A new CISO just started with a company and on the CISO's desk is the last complete Information Security Management audit report. The audit report is over two years old.
After reading it, what should be the CISO's FIRST priority?

• A.Review the recommendations and follow up to see if audit implemented the changes
• B.Meet with audit team to determine a timeline for corrections
• C.Contract with an external audit company to conduct an unbiased audit
• D.Have internal audit conduct another audit to see what has changed.

Comment: *

Name: *

Email: *

Verification: *

Scenario: You are the newly hired Chief Information Security Officer for a company that has not previously had a senior level security practitioner. The company lacks a defined security policy and framework for their Information Security Program. Your new boss, the Chief Financial Officer, has asked you to draft an outline of a security policy and recommend an industry/sector neutral information security control framework for implementation.
Your Corporate Information Security Policy should include which of the following?

• A.Roles and responsibilities
• B.Desktop configuration standards
• C.Incident response contacts
• D.Information security theory

Comment: *

Name: *

Email: *

Verification: *

As a new CISO at a large healthcare company you are told that everyone has to badge in to get in the building.
Below your office window you notice a door that is normally propped open during the day for groups of people to take breaks outside. Upon looking closer, you see there is no badge reader.
What should you do?

• A.Post a guard at the door to maintain physical security
• B.Nothing, this falls outside your area of influence
• C.Close and chain the door shut and send a company-wide memo banning the practice
• D.A physical risk assessment on the facility

Comment: *

Name: *

Email: *

Verification: *

Network Forensics is the prerequisite for any successful legal action after attacks on your Enterprise Network. Which is the single most important factor to introducing digital evidence into a court of law?

• A.Uninterrupted Chain of Custody
• B.Comprehensive Log-Files from all servers and network devices affected during the attack
• C.Expert forensics witness
• D.Fully trained network forensic experts to analyze all data right after the attack

Comment: *

Name: *

Email: *

Verification: *

An organization's firewall technology needs replaced. A specific technology has been selected that is less costly than others and lacking in some important capabilities. The security officer has voiced concerns about sensitive data breaches but the decision is made to purchase. What does this selection indicate?

• A.I low vulnerability environment
• B.A high threat environment
• C.A high risk tolerance environment
• D.A low risk tolerance environment

Comment: *

Name: *

Email: *

Verification: *