An organization has defined a set of standard security controls. This organization has also defined the circumstances and conditions in which they must be applied.
What is the NEXT logical step in applying the controls in the organization?

• A.Create an architecture gap analysis
• B.Determine the risk tolerance
• C.Perform an asset classification
• D.Analyze existing controls on systems

Comment: *

Name: *

Email: *

Verification: *

What is the relationship between information protection and regulatory compliance?

• A.That all information in an organization must be protected equally.
• B.That the protection of some information such as National ID information is mandated by regulation and other information such as trade secrets are protected based on business need.
• C.The information required to be protected by regulatory mandate does not have to be identified in the organizations data classification policy.
• D.There is no relationship between the two.

Comment: *

Name: *

Email: *

Verification: *

Simon had all his systems administrators implement hardware and software firewalls to ensure network security. They implemented IDS/IPS systems throughout the network to check for and stop any unauthorized traffic that may attempt to enter. Although Simon and his administrators believed they were secure, a hacker group was able to get into the network and modify files hosted on the company's website. After searching through the firewall and server logs, no one could find how the attackers were able to get in. He decides that the entire network needs to be monitored for critical and essential file changes. This monitoring tool alerts administrators when a critical file is altered. What tool could Simon and his administrators implement to accomplish this?

• A.They need to use Nessus.
• B.They can implement Wireshark.
• C.Snort is the best tool for their situation.
• D.They could use Tripwire.

Comment: *

Name: *

Email: *

Verification: *

Which of the following represents the BEST method for obtaining business unit acceptance of security controls within an organization?

• A.Allow the business units to decide which controls apply to their systems, such as the encryption of sensitive data
• B.Ensure business units are involved in the creation of controls and defining conditions under which they must be applied
• C.Provide the business units with control mandates and schedules of audits for compliance validation
• D.Create separate controls for the business units based on the types of business and functions they perform

Comment: *

Name: *

Email: *

Verification: *

Scenario: You are the CISO and are required to brief the C-level executive team on your information security audit for the year. During your review of the audit findings you discover that many of the controls that were put in place the previous year to correct some of the findings are not performing as needed. You have thirty days until the briefing.
To formulate a remediation plan for the non-performing controls what other document do you need to review before adjusting the controls?

• A.Business Impact Analysis
• B.Business Continuity plan
• C.Security roadmap
• D.Annual report to shareholders

Comment: *

Name: *

Email: *

Verification: *