Question 41 · 188 in bank
Which of the following should be determined while defining risk management strategies?
Show answer
Answer: A
EC-Council Certified Chief Information Security Officer (CCISO)188 questions across 19 pages are complete and free, with no account or card.
188 questions in this bank
Free access · progress saved on this device
Which of the following should be determined while defining risk management strategies?
Answer: A
Which of the following is the MOST important component of any change management process?
Answer: C
I would argue back out procedures are equally important with the best will in the world in today's complex systems it is impossible to predict all the effects of changes so being able to back-out a change quickly and smoothly is a vital safety net.
Source: Adapted from community discussion — Kentish
When selecting a security solution with reoccurring maintenance costs after the first year
Answer: B
An application vulnerability assessment has identified a security flaw in an application. This is a flaw that was previously identified and remediated on a prior release of the application. Which of the following is MOST likely the reason for this recurring issue?
Answer: A
The most likely reason for the recurring security flaw in the application, even after it was previously identified and remediated, is option B: Lack of change management controls. Change management controls refer to processes and procedures in place to manage and control changes to an application or system. These controls ensure that proper documentation, testing, and approval processes are followed before implementing changes. In this scenario, the recurring security flaw suggests that there may be a lack of effective change management controls in place.
Source: Adapted from community discussion — arifbhatkar
Ensuring that the actions of a set of people, applications and systems follow the organization's rules is BEST described as:
Answer: A
Risk appetite is typically determined by which of the following organizational functions?
Answer: B
I think this should the Board Of Director. I think they must determine the Risk Appetite of the business and NOT the Business Units. The Business Units could be compensating?
Source: Adapted from community discussion — Dzidzorli
Which of the following international standards can be BEST used to define a Risk Management process in an organization?
Answer: A
The security team has investigated the theft/loss of several unencrypted laptop computers containing sensitive corporate information. To prevent the loss of any additional corporate data, it is unilaterally decided by the CISO that all existing and future laptop computers will be encrypted. The help desk is then flooded with complaints about the slow performance of the laptops and users are upset. Which of the following best describes what the CISO did wrong?
Answer: A
An organization has a stated requirement to block certain traffic on networks. The implementation of controls will disrupt a manufacturing process and cause unacceptable delays, resulting in sever revenue disruptions. Which of the following is MOST likely to be responsible for accepting the risk until mitigating controls can be implemented?
Answer: D
A security professional has been promoted to be the CISO of an organization. The first task is to create a security policy for this organization. The CISO creates and publishes the security policy. This policy, however, is ignored and not enforced consistently. Which of the following is the MOST likely reason for the policy shortcomings?
Answer: B
Lack of a formal security policy governance process: This is the most probable reason for the policy being ignored. Governance involves not just the creation of policies but also the mechanisms for enforcement, monitoring, and reviewing those policies. If there's no formal governance process, there's likely no mechanism to ensure that the policy is integrated into daily operations, no accountability for non-compliance, and no regular reviews or updates to the policy. All of these factors can lead to a policy being ignored or inconsistently enforced.
Source: Adapted from community discussion — claudiosousa
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
712-50 practice, question 41. 188 questions available.
Version 1.0.0. How we source questions