CISM Module 1 Practice Bank Questions

U001 / Practice 1 Q1 / Which of the following is responsible for legal and regulatory liability? A. Chief security officer (CSO) B. Chief legal counsel (CLC) C. Board and senior management D. Information security steering group

Source answer: C. Board and senior management | Source explanation: The board of directors and senior management are ultimately responsible for all that happens in the organization. The others are not individually liable for failures of security in the organization.

U002 / Practice 1 Q2; Practice 2 Q1 / When an organization is implementing an information security governance program, its board of directors should be responsible for: A. drafting information security policie B. reviewing training and awareness program C. setting the strategic direction of the progra D. auditing for complianc

Source answer: C. setting the strategic direction of the progra | Source explanation: A board of directors should establish the strategic direction of the program to ensure that it is in sync with the company's vision and business goals. The board must incorporate the governance program into the overall corporate business strategy. Drafting information security policies is best fulfilled by someone such as a security manager with the expertise to bring balance, scope and focus to the policies. Reviewing training and awareness programs may best be handled by security management and training staff to ensure that the training is on point and follows best practices. Auditing for compliance is best left to the internal and external auditors to provide an objective review of the program and how it meets regulatory and statutory compliance.

U004 / Practice 1 Q4; Practice 2 Q2 / The FIRST step in establishing a security governance program is to: A. conduct a risk assessmen B. conduct a workshop for all end user C. prepare a security budge D. obtain high-level sponsorshi

Source answer: D. obtain high-level sponsorshi | Source explanation: The establishment of a security governance program is possible only with the support and sponsorship of top management since security governance projects are enterprise wide and integrated into business processes. Conducting a risk assessment, conducting a workshop for all end users and preparing a security budget all follow once high-level sponsorship is obtained.

U005 / Practice 1 Q5 / It is MOST important that information security architecture be aligned with which of the following? A. Industry best practices B. Information technology plans C. Information security best practices D. Business objectives and goals

Source answer: D. Business objectives and goals | Source explanation: Information security architecture should always be properly aligned with business goals and objectives. Alignment with IT plans or industry and security best practices is secondary by comparison.

U007 / Practice 1 Q7 / Successful implementation of information security governance will FIRST require: A. security awareness trainin B. updated security policie C. a computer incident management tea D. a security architectur

Source answer: B. updated security policie | Source explanation: Updated security policies are required to align management objectives with security procedures; management objectives translate into policy, policy translates into procedures. Security procedures will necessitate specialized teams such as the computer incident response and management group as well as specialized tools such as the security mechanisms that comprise the security architecture. Security awareness will promote the policies, procedures and appropriate use of the security mechanisms.

U008 / Practice 1 Q8; Practice 2 Q7 / The MOST effective approach to address issues that arise between IT management, business units and security management when implementing a new security strategy is for the information security manager to: A. escalate issues to an external third party for resolutio B. ensure that senior management provides authority for security to address the issue C. insist that managers or units not in agreement with the security solution accept the ris D. refer the issues to senior management along with any security recommendation

Source answer: D. refer the issues to senior management along with any security recommendation | Source explanation: Senior management is in the best position to arbitrate since they will look at the overall needs of the business in reaching a decision. The authority may be delegated to others by senior management after their review of the issues and security recommendations. Units should not be asked to accept the risk without first receiving input from senior management.

U010 / Practice 1 Q10 / The PRIMARY objective of a security steering group is to: A. ensure information security covers all business function B. ensure information security aligns with business goal C. raise information security awareness across the organizatio D. implement all decisions on security management across the organizatio

Source answer: B. ensure information security aligns with business goal | Source explanation: The security steering group comprises senior management of key business functions and has the primary objective to align the security strategy with the business direction. Option A is incorrect because all business areas may not be required to be covered by information security; but, if they do, the main purpose of the steering committee would be alignment more so than coverage. While raising awareness is important, this goal would not be carried out by the committee itself. The steering committee may delegate part of the decision making to the information security manager; however, if it retains this authority, it is not the primary' goal.

U011 / Practice 1 Q10; Practice 2 Q16 / Information security governance is PRIMARILY driven by: A. technology constraint B. regulatory requirement C. litigation potentia D. business strateg

Source answer: D. business strateg | Source explanation: Governance is directly tied to the strategy and direction of the business. Technology constraints, regulatory requirements and litigation potential are all important factors, but they are necessarily in line with the business strategy.

U013 / Practice 1 Q17 / Which of the following is the MOST important factor when designing information security architecture? A. Technical platform interfaces B. Scalability of the network C. Development methodologies D. Stakeholder requirements

Source answer: D. Stakeholder requirements | Source explanation: The most important factor for information security is that it advances the interests of the business, as defined by stakeholder requirements. Interoperability and scalability, as well as development methodologies, are all important but are without merit if a technologically-elegant solution is achieved that does not meet the needs of the business.

U015 / Practice 1 Q20 / The MOST complete business case for security solutions is one that. A. includes appropriate justificatio B. explains the current risk profil C. details regulatory requirement D. identifies incidents and losse

Source answer: A. includes appropriate justificatio | Source explanation: Management is primarily interested in security solutions that can address risks in the most cost-effective way. To address the needs of an organization, a business case should address appropriate security solutions in line with the organizational strategy.

U016 / Practice 1 Q25; Practice 2 Q26 / What would a security manager PRIMARILY utilize when proposing the implementation of a security solution? A. Risk assessment report B. Technical evaluation report C. Business case D. Budgetary requirements

Source answer: C. Business case | Source explanation: The information security manager needs to prioritize the controls based on risk management and the requirements of the organization. The information security manager must look at the costs of the various controls and compare them against the benefit the organization will receive from the security solution. The information security manager needs to have knowledge of the development of business cases to illustrate the costs and benefits of the various controls. All other choices are supplemental.

U017 / Practice 1 Q28 / Which of the following is the MOST important prerequisite for establishing information security management within an organization? A. Senior management commitment B. Information security framework C. Information security organizational structure D. Information security policy

Source answer: A. Senior management commitment | Source explanation: Senior management commitment is necessary in order for each of the other elements to succeed. Without senior management commitment, the other elements will likely be ignored within the organization.

U019 / Practice 1 Q37 / From an information security perspective, information that no longer supports the main purpose of the business should be: A. analyzed under the retention polic B. protected under the information classification polic C. analyzed under the backup polic D. protected under the business impact analysis (BIA).

Source answer: A. analyzed under the retention polic | Source explanation: Option A is the type of analysis that will determine whether the organization is required to maintain the data for business, legal or regulatory reasons. Keeping data that are no longer required unnecessarily consumes resources, and, in the case of sensitive personal information, can increase the risk of data compromise. Options B. C and D are attributes that should be considered in the destruction and retention policy. A BIA could help determine that this information does not support the main objective of the business, but does not indicate the action to take.

U020 / Practice 1 Q42; Practice 2 Q53 / Which of the following is characteristic of centralized information security management? A. More expensive to administer B. Better adherence to policies C. More aligned with business unit needs D. Faster turnaround of requests

Source answer: B. Better adherence to policies | Source explanation: Centralization of information security management results in greater uniformity and better adherence to security policies. It is generally less expensive to administer due to the economics of scale. However, turnaround can be slower due to the lack of alignment with business units.

U021 / Practice 1 Q47 / Senior management commitment and support for information security can BEST be obtained through presentations that: A. use illustrative examples of successful attack B. explain the technical risks to the organizatio C. evaluate the organization against best security practice D. tie security risks to key business objective

Source answer: D. tie security risks to key business objective | Source explanation: Senior management seeks to understand the business justification for investing in security. This can best be accomplished by tying security to key business objectives. Senior management will not be as interested in technical risks or examples of successful attacks if they are not tied to the impact on business environment and objectives. Industry best practices are important to senior management but, again, senior management will give them the right level of importance when they are presented in terms of key business objectives.

U022 / Practice 1 Q51 / Effective IT governance is BEST ensured by: A. utilizing a bottom-up approac B. management by the IT departmen C. referring the matter to the organization's legal departmen D. utilizing a top-down approac

Source answer: D. utilizing a top-down approac | Source explanation: Effective IT governance needs to be a top-down initiative, with the board and executive management setting clear policies, goals and objectives and providing for ongoing monitoring of the same. Focus on the regulatory issues and management priorities may not be reflected effectively by a bottom-up approach. IT governance affects the entire organization and is not a matter concerning only the management of IT. The legal department is part of the overall governance process, but cannot take full responsibility.

U024 / Practice 1 Q57 / The MOST basic requirement for an information security governance program is to: A. be aligned with the corporate business strateg B. be based on a sound risk management approac C. provide adequate regulatory complianc D. provide best practices for security- initiative

Source answer: A. be aligned with the corporate business strateg | Source explanation: To receive senior management support, an information security program should be aligned with the corporate business strategy. Risk management is a requirement of an information security program which should take into consideration the business strategy. Security governance is much broader than just regulatory compliance. Best practice is an operational concern and does not have a direct impact on a governance program.

U025 / Practice 1 Q60 / The organization has decided to outsource the majority of the IT department with a vendor that is hosting servers in a foreign country. Of the following, which is the MOST critical security consideration? A. Laws and regulations of the country of origin may not be enforceable in the foreign countr B. A security breach notification might get delayed due to the time differenc C. Additional network intrusion detection sensors should be installed, resulting in an additional cos D. The company could lose physical control over the server and be unable to monitor the physical security posture of the server

Source answer: A. Laws and regulations of the country of origin may not be enforceable in the foreign countr | Source explanation: A company is held to the local laws and regulations of the country in which the company resides, even if the company decides to place servers with a vendor that hosts the servers in a foreign country. A potential violation of local laws applicable to the company might not be recognized or rectified (i.e., prosecuted) due to the lack of knowledge of the local laws that are applicable and the inability to enforce the laws. Option B is not a problem. Time difference does not play a role in a 24/7 environment. Pagers, cellular phones, telephones, etc. are usually available to communicate notifications. Option C is a manageable problem that requires additional funding, but can be addressed. Option D is a problem that can be addressed. Most hosting providers have standardized the level of physical security that is in place. Regular physical audits or a SAS 70 report can address such concerns.

U026 / Practice 1 Q62; Practice 2 Q73 / Obtaining senior management support for establishing a warm site can BEST be accomplished by: A. establishing a periodic risk assessmen B. promoting regulatory requirement C. developing a business cas D. developing effective metric

Source answer: C. developing a business cas | Source explanation: Business case development, including a cost-benefit analysis, will be most persuasive to management. A risk assessment may be included in the business ease, but by itself will not be as effective in gaining management support. Informing management of regulatory requirements may help gain support for initiatives, but given that more than half of all organizations are not in compliance with regulations, it is unlikely to be sufficient in many cases. Good metrics which provide assurance that initiatives are meeting organizational goals will also be useful, but are insufficient in gaining management support.

U027 / Practice 1 Q67 / A security manager is preparing a report to obtain the commitment of executive management to a security program. Inclusion of which of the following would be of MOST value? A. Examples of genuine incidents at similar organizations B. Statement of generally accepted best practices C. Associating realistic threats to corporate objectives D. Analysis of current technological exposures

Source answer: C. Associating realistic threats to corporate objectives | Source explanation: Linking realistic threats to key business objectives will direct executive attention to them. All other options are supportive but not of as great a value as choice C when trying to obtain the funds for a new program.

U028 / Practice 1 Q71; Practice 2 Q81 / When identifying legal and regulatory issues affecting information security, which of the following would represent the BEST approach to developing information security policies? A. Create separate policies to address each regulation B. Develop policies that meet all mandated requirements C. Incorporate policy statements provided by regulators D. Develop a compliance risk assessment

Source answer: B. Develop policies that meet all mandated requirements | Source explanation: It will be much more efficient to craft all relevant requirements into policies than to create separate versions. Using statements provided by regulators will not capture all of the requirements mandated by different regulators. A compliance risk assessment is an important tool to verify that procedures ensure compliance once the policies have been established.

