Which of the following is the MOST critical step prior to performing a network penetration test?

A. Informing management of the potential risk involved with penetration testing
B. Identifying a scanning tool for use in identifying vulnerabilities
C. Communicating the location of the penetration test targets to management
D. Reviewing the results of previous penetration tests

Due to the small size of the payroll department, an organization is unable to segregate the employee setup and payroll processing functions. Which of the following would be the BEST compensating control for the lack of segregation of duties?

A. An independent payroll disbursement review is conducted.
B. The system is configured to require secondary approval for changes to the employee master file.
C. A review is conducted to verify that terminated employees are removed from the employee master file.
D. A payroll variance report is reviewed for anomalies every pay period.

Privileged account access is required to start an ad hoc batch job. Which of the following would MOST effectively detect unauthorized job execution?

A. Requiring manual approval by an authorized user
B. Executing the job through two-factor authentication
C. Introducing job execution request procedures
D. Reconciling user activity logs against authorizations

A user of a telephone banking system has forgotten his personal identification number (PIN). After the user has been authenticated, the BEST method of issuing a new PIN is to have:

A. the user enter a new PIN twice.
B. banking personnel verbally assign a new PIN.
C. a randomly generated PIN communicated by banking personnel.
D. banking personnel assign the user a new PIN via email.

Which of the following would help determine the maturity of an information security awareness program?

A. A review of the annual penetration test results
B. A network vulnerability assessment
C. A simulated social engineering test
D. A gap assessment against an established model

Which of the following is the BEST reason to perform root cause analysis after a critical server failure?

A. To enable appropriate corrective measures
B. To enable the gathering of system availability data
C. To enable timely follow-up audits
D. To enable the optimization of IT investments

Which of the following is the BEST method for uncovering shadow IT within an organization?

A. Analyze help desk tickets.
B. Review secondary approval thresholds.
C. Use a cloud access security broker (CASB).
D. Review business processes.

Which of the following is the PRIMARY purpose of documenting and approving an information security policy?

A. To communicate management’s intent for securing the organization’s information assets
B. To mitigate the organization’s information security risk to an acceptable level
C. To ensure awareness of disciplinary procedures for security breaches by authorized users
D. To determine the best approach for implementing information security within the organization

Which of the following would be the MOST appropriate reason for an organization to purchase fault-tolerant hardware?

A. Reducing hardware maintenance costs.
B. Improving system performance.
C. Minimizing business loss.
D. Compensating for the lack of contingency planning

A database audit reveals an issue with the way data ownership for client data is defined. Which of the following roles should be accountable for this finding?

A. Business management
B. Database administrator
C. Information security management
D. Privacy manager