712-50 practice questions 81–90

1. Question 81 · 188 in bank

   Scenario: A Chief Information Security Officer (CISO) recently had a third party conduct an audit of the security program. Internal policies and international standards were used as audit baselines. The audit report was presented to the CISO and a variety of high, medium and low rated gaps were identified. The CISO has validated audit findings, determined if compensating controls exist, and started initial remediation planning. Which of the following is the MOST logical next step?

   • ACreate detailed remediation funding and staffing plans
   • BReport the audit findings and remediation status to business stake holders
   • CValidate the effectiveness of current controls
   • DReview security procedures to determine if they need modified according to findings

   Show answer

   Answer: C

   Explanation

   The most logical next step in this scenario would be option C: Validate the effectiveness of current controls. After identifying the gaps in the security program through the audit, it is essential to verify whether the existing controls are effectively addressing the identified risks or if further adjustments are necessary. This validation helps ensure that the controls are providing the intended level of protection and mitigating the identified vulnerabilities. In summary, validating the effectiveness of current controls is the most logical next step as it ensures that the existing controls are providing the intended level of protection. This step provides a solid foundation for creating detailed remediation plans (option A) and reporting to business stakeholders (option B), while reviewing security procedures (option D) comes later in the process.

   Source: Adapted from community discussion — arifbhatkar

   Next question

2. Question 82 · 188 in bank

   Scenario: A Chief Information Security Officer (CISO) recently had a third party conduct an audit of the security program. Internal policies and international standards were used as audit baselines. The audit report was presented to the CISO and a variety of high, medium and low rated gaps were identified. Which of the following is the FIRST action the CISO will perform after receiving the audit report?

   • AInform peer executives of the audit results
   • BValidate gaps and accepts or dispute the audit findings
   • CCreate remediation plans to address program gaps
   • DDetermine if security policies and procedures are adequate

   Show answer

   Answer: B

   Next question

3. Question 83 · 188 in bank

   An organization has defined a set of standard security controls. This organization has also defined the circumstances and conditions in which they must be applied. What is the NEXT logical step in applying the controls in the organization?

   • ADetermine the risk tolerance
   • BPerform an asset classification
   • CAnalyze existing controls on systems
   • DCreate an architecture gap analysis

   Show answer

   Answer: C

   Explanation

   After defining the standard security controls and the conditions for their application, the next step is to analyze the existing controls on the systems to identify any gaps or overlaps. This analysis helps in understanding how well the current controls align with the new standards and where adjustments or enhancements are needed. By doing this, the organization can ensure that the new controls are effectively integrated and that all systems comply with the updated security requirements.

   Source: Adapted from community discussion — johndoe69

   Next question

4. Question 84 · 188 in bank

   Scenario: Your corporate systems have been under constant probing and attack from foreign IP addresses for more than a week. Your security team and security infrastructure have performed well under the stress. You are confident that your defenses have held up under the test, but rumors are spreading that sensitive customer data has been stolen and is now being sold on the Internet by criminal elements. During your investigation of the rumored compromise, you discover that data has been breached and that the repository of stolen data is on a server located in a foreign country. Your team now has full access to the data on the foreign server. What action should you take FIRST?

   • AConsult with other executives to develop an action plan
   • BContract with a credit reporting company for paid monitoring services for affected customers
   • CContact your local law enforcement agency
   • DDestroy the repository of stolen data

   Show answer

   Answer: A

   Explanation

   While involving law enforcement (Option C) is important, it is typically advisable to consult with other executives and develop an action plan before contacting them. This ensures that the organization has a clear understanding of the situation and can provide relevant information to law enforcement, enabling a more focused and productive engagement with the authorities.

   Source: Adapted from community discussion — arifbhatkar

   Next question

5. Question 85 · 188 in bank

   Scenario: You are the newly hired Chief Information Security Officer for a company that has not previously had a senior level security practitioner. The company lacks a defined security policy and framework for their Information Security Program. Your new boss, the Chief Financial Officer, has asked you to draft an outline of a security policy and recommend an industry/sector neutral information security control framework for implementation. Which of the following industry / sector neutral information security control frameworks should you recommend for implementation?

   • APayment Card Industry Digital Security Standard (PCI DSS)
   • BNational Institute of Standards and Technology (NIST) Special Publication 800-53
   • CInternational Organization for Standardization ג€" ISO 27001/2
   • DBritish Standard 7799 (BS7799)

   Show answer

   Answer: C

   Next question

6. Question 86 · 188 in bank

   Scenario: An organization has recently appointed a CISO. This is a new role in the organization and it signals the increasing need to address security consistently at the enterprise level. This new CISO, while confident with skills and experience, is constantly on the defensive and is unable to advance the IT security centric agenda. From an Information Security Leadership perspective, which of the following is a MAJOR concern about the CISO's approach to security?

   • AIT security centric agenda
   • BLack of risk management process
   • CLack of risk management process
   • DCompliance centric agenda

   Show answer

   Answer: A

   Explanation

   A. Compliance centric agenda B. IT security centric agenda C. Lack of risk management process D. Lack of sponsorship from executive management It must be D. imho "Security Leadership perspective"

   Source: Adapted from community discussion — LARdT

   Next question

7. Question 87 · 188 in bank

   The single most important consideration to make when developing your security program, policies, and processes is:

   • AAlignment with the business
   • BBudgeting for unforeseen data compromises
   • CEstablishing your authority as the Security Executive
   • DStreaming for efficiency

   Show answer

   Answer: A

   Next question

8. Question 88 · 188 in bank

   The amount of risk an organization is willing to accept in pursuit of its mission is known as______________.

   • Arisk transfer
   • Brisk mitigation
   • Crisk acceptance
   • Drisk tolerance

   Show answer

   Answer: D

   Next question

9. Question 89 · 188 in bank

   Scenario: As you begin to develop the program for your organization, you assess the corporate culture and determine that there is a pervasive opinion that the security program only slows things down and limits the performance of the `real workers.` Which group of people should be consulted when developing your security program?

   • APeers
   • BEnd Users
   • CAll of the above
   • DExecutive Management

   Show answer

   Answer: C

   Next question

10. Question 90 · 188 in bank

    Scenario: The new CISO was informed of all the Information Security projects that the section has in progress. Two projects are over a year behind schedule and way over budget. Using the best business practices for project management, you determine that the project correctly aligns with the organization goals. What should be verified next?

    • AScope
    • BConstraints
    • CResources
    • DBudget

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

712-50 practice, question 81. 188 questions available.