Involvement of senior management is MOST important in the development of:

• A.IT security procedures
• B.IT security implementation plans
• C.Standards and guidelines
• D.IT security policies

Comment: *

Name: *

Email: *

Verification: *

A system was hardened at the Operating System level and placed into the production environment. Months later an audit was performed and it identified insecure configuration different from the original hardened state. Which of the following security issues is the MOST likely reason leading to the audit findings?

• A.Lack of hardening standards
• B.Lack of proper access controls
• C.Lack of asset management processes
• D.Lack of change management processes

Comment: *

Name: *

Email: *

Verification: *

An audit was conducted and many critical applications were found to have no disaster recovery plans in place.
You conduct a Business Impact Analysis (BIA) to determine impact to the company for each application.
What should be the NEXT step?

• A.Create technology recovery plans
• B.Determine the annual loss expectancy (ALE)
• C.Build a secondary hot site
• D.Create a crisis management plan

Comment: *

Name: *

Email: *

Verification: *

A person in your security team calls you at night and informs you that one of your web applications is potentially under attack from a cross-site scripting vulnerability.
What do you do?

• A.tell him to call the police
• B.tell him to shut down the server
• C.tell him to analyze the problem, preserve the evidence and provide a full analysis and report.
• D.tell him to invoke the incident response process

Comment: *

Name: *

Email: *

Verification: *

A security professional has been promoted to be the CISO of an organization. The first task is to create a security policy for this organization. The CISO creates and publishes the security policy.
This policy however, is ignored and not enforced consistently. Which of the following is the MOST likely reason for the policy shortcomings?

• A.Lack of normal definition of roles and responsibilities
• B.Lack of a formal risk management policy
• C.Lack of a formal security awareness program
• D.Lack of a formal security policy governance process

Comment: *

Name: *

Email: *

Verification: *