Question 61 · 188 in bank
Acceptable levels of information security risk tolerance in an organization should be determined by?
Show answer
Answer: B
EC-Council Certified Chief Information Security Officer (CCISO)188 questions across 19 pages are complete and free, with no account or card.
188 questions in this bank
Free access · progress saved on this device
Acceptable levels of information security risk tolerance in an organization should be determined by?
Answer: B
Which of the following is the MAIN security concern for public cloud computing?
Answer: A
A global retail company is creating a new compliance management process. Which of the following regulations is of MOST importance to be tracked and managed by this process?
Answer: D
D. Payment Card Industry Data Security Standards (PCI-DSS) Here's why: Option A: ITIL is a framework for IT service management, not a regulation. While it can be helpful in managing compliance processes, it doesn't directly dictate specific compliance requirements. Option B: NIST standards are broad and encompass various areas, including cybersecurity. However, they are not specific to retail companies or payment card data security. Option C: ISO standards also cover a wide range of areas, including some relevant to retail, like ISO 9001 for quality management. However, none directly address payment card data security like PCI-DSS does. Option D: PCI-DSS is a set of security standards specifically designed to ensure the safe handling of cardholder data by organizations that accept, transmit, or store payment card information. This directly applies to most, if not all, global retail companies that process customer payments.
Source: Adapted from community discussion — ats831
Your incident handling manager detects a virus attack in the network of your company. You develop a signature based on the characteristics of the detected virus. Which of the following phases in the incident handling process will utilize the signature to resolve this incident?
Answer: A
There is no Identification phase in IR under NIST, Prep, detection and analysis, Containment, eradication and recovery, and post. Eradication involves using AV tools or manual removal techniques. And, the virus has already been identified.
Source: Adapted from community discussion — Perseus_68
A system is designed to dynamically block offending Internet IP-addresses from requesting services from a secure website. This type of control is considered______________________.
Answer: B
The CCISO all-in one exam page 74 has IPS's in Corrective and Preventative. Since Detective and Preventive or 2 different controls, A is wrong because there is no such controls as a "Preventative detection control" per the book EXAM TIP A control can be associated with more than one control functionality. For example, an IPS could be considered both preventive and corrective and fencing could be considered both....
Source: Adapted from community discussion — Perseus_68
The process for identifying, collecting, and producing digital information in support of legal proceedings is called _____________________________.
Answer: D
Electronic discovery (sometimes known as e-discovery, ediscovery, eDiscovery, or e-Discovery) is the electronic aspect of identifying, collecting and producing electronically stored information (ESI) in response to a request for production in a law suit or investigation. ESI includes, but is not limited to, emails, documents, presentations, databases, voicemail, audio and video files, social media, and web sites. -https://cdslegal.com/knowledge/the-basics-what-is-e-discovery/
Source: Adapted from community discussion — ChrisZo
The newly appointed CISO of an organization is reviewing the IT security strategic plan. Which of the following is the MOST important component of the strategic plan?
Answer: A
The formal certification and accreditation process has four primary steps, what are they?
Answer: A
One of the MAIN goals of a Business Continuity Plan is to_______________.
Answer: A
the main goal of a BCP is to ensure the continuity of the operations, no matter how it is done. So the correct answer should be A
Source: Adapted from community discussion — perritoFaldero
While designing a secondary data center for your company what document needs to be analyzed to determine to how much should be spent on building the data center?
Answer: D
Enterprise Risk Assessment (ERA): The ERA provides a comprehensive evaluation of the risks that the organization faces, including the potential impact of data center outages and other disasters. By analyzing the ERA, you can understand the criticality of the systems and data that need to be protected, the potential financial impact of downtime, and the necessary investments to mitigate those risks. This assessment helps in determining the appropriate budget for building a secondary data center based on the risk appetite and the value of the assets that need protection.
Source: Adapted from community discussion — johndoe69
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
712-50 practice, question 61. 188 questions available.
Version 1.0.0. How we source questions