Activedumpsnet Logo
An anonymity network is a series of?
What is the FIRST step in developing the vulnerability management program?
The process for identifying, collecting, and producing digital information in support of legal proceedings is called
The general ledger setup function in an enterprise resource package allows for setting accounting periods. Access to this function has been permitted to users in finance, the shipping department, and production scheduling. What is the most likely reason for such broad access?
Which wireless encryption technology makes use of temporal keys?
You are having a penetration test done on your company network and the leader of the team says they discovered all the network devices because no one had changed the Simple Network Management Protocol (SNMP) community strings from the defaults. Which of the following is a default community string?
Which of the following strategies provides the BEST response to a ransomware attack?
Network Forensics is the prerequisite for any successful legal action after attacks on your Enterprise Network. Which is the single most important factor to introducing digital evidence into a court of law?
Which of the following statements about Encapsulating Security Payload (ESP) is true?
Which of the following backup sites takes the longest recovery time?
SQL injection is a very popular and successful injection attack method. Identify the basic SQL injection text:
While designing a secondary data center for your company what document needs to be analyzed to determine to how much should be spent on building the data center?
Which of the following tests is an IS auditor performing when a sample of programs is selected to determine if the source and object versions are the same?
The effectiveness of an audit is measured by?
Which of the following are primary concerns for management with regard to assessing internal control objectives?
You are the Chief Information Security Officer of a large, multinational bank and you suspect there is a flaw in a two factor authentication token management process. Which of the following represents your BEST course of action?
Which of the following is the PRIMARY purpose of International Organization for Standardization (ISO) 27001?
A Chief Information Security Officer received a list of high, medium, and low impact audit findings. Which of the following represents the BEST course of action?
In MOST organizations which group periodically reviews network intrusion detection system logs for all systems as part of their daily tasks?
An audit was conducted and many critical applications were found to have no disaster recovery plans in place. You conduct a Business Impact Analysis (BIA) to determine impact to the company for each application. What should be the NEXT step?
Creating a secondary authentication process for network access would be an example of?
You have implemented the new controls. What is the next step?
The regular review of a firewall ruleset is considered a
The executive board has requested that the CISO of an organization define and Key Performance Indicators (KPI) to measure the effectiveness of the security awareness program provided to call center employees. Which of the following can be used as a KPI?
From an information security perspective, information that no longer supports the main purpose of the business should be:
You have a system with 2 identified risks. You determine the probability of one risk occurring is higher than the
When dealing with a risk management process, asset classification is important because it will impact the overall:
When dealing with Security Incident Response procedures, which of the following steps come FIRST when reacting to an incident?
Information security policies should be reviewed:
According to the National Institute of Standards and Technology (NIST) SP 800-40, which of the following considerations are MOST important when creating a vulnerability management program?
When choosing a risk mitigation method what is the MOST important factor?
When would it be more desirable to develop a set of decentralized security policies and procedures within an enterprise environment?
Which of the following international standards can be BEST used to define a Risk Management process in an organization?
What is the SECOND step to creating a risk management methodology according to the National Institute of Standards and Technology (NIST) SP 800-30 standard?
A security professional has been promoted to be the CISO of an organization. The first task is to create a security policy for this organization. The CISO creates and publishes the security policy. This policy however, is ignored and not enforced consistently. Which of the following is the MOST likely reason for the policy shortcomings?
What role should the CISO play in properly scoping a PCI environment?
SCENARIO: Critical servers show signs of erratic behavior within your organization’s intranet. Initial information indicates the systems are under attack from an outside entity. As the Chief Information Security Officer (CISO), you decide to deploy the Incident Response Team (IRT) to determine the details of this incident and take action according to the information available to the team.
In what phase of the response will the team extract information from the affected systems without altering original data?
When analyzing and forecasting a capital expense budget what are not included?
What are the three hierarchically related aspects of strategic planning and in which order should they be done?
A system is designed to dynamically block offending Internet IP-addresses from requesting services from a secure website. This type of control is considered
You are just hired as the new CISO and are being briefed on all the Information Security projects that your section has on going. You discover that most projects are behind schedule and over budget.
Using the best business practices for project management you determine that the project correctly aligns with the company goals and the scope of the project is correct. What is the NEXT step?
File Integrity Monitoring (FIM) is considered a
What is the BEST reason for having a formal request for proposal process?
Scenario: The new CISO was informed of all the Information Security projects that the section has in progress. Two projects are over a year behind schedule and way over budget.
Using the best business practices for project management, you determine that the project correctly aligns with the organization goals. What should be verified next?
Scenario: Most industries require compliance with multiple government regulations and/or industry standards to meet data protection and privacy mandates.
When multiple regulations or standards apply to your industry you should set controls to meet the:
You are just hired as the new CISO and are being briefed on all the Information Security projects that your section has on going. You discover that most projects are behind schedule and over budget.
Using the best business practices for project management you determine that the project correct aligns with the company goals. What needs to be verified FIRST?
The network administrator wants to strengthen physical security in the organization. Specifically, to implement a
solution stopping people from entering certain restricted zones without proper credentials. Which of following
physical security measures should the administrator use?
The new CISO was informed of all the Information Security projects that the organization has in progress. Two projects are over a year behind schedule and over budget. Using best business practices for project management you determine that the project correctly aligns with the company goals.
Which of the following needs to be performed NEXT?
Which of the following is considered a project versus a managed process?
A newly appointed security officer finds data leakage software licenses that had never been used. The officer decides to implement a project to ensure it gets installed, but the project gets a great deal of resistance across the organization. Which of the following represents the MOST likely reason for this situation?
Which of the following functions evaluates patches used to close software vulnerabilities of new systems to assure compliance with policy when implementing an information security program?
Knowing the potential financial loss an organization is willing to suffer if a system fails is a determination of which of the following?
Which of the following represents the best method of ensuring business unit alignment with security program requirements?
Which of the following functions evaluates risk present in IT initiatives and/or systems when implementing an information security program?
In effort to save your company money which of the following methods of training results in the lowest cost for the organization?
The ultimate goal of an IT security projects is:
Information Security is often considered an excessive, after-the-fact cost when a project or initiative is completed. What can be done to ensure that security is addressed cost effectively?
Which of the following methodologies references the recommended industry standard that Information security project managers should follow?
Which of the following methods are used to define contractual obligations that force a vendor to meet customer expectations?
As the CISO for your company you are accountable for the protection of information resources commensurate with: