate the effectiveness of an information security awareness program for end users, especially senior executives, is to conduct periodic:
Your company has limited resources to spend on security initiatives. The Chief Financial Officer asks you to prioritize the protection of information resources based on their value to the company. It is essential that you be able to communicate in language that your fellow executives will understand. You should:
What is the term describing the act of inspecting all real-time Internet traffic (i.e., packets) traversing a major Internet backbone without introducing any apparent latency?
Physical security measures typically include which of the following components?
The process of creating a system which divides documents based on their security level to manage access to private data is known as
Your penetration testing team installs an in-line hardware key logger onto one of your network machines. Which of the following is of major concern to the security organization?
A customer of a bank has placed a dispute on a payment for a credit card account. The banking system uses digital signatures to safeguard the integrity of their transactions. The bank claims that the system shows proof that the customer in fact made the payment. What is this system capability commonly known as?
Your incident handling manager detects a virus attack in the network of your company. You develop a signature based on the characteristics of the detected virus. Which of the following phases in the incident handling process will utilize the signature to resolve this incident?
Which of the following is a countermeasure to prevent unauthorized database access from web applications?
While designing a secondary data center for your company what document needs to be analyzed to determine to how much should be spent on building the data center?
SQL injection is a very popular and successful injection attack method. Identify the basic SQL injection text:
Which of the following statements about Encapsulating Security Payload (ESP) is true?
TESTED 04 May 2024