QUESTION 1
A newly appointed information security manager has been asked to update all security-related policies and procedures that have been static for five years or more. What should be done FIRST?

A. Review legal and regulatory requirements.
B. Inventory and review current security policies.
C. Perform a risk assessment of the current IT environment.
D. Update in accordance with the best business practices.

Correct Answer: B

QUESTION 2
Which of the following is a PRIMARY principle of Zero Trust architecture?

A. Implicitly denying authorization
B. Granting access by default
C. Approving all permissions for administrators
D. Grouping policies between networks

Correct Answer: A

QUESTION 3
A security review of an HR application reveals a file server containing confidential HR data is accessible to external user IDs. Which of the following should the information security manager do FIRST?

A. Remove access permissions for the external users.
B. Update the existing data privacy policy.
C. Train the HR team on proper access control.
D. Confirm the issue with the data owner.

Correct Answer: D

QUESTION 4
Which of the following metrics BEST indicates that an organization has a security-aware culture?

A. Frequency of security awareness training
B. Number of independent attestations and certifications
C. Percentage of phishing simulation tests passed
D. Percentage of controls tested and deemed effective

Correct Answer: C

QUESTION 5
Which of the following would be MOST important to include in communications to customers impacted by an information security incident?

A. Details of the type of data exposed
B. Costs of the incident to the organization
C. Technical information related to the incident
D. Identities of the attackers

Correct Answer: A

QUESTION 6
Which of the following should be done FIRST upon learning that a successful phishing attack has resulted in a breach of several databases containing sensitive information?

A. Activate the incident response plan.
B. Close off firewall ports.
C. Disable access to the databases.
D. Alert senior management.

Correct Answer: A

QUESTION 7
Which of the following is MOST helpful to ensure alignment of an organization’s information security resources to the organization’s goals and strategic direction?

A. Risk management framework
B. Information security gap analysis
C. Business impact analysis (BIA)
D. Enterprise security architecture

Correct Answer: A

QUESTION 8
In the context of information security governance, which of the following organizational practices BEST promotes a fraud-aware culture?

A. Allowing discretionary access to sensitive data to expedite workflow processes
B. Assigning multiple individuals to the same task to increase redundancy
C. Consolidating decision-making authority within a single team to streamline operations
D. Ensuring no single individual has complete control of a critical process

Correct Answer: D

QUESTION 9
Which of the following is the MOST effective way for a software company to minimize risk associated with its use of code developed by third parties in web applications?

A. Perform vulnerability scans of web-exposed infrastructure.
B. Require third parties to comply with the organization’s development standards.
C. Conduct static and dynamic code scans before release.
D. Ensure software composition analysis is integrated into development standards.

Correct Answer: D

QUESTION 10
Which of the following MOST directly influences the efficiency of incident response immediately after an incident has been detected?

A. Lessons learned
B. Root cause analysis
C. Incident categorization
D. Incident containment and mitigation

Correct Answer: C

QUESTION 11
Which of the following would BEST enable senior management to integrate security into all organizational processes following an increase in cyberattacks on business applications?

A. Providing security training to key stakeholders within each business area
B. Updating process diagrams to align with organizational strategy
C. Establishing security policies that align with business objectives
D. Requiring developers to attend customized training on secure application development

Correct Answer: C

QUESTION 12
An information security manager is recommending an investment in a new security initiative to address recently published threats. Which of the following is MOST important to include in the business case?

A. Anticipated risk reduction
B. Alignment with the IT strategy
C. Threat intelligence report
D. Availability of resources

Correct Answer: A

QUESTION 13
The BEST time to conduct a business impact analysis (BIA) is:

A. when testing business continuity plans (BCPs).
B. upon changes in management direction.
C. when conducting a disaster recovery test.
D. upon change in corporate culture.

Correct Answer: B

QUESTION 14
Which of the following would BEST enable an organization to monitor changes in its risk profile?

A. Implement a network intrusion detection system (DS).
B. Subscribe to third-party security threat intelligence.
C. Implement a SIEM system.
D. Establish security policies for system users.

Correct Answer: C

QUESTION 15
Which of the following is the BEST way for a security champion to promote a security-aware culture within an organization?

A. Design information security controls.
B. Discuss information security during leadership meetings.
C. Create and publish employee training slides.
D. Conduct regular phishing exercises.

Correct Answer: B

QUESTION 16
A healthcare company is scanning patient health records with an Al algorithm developed and hosted in a public cloud environment. Which of the following is the PRIMARY risk area for an information security manager to consider?

A. Data privacy
B. Data redundancy
C. Data recovery
D. Data availability

Correct Answer: A

QUESTION 17
An organization’s incident response plan was updated to include a requirement to report incidents to the relevant authorities. Which of the following would be MOST helpful in evaluating the effectiveness of the updated plan?

A. Assignment of communication responsibilities
B. Management approval of the incident reporting process
C. Ongoing testing of the incident response plan
D. Development of metrics for the incident response plan

Correct Answer: C

QUESTION 18
Which of the following metrics provides the MOST insight on the maturity of an information security program?

A. Number of vulnerabilities addressed
B. Number of controls achieving desired results
C. Number of audit findings
D. Number of attacks stopped by information security

Correct Answer: B

QUESTION 19
Which of the following is MOST important to verify during a test of an organization’s incident response process?

A. Whether senior management endorses the incident response process
B. Whether users know which numbers to call in the call tree
C. Whether incident response team members are cross-trained
D. Whether incident response team members know their responsibilities

Correct Answer: D

QUESTION 20
Which of the following is the GREATEST concern with implementing all controls recommended by a security framework?

A. Lack of approval from senior management
B. Increased risk levels
C. Increased time for implementation
D. Negative return on investment (ROI)

Correct Answer: D