U029 / Practice 1 Q73 / Who is ultimately responsible for the organization's information? A. Data custodian B. Chief information security officer (CISO) C. Board of directors D. Chief information officer (CIO)

Source answer: C. Board of directors | Source explanation: The board of directors is ultimately responsible for the organization's information and is tasked with responding to issues that affect its protection. The data custodian is responsible for the maintenance and protection of data. This role is usually filled by the IT department. The chief information security officer (CISO) is responsible for security and carrying out senior management's directives. The chief information officer (CIO) is responsible for information technology within the organization and is not ultimately responsible for the organization's information.

U030 / Practice 1 Q77; Practice 2 Q89 / A good privacy statement should include: A. notification of liability on accuracy of informatio B. notification that information will be encrypte C. what the company will do with information it collect D. a description of the information classification proces

Source answer: C. what the company will do with information it collect | Source explanation: Most privacy laws and regulations require disclosure on how information will be used. Choice A is incorrect because that information should be located in the web site's disclaimer. Choice B is incorrect because, although encryption may be applied, this is not generally disclosed. Choice D is incorrect because information classification would be contained in a separate policy.

U031 / Practice 1 Q82 / An information security strategy document that includes specific links to an organization's business activities is PRIMARILY an indicator of: A. performance measuremen B. integratio C. alignmen D. value deliver

Source answer: C. alignmen | Source explanation: Strategic alignment of security with business objectives is a key indicator of performance measurement. In guiding a security program, a meaningful performance measurement will also rely on an understanding of business objectives, which will be an outcome of alignment. Business linkages do not by themselves indicate integration or value delivery. While alignment is an important precondition, it is not as important an indicator.

U032 / Practice 1 Q87; Practice 2 Q92 / Retention of business records should PRIMARILY be based on: A. business strategy and directio B. regulatory and legal requirement C. storage capacity and longevit D. business ease and value analysi

Source answer: B. regulatory and legal requirement | Source explanation: Retention of business records is generally driven by legal and regulatory requirements. Business strategy and direction would not normally apply nor would they override legal and regulatory requirements. Storage capacity and longevity are important but secondary issues. Business case and value analysis would be secondary to complying with legal and regulatory requirements.

U033 / Practice 1 Q89 / To achieve effective strategic alignment of security initiatives, it is important that: A. Steering committee leadership be selected by rotatio B. Inputs be obtained and consensus achieved between the major organizational unit C. The business strategy be updated periodicall D. Procedures and standards be approved by all departmental head

Source answer: B. Inputs be obtained and consensus achieved between the major organizational unit | Source explanation: It is important to achieve consensus on risks and controls, and obtain inputs from various organizational entities since security needs to be aligned to the needs of the organization. Rotation of steering committee leadership does not help in achieving strategic alignment. Updating business strategy does not lead to strategic alignment of security initiatives. Procedures and standards need not be approved by all departmental heads

U034 / Practice 1 Q92 / An organization's board of directors has learned of recent legislation requiring organizations within the industry to enact specific safeguards to protect confidential customer information. What actions should the board take next? A. Direct information security on what they need to do B. Research solutions to determine the proper solutions C. Require management to report on compliance D. Nothing; information security does not report to the board

Source answer: C. Require management to report on compliance | Source explanation: Information security governance is the responsibility of the board of directors and executive management. In this instance, the appropriate action is to ensure that a plan is in place for implementation of needed safeguards and to require updates on that implementation.

U037 / Practice 1 Q101 / When implementing effective security governance within the requirements of the company's security strategy, which of the following is the MOST important factor to consider? A. Preserving the confidentiality of sensitive data B. Establishing international security standards for data sharing C. Adhering to corporate privacy standards D. Establishing system manager responsibility for information security

Source answer: A. Preserving the confidentiality of sensitive data | Source explanation: The goal of information security is to protect the organization's information assets. International security standards are situational, depending upon the company and its business. Adhering to corporate privacy standards is important, but those standards must be appropriate and adequate and are not the most important factor to consider. All employees are responsible for information security, but it is not the most important factor to consider.

U038 / Practice 1 Q106; Practice 2 Q101 / On a company's e-commerce web site, a good legal statement regarding data privacy should include: A. a statement regarding what the company will do with the information it collect B. a disclaimer regarding the accuracy of information on its web sit C. technical information regarding how information is protecte D. a statement regarding where the information is being hoste

Source answer: A. a statement regarding what the company will do with the information it collect | Source explanation: Most privacy laws and regulations require disclosure on how information will be used. A disclaimer is not necessary since it does not refer to data privacy. Technical details regarding how information is protected are not mandatory to publish on the web site and in fact would not be desirable. It is not mandatory to say where information is being hosted.

U040 / Practice 1 Q111; Practice 2 Q110 / Which of the following is the BEST justification to convince management to invest in an information security program? A. Cost reduction B. Compliance with company policies C. Protection of business assets D. Increased business value

Source answer: D. Increased business value | Source explanation: Investing in an information security program should increase business value and confidence. Cost reduction by itself is rarely the motivator for implementing an information security program. Compliance is secondary to business value. Increasing business value may include protection of business assets.

U041 / Practice 1 Q114; Practice 2 Q115 / What is the MAIN risk when there is no user management representation on the Information Security Steering Committee? A. Functional requirements are not adequately considere B. User training programs may be inadequat C. Budgets allocated to business units are not appropriat D. Information security plans are not aligned with business requirements

Source answer: D. Information security plans are not aligned with business requirements | Source explanation: The steering committee controls the execution of the information security strategy, according to the needs of the organization, and decides on the project prioritization and the execution plan. User management is an important group that should be represented to ensure that the information security plans are aligned with the business needs. Functional requirements and user training programs are considered to be part of the projects but are not the main risks. The steering committee does not approve budgets for business units.

U042 / Practice 1 Q116 / Which of the following should be the FIRST step in developing an information security plan? A. Perform a technical vulnerabilities assessment B. Analyze the current business strategy C. Perform a business impact analysis D. Assess the current levels of security awareness

Source answer: B. Analyze the current business strategy | Source explanation: Prior to assessing technical vulnerabilities or levels of security awareness, an information security manager needs to gain an understanding of the current business strategy and direction. A business impact analysis should be performed prior to developing a business continuity plan, but this would not be an appropriate first step in developing an information security strategy because it focuses on availability.

