An information security manager reads a media report of a new type of malware attack. Who should be notified FIRST?

A. Application owners
B. Communications department
C. Data owners
D. Security operations team

Which of the following is the PRIMARY benefit to an organization using an automated event monitoring solution?

A. Improved response time to incidents
B. Improved network protection
C. Enhanced forensic analysis
D. Reduced need for manual analysis

Which of the following would be MOST effective when justifying the cost of adding security controls to an existing web application?

A. Internal audit reports
B. Application security policy
C. Vulnerability assessment results
D. A business case

Which of the following is the BEST reason for delaying the application of a critical security patch?

A. Conflicts with software development lifecycle
B. Technology interdependencies
C. Lack of vulnerability management
D. Resource limitations

Which of the following is MOST important to include in a contract with a critical service provider to help ensure alignment with the organization’s information security program?

A. Right-to-audit clause
B. Escalation paths
C. Key performance indicators (KPIs)
D. Termination language

The selection of security controls is PRIMARILY linked to:

A. best practices of similar organizations
B. risk appetite of the organization
C. regulatory requirements
D. business impact assessment

During an annual security review of an organization’s servers, it was found that the customer service team’s file server, which contains sensitive customer data, is accessible to all user IDs in the organization. Which of the following should the information security manager do FIRST?

A. Report the situation to the data owner
B. Remove access privileges to the folder containing the data
C. Isolate the server from the network
D. Train the customer service team on properly controlling file permissions

Which of the following methods BEST ensures that a comprehensive approach is used to direct information security activities?

A. Holding periodic meetings with business owners
B. Promoting security training
C. Establishing a steering committee
D. Creating communication channels

Which of the following metrics BEST evaluates the completeness of disaster-recovery preparations?

A. Number of published application-recovery plans
B. Ratio of recovery-plan documents to total applications
C. Ratio of tested applications to total applications
D. Ratio of successful to unsuccessful tests

Which of the following MOST effectively prevents internal users from modifying sensitive data?

A. Network segmentation
B. Acceptable use policies
C. Role-based access controls
D. Multi-factor authentication