A security professional has been promoted to be the CISO of an organization. The first task is to create a security policy for this organization. The CISO creates and publishes the security policy. This policy however, is ignored and not enforced consistently. Which of the following is the MOST likely reason for the policy shortcomings?

• A.Lack of a formal risk management policy
• B.Lack of a formal security policy governance process
• C.Lack of a formal security awareness program
• D.Lack of formal definition of roles and responsibilities

Comment: *

Name: *

Email: *

Verification: *

Annual Loss Expectancy is derived from the function of which two factors?

• A.Annual rate of Occurrence and Asset Value
• B.Single Loss Expectancy and Exposure factor
• C.Safeguard value and Annual Rate of Occurrence
• D.Annual rate of Occurrence and Single Loss Expectancy

Comment: *

Name: *

Email: *

Verification: *

Acme Inc. has engaged a third party vendor to provide 99.999% up-time for their online web presence and had them contractually agree to this service level agreement. What type of risk tolerance is Acme exhibiting? (choose the BEST answer):

• A.medium-high risk-tolerance
• B.high risk-tolerance
• C.low risk-tolerance
• D.moderate risk-tolerance

Comment: *

Name: *

Email: *

Verification: *

Many times a CISO may have to speak to the Board of Directors (BOD) about their cyber security posture. What would be the BEST choice of security metrics to present to the BOD?

• A.All vulnerabilities that impact important production servers
• B.All vulnerabilities found on servers and desktops
• C.Only critical and high vulnerabilities on servers and desktops
• D.Only critical and high vulnerabilities that impact important production servers

Comment: *

Name: *

Email: *

Verification: *

Which of the following represents the HIGHEST negative impact resulting from an ineffective security governance program?

• A.Fines for regulatory non-compliance
• B.Reduction of budget
• C.Improper use of information resources
• D.Decreased security awareness

Comment: *

Name: *

Email: *

Verification: *