U043 / Practice 1 Q117; Practice 2 Q119 / When designing an information security quarterly report to management, the MOST important element to be considered should be the: A. information security metric B. knowledge required to analyze each issu C. linkage to business area objective D. baseline against which metrics are evaluate

Source answer: C. linkage to business area objective | Source explanation: The link to business objectives is the most important clement that would be considered by management. Information security metrics should be put in the context of impact to management objectives. Although important, the security knowledge required would not be the first element to be considered. Baselining against the information security metrics will be considered later in the process.

U045 / Practice 1 Q123; Practice 2 Q122 / An information security manager at a global organization has to ensure that the local information security program will initially ensure compliance with the: A. corporate data privacy polic B. data privacy policy where data are collecte C. data privacy policy of the headquarters' countr D. data privacy directive applicable globall

Source answer: B. data privacy policy where data are collecte | Source explanation: As a subsidiary, the local entity will have to comply with the local law for data collected in the country. Senior management will be accountable for this legal compliance. The policy, being internal, cannot supersede the local law. Additionally, with local regulations differing from the country in which the organization is headquartered, it is improbable that a group wide policy will address all the local legal requirements. In case of data collected locally (and potentially transferred to a country with a different data privacy regulation), the local law applies, not the law applicable to the head office. The data privacy laws are country-specific.

U046 / Practice 1 Q124 / When an organization hires a new information security manager, which of the following goals should this individual pursue FIRST? A. Develop a security architecture B. Establish good communication with steering committee members C. Assemble an experienced staff D. Benchmark peer organizations

Source answer: B. Establish good communication with steering committee members | Source explanation: New information security managers should seek to build rapport and establish lines of communication with senior management to enlist their support. Benchmarking peer organizations is beneficial to better understand industry best practices, but it is secondary to obtaining senior management support. Similarly, developing a security architecture and assembling an experienced staff are objectives that can be obtained later.

U047 / Practice 1 Q129 / Which of the following represents the MAJOR focus of privacy regulations? A. Unrestricted data mining B. Identity theft C. Human rights protection D. Identifiable personal data

Source answer: D. Identifiable personal data | Source explanation: Protection of identifiable personal data is the major focus of recent privacy regulations such as the Health Insurance Portability and Accountability Act (HIPAA). Data mining is an accepted tool for ad hoc reporting; it could pose a threat to privacy only if it violates regulator)' provisions. Identity theft is a potential consequence of privacy violations but not the main focus of many regulations. Human rights addresses privacy issues but is not the main focus of regulations.

U048 / Practice 1 Q134; Practice 2 Q127 / Which of the following situations would MOST inhibit the effective implementation of security governance: A. The complexity of technology B. Budgetary constraints C. Conflicting business priorities D. High-level sponsorship

REVIEW NOTE: BROKEN KEY / WORDING: The source says D (high-level sponsorship) inhibits governance, but its explanation says sponsorship is essential. Likely missing "lack of" in option D. Do not memorize the printed claim as correct; confirm the intended wording with your instructor. | Source answer: D. High-level sponsorship | Source explanation: The need for senior management involvement and support is a key success factor for the implementation of appropriate security governance. Complexity of technology, budgetary constraints and conflicting business priorities are realities that should be factored into the governance model of the organization, and should not be regarded as inhibitors.

U050 / Practice 1 Q139 / The MOST appropriate role for senior management in supporting information security is the: A. evaluation of vendors offering security product B. assessment of risks to the organizatio C. approval of policy statements and fundin D. monitoring adherence to regulatory requirement

Source answer: C. approval of policy statements and fundin | Source explanation: Since the members of senior management are ultimately responsible for information security, they are the ultimate decision makers in terms of governance and direction. They are responsible for approval of major policy statements and requests to fund the information security practice. Evaluation of vendors, assessment of risks and monitoring compliance with regulatory requirements are day-to-day responsibilities of the information security manager; in some organizations, business management is involved in these other activities, though their primary role is direction and governance.

U051 / Practice 1 Q140 / Which of the following requirements would have the lowest level of priority in information security? A. Technical B. Regulatory C. Privacy D. Business

Source answer: A. Technical | Source explanation: Information security priorities may, at times, override technical specifications, which then must be rewritten to conform to minimum security standards. Regulatory and privacy requirements are government-mandated and, therefore, not subject to override. The needs of the business should always take precedence in deciding information security priorities.

U052 / Practice 1 Q143 / Which of the following would be MOST helpful to achieve alignment between information security and organization objectives? A. Key control monitoring B. A robust security awareness program C. A security program that enables business activities D. An effective security architecture

Source answer: C. A security program that enables business activities | Source explanation: A security program enabling business activities would be most helpful to achieve alignment between information security and organization objectives. All of the other choices are part of the security program and would not individually and directly help as much as the security program.

U053 / Practice 1 Q144; Practice 2 Q128 / The MOST important component of a privacy policy is: A. notification B. warrantie C. liabilitie D. geographic coverag

Source answer: A. notification | Source explanation: Privacy policies must contain notifications and opt-out provisions: they are a high-level management statement of direction. They do not necessarily address warranties, liabilities or geographic coverage, which are more specific.

U054 / Practice 1 Q149 / Which of the following would be the MOST important goal of an information security governance program? A. Review of internal control mechanisms B. Effective involvement in business decision making C. Total elimination of risk factors D. Ensuring trust in data

Source answer: D. Ensuring trust in data | Source explanation: The development of trust in the integrity of information among stakeholders should be the primary goal of information security governance. Review of internal control mechanisms relates more to auditing, while the total elimination of risk factors is not practical or possible. Proactive involvement in business decision making implies that security needs dictate business needs when, in fact, just the opposite is true. Involvement in decision making is important only to ensure business data integrity so that data can be trusted.

U055 / Practice 1 Q154 / A security manager meeting the requirements for the international flow of personal data will need to ensure: A. a data processing agreemen B. a data protection registratio C. the agreement of the data subject D. subject access procedure

REVIEW NOTE: SOURCE CAUTION: The supplied key is C. The explanation presents consent as a universal requirement for international transfers; treat that as an oversimplified bank statement, not a universal legal rule. | Source answer: C. the agreement of the data subject | Source explanation: Whenever personal data are transferred across national boundaries, the awareness and agreement of the data subjects are required. Choices A, B and D are supplementary data protection requirements that are not key for international data transfer.

U057 / Practice 1 Q163 / Senior management commitment and support for information security can BEST be enhanced through: A. a formal security policy sponsored by the chief executive officer (CEO). B. regular security awareness training for employee C. periodic review of alignment with business management goal D. senior management signoff on the information security strateg

Source answer: C. periodic review of alignment with business management goal | Source explanation: Ensuring that security activities continue to be aligned and support business goals is critical to obtaining their support. Although having the chief executive officer (CEO) signoff on the security policy and senior management signoff on the security strategy makes for good visibility and demonstrates good tone at the top, it is a one-time discrete event that may be quickly forgotten by senior management. Security awareness training for employees will not have as much effect on senior management commitment.

U058 / Practice 1 Q168; Practice 2 Q137 / The BEST way to justify the implementation of a single sign-on (SSO) product is to use: A. return on investment (RO B. a vulnerability assessmen C. annual loss expectancy (ALE). D. a business cas

Source answer: D. a business cas | Source explanation: A business case shows both direct and indirect benefits, along with the investment required and the expected returns, thus making it useful to present to senior management. Return on investment (ROD would only provide the costs needed to preclude specific risks, and would not provide other indirect benefits such as process improvement and learning. A vulnerability assessment is more technical in nature and would only identify and assess the vulnerabilities. This would also not provide insights on indirect benefits. Annual loss expectancy (ALE) would not weigh the advantages of implementing single sign-on (SSO) in comparison to the cost of implementation.

U059 / Practice 1 Q170; Practice 2 Q141 / Which of the following individuals would be in the BEST position to sponsor the creation of an information security steering group? A. Information security manager B. Chief operating officer (COO) C. Internal auditor D. Legal counsel

Source answer: B. Chief operating officer (COO) | Source explanation: The chief operating officer (COO) is highly-placed within an organization and has the most knowledge of business operations and objectives. The chief internal auditor and chief legal counsel are appropriate members of such a steering group. However, sponsoring the creation of the steering committee should be initiated by someone versed in the strategy and direction of the business. Since a security manager is looking to this group for direction, they are not in the best position to oversee formation of this group.

U061 / Practice 1 Q173 / An information security manager must understand the relationship between information security and business operations in order to: A. support organizational objective B. determine likely areas of noncomplianc C. assess the possible impacts of compromis D. understand the threats to the busines

Source answer: A. support organizational objective | Source explanation: Security exists to provide a level of predictability for operations, support for the activities of the organization and to ensure preservation of the organization. Business operations must be the driver for security activities in order to set meaningful objectives, determine and manage the risks to those activities, and provide a basis to measure the effectiveness of and provide guidance to the security program. Regulatory compliance may or may not be an organizational requirement. If compliance is a requirement, some level of compliance must be supported but compliance is only one aspect. It is necessary to understand the business goals in order to assess potential impacts and evaluate threats. These are some of the ways in which security supports organizational objectives, but they are not the only ways.

U063 / Practice 1 Q179 / An information security manager at a global organization that is subject to regulation by multiple governmental jurisdictions with differing requirements should: A. bring all locations into conformity with the aggregate requirements of all governmental jurisdiction B. establish baseline standards for all locations and add supplemental standards as require C. bring all locations into conformity with a generally accepted set of industry best practice D. establish a baseline standard incorporating those requirements that all jurisdictions have in commo

Source answer: B. establish baseline standards for all locations and add supplemental standards as require | Source explanation: It is more efficient to establish a baseline standard and then develop additional standards for locations that must meet specific requirements. Seeking a lowest common denominator or just using industry best practices may cause certain locations to fail regulatory compliance. The opposite approach—forcing all locations to be in compliance with the regulations places an undue burden on those locations.

U064 / Practice 1 Q184 / The FIRST step to create an internal culture that focuses on information security is to: A. implement stronger control B. conduct periodic awareness trainin C. actively monitor operation D. gain the endorsement of executive managemen

Source answer: D. gain the endorsement of executive managemen | Source explanation: Endorsement of executive management in the form of policies provides direction and awareness. The implementation of stronger controls may lead to circumvention. Awareness training is important, but must be based on policies. Actively monitoring operations will not affect culture at all levels.

U093 / Practice 1 Q274 / An organization is already certified to an international security standard. Which mechanism would BEST help to further align the organization with other data security regulatory requirements as per new business needs? A. Key performance indicators (KPIs) B. Business impact analysis (BIA) C. Gap analysis D. Technical vulnerability assessment

Source answer: C. Gap analysis | Source explanation: Gap analysis would help identify the actual gaps between the desired state and the current implementation of information security management. BIA is primarily used for business continuity planning. Technical vulnerability assessment is used for detailed assessment of technical controls, which would come later in the process and would not provide complete information in order to identify gaps.

U117 / Practice 1 Q346; Practice 2 Q274 / Which of the following would be MOST relevant to include in a cost-benefit analysis of a two-factor authentication system? A. Annual loss expectancy (ALE) of incidents B. Frequency of incidents C. Total cost of ownership (TCO) D. Approved budget for the project

Source answer: C. Total cost of ownership (TCO) | Source explanation: The total cost of ownership (TCO) would be the most relevant piece of information in that it would establish a cost baseline and it must be considered for the full life cycle of the control. Annual loss expectancy (ALE) and the frequency of incidents could help measure the benefit, but would have more of an indirect relationship as not all incidents may be mitigated by implementing a two-factor authentication system. The approved budget for the project may have no bearing on what the project may actually cost.

