Scenario: A Chief Information Security Officer (CISO) recently had a third party conduct an audit of the security program. Internal policies and international standards were used as audit baselines. The audit report was presented to the CISO and a variety of high, medium and low rated gaps were identified. The CISO has implemented remediation activities.
Which of the following is the MOST logical next step?

• A.Validate the effectiveness of applied controls
• B.Report the audit findings and remediation status to business stake holders
• C.Validate security program resource requirements
• D.Review security procedures to determine if they need modified according to findings

Comment: *

Name: *

Email: *

Verification: *

When creating contractual agreements and procurement processes why should security requirements be included?

• A.To make sure they are added on after the process is completed
• B.To make sure the costs of security is included and understood
• C.To make sure the security process aligns with the vendor's security process
• D.To make sure the patching process is included with the costs

Comment: *

Name: *

Email: *

Verification: *

Regulatory requirements typically force organizations to implement

• A.Mandatory controls
• B.Discretionary controls
• C.Optional controls
• D.Financial controls

Comment: *

Name: *

Email: *

Verification: *

Which of the following is MOST important when dealing with an Information Security Steering committee:

• A.Include a mix of members from different departments and staff levels.
• B.Ensure that security policies and procedures have been vetted and approved.
• C.Review all past audit and compliance reports.
• D.Be briefed about new trends and products at each meeting by a vendor.

Comment: *

Name: *

Email: *

Verification: *

What is the MOST critical output of the incident response process?

• A.A complete document of all involved team members and the support they provided
• B.Recovery of all data from affected systems
• C.Lessons learned from the incident, so they can be incorporated into the incident response processes
• D.Clearly defined documents detailing standard evidence collection and preservation processes

Comment: *

Name: *

Email: *

Verification: *