712-50 practice questions 151–160

1. Question 151 · 188 in bank

   Quantitative Risk Assessments have the following advantages over qualitative risk assessments:

   • AThey are subjective and can be completed more quickly
   • BThey are objective and express risk / cost in approximates
   • CThey are subjective and can express risk / cost in real numbers
   • DThey are objective and can express risk / cost in real numbers

   Show answer

   Answer: D

   Next question

2. Question 152 · 188 in bank

   From the CISO's perspective in looking at financial statements, the statement of retained earnings of an organization:

   • AHas a direct correlation with the CISO's budget
   • BRepresents, in part, the savings generated by the proper acquisition and implementation of security controls
   • CRepresents the sum of all capital expenditures
   • DRepresents the percentage of earnings that could in part be used to finance future security controls

   Show answer

   Answer: D

   Next question

3. Question 153 · 188 in bank

   What is the primary difference between Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS)?

   • AIPS identify potentially malicious traffic based on signature or behaviour and IDS does not
   • BAn IPS examine network traffic flows to detect and actively stop exploits and attacks
   • CIDS are typically deployed behind the firewall and IPS are deployed in front of the firewall
   • DOnly IDS is susceptible to false positives

   Show answer

   Answer: B

   Next question

4. Question 154 · 188 in bank

   What is the THIRD state of the Tuchman Stages of Group Development?

   • ANorming
   • BForming
   • CStorming
   • DPerforming

   Show answer

   Answer: A

   Next question

5. Question 155 · 188 in bank

   A security manager regularly checks work areas after business hours for security violations; such as unsecured files or unattended computers with active sessions. This activity BEST demonstrates what part of a security program?

   • ACompliance management
   • BAudit validation
   • CPhysical control testing
   • DSecurity awareness training

   Show answer

   Answer: A

   Next question

6. Question 156 · 188 in bank

   What is the definition of Risk in Information Security?

   • ARisk = Probability x Impact
   • BRisk = Impact x Threat
   • CRisk = Threat x Probability
   • DRisk = Financial Impact x Probability

   Show answer

   Answer: A

   Explanation

   Answer is C. C. In Information Security, the definition of Risk is: Risk = Threat x Probability. Risk refers to the potential for harm or loss resulting from a threat exploiting a vulnerability. A threat is any potential danger that could harm or compromise the confidentiality, integrity, or availability of an organization's information assets. Probability refers to the likelihood of a threat exploiting a vulnerability, while vulnerability is a weakness or gap in an organization's security defenses that could be exploited by a threat. By multiplying the likelihood of a threat exploiting a vulnerability (i.e., probability) by the potential impact of a successful attack (i.e., threat), organizations can determine the level of risk associated with a particular information asset or system. This formula allows organizations to quantify and prioritize risks and determine appropriate risk treatment strategies.

   Source: Adapted from community discussion — Pika26

   Next question

7. Question 157 · 188 in bank

   A business unit within your organization intends to deploy a new technology in a manner that places it in violation of existing information security standards. What immediate action should the information security manager take?

   • AEnforce the existing security standards and do not allow the deployment of the new technology.
   • BIf the risks associated with that technology are not already identified, perform a risk analysis to quantify the risk, and allow the business unit to proceed based on the identified risk level.
   • CAmend the standard to permit the deployment.
   • DPermit a 90-day window to see if an issue occurs and then amend the standard if there are no issues.

   Show answer

   Answer: B

   Explanation

   Agreed. Policy and security standards are not subjective, they are to be followed. If exceptions are to be made, it must go through an approval process rather than allowed to proceed and management catches up to the problem. Allowing a precedent to happen opens the doors to other departments performing the same action causing disorganized management

   Source: Adapted from community discussion — adv87

   Next question

8. Question 158 · 188 in bank

   The establishment of a formal risk management framework and system authorization program is essential. The LAST step of the system authorization process is:

   • AGetting authority to operate the system from executive management
   • BContacting the Internet Service Provider for an IP scope
   • CChanging the default passwords
   • DConducting a final scan of the live system and mitigating all high and medium level vulnerabilities

   Show answer

   Answer: A

   Next question

9. Question 159 · 188 in bank

   An organization's firewall technology needs replaced. A specific technology has been selected that is less costly than others and lacking in some important capabilities. The security officer has voiced concerns about sensitive data breaches but the decision is made to purchase. What does this selection indicate?

   • AA high threat environment
   • BA low vulnerability environment
   • CA high risk tolerance environment
   • DA low risk tolerance environment

   Show answer

   Answer: C

   Next question

10. Question 160 · 188 in bank

    Which of the following is MOST important when dealing with an Information Security Steering committee?

    • AEnsure that security policies and procedures have been vetted and approved.
    • BReview all past audit and compliance reports.
    • CInclude a mix of members from different departments and staff levels.
    • DBe briefed about new trends and products at each meeting by a vendor.

    Show answer

    Answer: C

    Explanation

    The Correct Answer is C. This is crucial because the effectiveness of an Information Security Steering Committee hinges on its ability to understand and address security needs and concerns across the entire organization. The committee benefits from diverse perspectives and expertise by including members from various departments and staff levels. This diversity helps make more informed and comprehensive decisions about information security policies and strategies, ensuring that they align with the overall business objectives and the specific needs of different areas within the organization.

    Source: Adapted from community discussion — ONERAPTOR

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

712-50 practice, question 151. 188 questions available.