U118 / Practice 1 Q348; Practice 2 Q278 / An information security organization should PRIMARILY: A. support the business objectives of the company by providing security-related support service B. be responsible for setting up and documenting the information security responsibilities of the information security team member C. ensure that the information security policies of the company are in line with global best practices and standard D. ensure that the information security expectations are conveyed to employee

Source answer: A. support the business objectives of the company by providing security-related support service | Source explanation: The information security organization is responsible for options B and D within an organization, but they are not its primary mission. Reviewing and adopting appropriate standards (option C) is a requirement. The primary objective of an information security organization is to ensure that security supports the overall business objectives of the company.

U124 / Practice 1 Q363 / In assessing the degree to which an organization may be affected by new privacy legislation, information security management should FIRST: A. develop an operational plan for achieving compliance with the legislatio B. identify systems and processes that contain privacy component C. restrict the collection of personal information until complian D. identify privacy legislation in other countries that may contain similar requirement

Source answer: B. identify systems and processes that contain privacy component | Source explanation: Identifying the relevant systems and processes is the best first step. Developing an operational plan for achieving compliance with the legislation is incorrect because it is not the first step. Restricting the collection of personal information comes later. Identifying privacy legislation in other countries would not add much value.

U133 / Practice 1 Q395; Practice 2 Q297 / Who can BEST advocate the development of and ensure the success of an information security program? A. Internal auditor B. Chief operating officer (COO) C. Steering committee D. IT management

Source answer: C. Steering committee | Source explanation: Senior management represented in the security steering committee is in the best position to advocate the establishment of and continued support for an information security program. The chief operating officer (COO) will be a member of that committee. An internal auditor is a good advocate but is secondary to the influence of senior management. IT management has a lesser degree of influence and would also be part of the steering committee.

U139 / Practice 1 Q411; Practice 2 Q325 / An information security program should be sponsored by: A. infrastructure managemen B. the corporate audit departmen C. key business process owner D. information security managemen

Source answer: C. key business process owner | Source explanation: The information security program should ideally be sponsored by business managers, as represented by key business process owners. Infrastructure management is not sufficiently independent and lacks the necessary knowledge regarding specific business requirements. A corporate audit department is not in as good a position to fully understand how an information security program needs to meet the needs of the business. Audit independence and objectivity will be lost, impeding traditional audit functions. Information security implements and executes the program. Although it should promote it at all levels, it cannot sponsor the effort due to insufficient operational knowledge and lack of proper authority.

U142 / Practice 1 Q415 / Who can BEST approve plans to implement an information security governance framework? A. Internal auditor B. Information security management C. Steering committee D. Infrastructure management

Source answer: C. Steering committee | Source explanation: Senior management that is part of the security steering committee is in the best position to approve plans to implement an information security governance framework. An internal auditor is secondary' to the authority and influence of senior management. Information security management should not have the authority to approve the security governance framework. Infrastructure management will not be in the best position since it focuses more on the technologies than on the business.

U151 / Practice 1 Q442; Practice 2 Q348 / Which of the following is the MOST important reason why information security objectives should be defined? A. Tool for measuring effectiveness B. General understanding of goals C. Consistency with applicable standards D. Management sign-off and support initiatives

Source answer: A. Tool for measuring effectiveness | Source explanation: The creation of objectives can be used in part as a source of measurement of the effectiveness of information security management, which feeds into the overall governance. General understanding of goals and consistency with applicable standards are useful, but are not the primary reasons for having clearly defined objectives. Gaining management understanding is important, but by itself will not provide the structure for governance.

U158 / Practice 1 Q465 / When application-level security controlled by business process owners is found to be poorly managed, which of the following could BEST improve current practices? A. Centralizing security management B. Implementing sanctions for noncompliance C. Policy enforcement by IT management D. Periodic compliance reviews

Source answer: A. Centralizing security management | Source explanation: By centralizing security management, the organization can ensure that security standards are applied to all systems equally and in line with established policy. Sanctions for noncompliance would not be the best way to correct poor management practices caused by work overloads or insufficient knowledge of security practices. Enforcement of policies is not solely the responsibility of IT management. Periodic compliance reviews would not correct the problems, by themselves, although reports to management would trigger corrective action such as centralizing security management.

U161 / Practice 2 Q4 / Which of the following would BEST ensure the success of information security governance within an organization? A. Steering committees approve security projects B. Security policy training provided to all managers C. Security training available to all employees on the intranet D. Steering committees enforce compliance with laws and regulations

Source answer: A. Steering committees approve security projects | Source explanation: The existence of a steering committee that approves all security projects would be an indication of the existence of a good governance program. Compliance with laws and regulations is part of the responsibility of the steering committee but it is not a full answer. Awareness training is important at all levels in any medium, and also an indicator of good governance. However, it must be guided and approved as a security project by the steering committee.

U162 / Practice 2 Q6 / From an information security manager perspective, what is the immediate benefit of clearly-defined roles and responsibilities? A. Enhanced policy compliance B. Improved procedure flows C. Segregation of duties D. Better accountability

Source answer: D. Better accountability | Source explanation: Without well-defined roles and responsibilities, there cannot be accountability. Choice A is incorrect because policy compliance requires adequately defined accountability first and therefore is a byproduct. Choice B is incorrect because people can be assigned to execute procedures that are not well designed. Choice C is incorrect because segregation of duties is not automatic, and roles may still include conflicting duties.

U163 / Practice 2 Q8 / Which of the following BEST contributes to the development of a security governance framework that supports the maturity model concept? A. Continuous analysis, monitoring and feedback B. Continuous monitoring of the return on security investment (ROSD C. Continuous risk reduction D. Key risk indicator (KRD setup to security management processes

Source answer: A. Continuous analysis, monitoring and feedback | Source explanation: To improve the governance framework and achieve a higher level of maturity, an organization needs to conduct continuous analysis, monitoring and feedback compared to the current state of maturity. Return on security investment (ROSD may show the performance result of the security-related activities; however, the result is interpreted in terms of money and extends to multiple facets of security initiatives. Thus, it may not be an adequate option. Continuous risk reduction would demonstrate the effectiveness of the security governance framework, but does not indicate a higher level of maturity. Key risk indicator (KRD setup is a tool to be used in internal control assessment. KRI setup presents a threshold to alert management when controls are being compromised in business processes. This is a control tool rather than a maturity model support tool.

U164 / Practice 2 Q9 / Who is responsible for ensuring that information is categorized and that specific protective measures are taken? A. The security officer B. Senior management C. The end user D. The custodian

Source answer: B. Senior management | Source explanation: Routine administration of all aspects of security is delegated, but top management must retain overall responsibility. The security officer supports and implements information security for senior management. The end user does not perform categorization. The custodian supports and implements information security measures as directed.

U166 / Practice 2 Q10 / Investments in information security technologies should be based on: A. vulnerability assessment B. value analysi C. business climat D. audit recommendation

Source answer: B. value analysi | Source explanation: Investments in security technologies should be based on a value analysis and a sound business case. Demonstrated value takes precedence over the current business climate because it is ever changing. Basing decisions on audit recommendations would be reactive in nature and might not address the key business needs comprehensively. Vulnerability assessments are useful, but they do not determine whether the cost is justified.

U167 / Practice 2 Q14 / Which of the following MOST commonly falls within the scope of an information security governance steering committee? A. Interviewing candidates for information security specialist positions B. Developing content for security awareness programs C. Prioritizing information security initiatives D. Approving access to critical financial systems

Source answer: C. Prioritizing information security initiatives | Source explanation: Prioritizing information security initiatives is the only appropriate item. The interviewing of specialists should be performed by the information security manager, while the developing of program content should be performed by the information security staff. Approving access to critical financial systems is the responsibility of individual system data owners.

U168 / Practice 2 Q21 / When an information security manager is developing a strategic plan for information security, the timeline for the plan should be: A. aligned with the IT strategic pla B. based on the current rate of technological chang C. three-to-five years for both hardware and softwar D. aligned with the business strateg

Source answer: D. aligned with the business strateg | Source explanation: Any planning for information security should be properly aligned with the needs of the business. Technology should not come before the needs of the business, nor should planning be done on an artificial timetable that ignores business needs.

U169 / Practice 2 Q30 / Senior management commitment and support for information security will BEST be attained by an information security manager by emphasizing: A. organizational ris B. organization wide metric C. security need D. the responsibilities of organizational unit

Source answer: A. organizational ris | Source explanation: Information security exists to help the organization meet its objectives. The information security manager should identify information security needs based on organizational needs. Organizational or business risk should always take precedence. Involving each organizational unit in information security and establishing metrics to measure success will be viewed favorably by senior management after the overall organizational risk is identified.

U170 / Practice 2 Q35 / Which of the following is a benefit of information security governance? A. Reduction of the potential for civil or legal liability B. Questioning trust in vendor relationships C. Increasing the risk of decisions based on incomplete management information D. Direct involvement of senior management in developing control processes

Source answer: A. Reduction of the potential for civil or legal liability | Source explanation: Information security governance decreases the risk of civil or legal liability. The remaining answers are incorrect. Option D appears to be correct, but senior management would provide oversight and approval as opposed to direct involvement in developing control processes.

U172 / Practice 2 Q45 / The PRIMARY goal in developing an information security strategy is to: A. establish security metrics and performance monitorin B. educate business process owners regarding their dutie C. ensure that legal and regulatory requirements are met D. support the business objectives of the organizatio

Source answer: D. support the business objectives of the organizatio | Source explanation: The business objectives of the organization supersede all other factors. Establishing metrics and measuring performance, meeting legal and regulatory requirements, and educating business process owners are all subordinate to this overall goal.

U173 / Practice 2 Q47 / What will have the HIGHEST impact on standard information security governance models? A. Number of employees B. Distance between physical locations C. Complexity of organizational structure D. Organizational budget

Source answer: C. Complexity of organizational structure | Source explanation: Information security governance models are highly dependent on the overall organizational structure. Some of the elements that impact organizational structure are multiple missions and functions across the organization, leadership and lines of communication. Number of employees and distance between physical locations have less impact on information security governance models since well-defined process, technology and people components intermingle to provide the proper governance. Organizational budget is not a major impact once good governance models are in place, hence governance will help in effective management of the organization's budget.

U176 / Practice 2 Q58 / The PRIMARY concern of an information security manager documenting a formal data retention policy would be: A. generally accepted industry best practice B. business requirement C. legislative and regulatory requirement D. storage availabilit

REVIEW NOTE: SOURCE CONFLICT: This key says B (business requirements), while Practice 1 Q87 / Practice 2 Q92 prioritizes regulatory/legal requirements for retention. Do not learn the explanation as permission to disregard applicable requirements. Confirm the instructor's expected treatment. | Source answer: B. business requirement | Source explanation: The primary concern will be to comply with legislation and regulation but only if this is a genuine business requirement. Best practices may be a useful guide but not a primary concern. Legislative and regulatory requirements are only relevant if compliance is a business need. Storage is irrelevant since whatever is needed must be provided

U177 / Practice 2 Q64 / To justify the need to invest in a forensic analysis tool, an information security manager should FIRST: A. review the functionalities and implementation requirements of the solutio B. review comparison reports of tool implementation in peer companie C. provide examples of situations where such a tool would be usefu D. substantiate the investment in meeting organizational need

Source answer: D. substantiate the investment in meeting organizational need | Source explanation: Any investment must be reviewed to determine whether it is cost effective and supports the organizational strategy. It is important to review the features and functionalities provided by such a tool, and to provide examples of situations where the tool would be useful, but that comes after substantiating the investment and return on investment to the organization.

U178 / Practice 2 Q65 / The MOST important characteristic of good security policies is that they: A. state expectations of IT managemen B. state only one general security mandat C. are aligned with organizational goal D. govern the creation of procedures and guideline

Source answer: C. are aligned with organizational goal | Source explanation: The most important characteristic of good security policies is that they be aligned with organizational goals. Failure to align policies and goals significantly reduces the value provided by the policies. Stating expectations of IT management omits addressing overall organizational goals and objectives. Stating only one general security mandate is the next best option since policies should be clear; otherwise, policies may be confusing and difficult to understand. Governing the creation of procedures and guidelines is most relevant to information security standards.

U182 / Practice 2 Q82 / Which of the following is the MOST essential task for a chief information security officer (CISO) to perform? A. Update platform-level security settings B. Conduct disaster recovery test exercises C. Approve access to critical financial systems D. Develop an information security strategy paper

Source answer: D. Develop an information security strategy paper | Source explanation: Developing a strategy paper on information security would be the most appropriate. Approving access would be the job of the data owner. Updating platform-level security and conducting recovery test exercises would be less essential since these are administrative tasks.

U184 / Practice 2 Q97 / In implementing information security governance, the information security manager is PRIMARILY responsible for: A. developing the security strateg B. reviewing the security strateg C. communicating the security strateg D. approving the security strategy

Source answer: A. developing the security strateg | Source explanation: The information security manager is responsible for developing a security strategy based on business objectives with the help of business process owners. Reviewing the security strategy is the responsibility of a steering committee. The information security manager is not necessarily responsible for communicating or approving the security strategy.

U185 / Practice 2 Q131 / Which of the following is MOST appropriate for inclusion in an information security strategy? A. Business controls designated as key controls B. Security processes, methods, tools and techniques C. Firewall rule sets, network defaults and intrusion detection system (IDS) settings D. Budget estimates to acquire specific security tools

Source answer: B. Security processes, methods, tools and techniques | Source explanation: A set of security objectives, processes, methods, tools and techniques together constitute a security strategy. Although IT and business governance are intertwined, business controls may not be included in a security strategy. Budgets will generally not be included in an information security strategy. Additionally, until information security strategy is formulated and implemented, specific tools will not be identified and specific cost estimates will not be available. Firewall rule sets, network defaults and intrusion detection system (IDS) settings are technical details subject to periodic change, and are not appropriate content for a strategy document.

U186 / Practice 2 Q133 / The MOST useful way to describe the objectives in the information security strategy is through: A. attributes and characteristics of the 'desired state." B. overall control objectives of the security progra C. mapping the IT systems to key business processe D. calculation of annual loss expectation

Source answer: A. attributes and characteristics of the 'desired state." | Source explanation: Security strategy will typically cover a wide variety of issues, processes, technologies and outcomes that can best be described by a set of characteristics and attributes that are desired. Control objectives are developed after strategy and policy development. Mapping IT systems to key business processes does not address strategy issues. Calculation of annual loss expectations would not describe the objectives in the information security strategy.

U188 / Practice 2 Q150 / An organization's information security processes are currently defined as ad hoc. In seeking to improve their performance level, the next step for the organization should be to: A. ensure that security processes are consistent across the organizatio B. enforce baseline security levels across the organizatio C. ensure that security processes are fully documente D. implement monitoring of key performance indicators for security processe

Source answer: A. ensure that security processes are consistent across the organizatio | Source explanation: The organization first needs to move from ad hoc to repeatable processes. The organization then needs to document the processes and implement process monitoring and measurement. Baselining security levels will not necessarily assist in process improvement since baselining focuses primarily on control improvement. The organization needs to standardize processes both before documentation, and before monitoring and measurement.

U190 / Practice 2 Q164 / An organization has to comply with recently published industry regulatory requirements—compliance that potentially has high implementation costs. What should the information security manager do FIRST? A. Implement a security committe B. Perform a gap analysi C. Implement compensating control D. Demand immediate complianc

Source answer: B. Perform a gap analysi | Source explanation: Since they are regulatory requirements, a gap analysis would be the first step to determine the level of compliance already in place. Implementing a security committee or compensating controls would not be the first step. Demanding immediate compliance would not assess the situation.

U218 / Practice 2 Q309 / Primary direction on the impact of compliance with new regulatory requirements that may lead to major application system changes should be obtained from the: A. corporate internal audito B. System developers/analyst C. key business process owner D. corporate legal counse

Source answer: C. key business process owner | Source explanation: Business process owners are in the best position to understand how new regulatory requirements may affect their systems. Legal counsel and infrastructure management, as well as internal auditors, would not be in as good a position to fully understand all ramifications.

U220 / Practice 2 Q326 / Which of the following is MOST important to the success of an information security program? A. Security' awareness training B. Achievable goals and objectives C. Senior management sponsorship D. Adequate start-up budget and staffing

Source answer: C. Senior management sponsorship | Source explanation: Sufficient senior management support is the most important factor for the success of an information security program. Security awareness training, although important, is secondary. Achievable goals and objectives as well as having adequate budgeting and staffing are important factors, but they will not ensure success if senior management support is not present.

U221 / Practice 2 Q329 / Which of the following tools is MOST appropriate to assess whether information security governance objectives are being met? A. SWOT analysis B. Waterfall chart C. Gap analysis D. Balanced scorecard

Source answer: D. Balanced scorecard | Source explanation: The balanced scorecard is most effective for evaluating the degree to which information security objectives are being met. A SWOT analysis addresses strengths, weaknesses, opportunities and threats. Although useful, a SWOT analysis is not as effective a tool. Similarly, a gap analysis, while useful for identifying the difference between the current state and the desired future state, is not the most appropriate tool. A waterfall chart is used to understand the flow of one process into another.

U232 / Practice 2 Q365 / Priority should be given to which of the following to ensure effective implementation of information security governance? A. Consultation B. Negotiation C. Facilitation D. Planning

Source answer: D. Planning | Source explanation: Planning is the key to effective implementation of information security governance. Consultation, negotiation and facilitation come after planning.

U263 / Practice 2 Q455 / Which of the following will BEST ensure that management takes ownership of the decision making process for information security? A. Security policies and procedures B. Annual self-assessment by management C. Security- steering committees D. Security awareness campaigns

Source answer: C. Security- steering committees | Source explanation: Security steering committees provide a forum for management to express its opinion and take ownership in the decision making process. Security awareness campaigns, security policies and procedures, and self- assessment exercises are all good but do not exemplify the taking of ownership by management.