- (Topic 5)
The process for management approval of the security certification process which states the risks and mitigation of such risks of a given IT system is called

1. A. Security certification
2. B. Security system analysis
3. C. Security accreditation
4. D. Alignment with business practices and goals.

Correct Answer: C

- (Topic 5)
SCENARIO: Critical servers show signs of erratic behavior within your organization’s intranet. Initial information indicates the systems are under attack from an outside entity. As the Chief Information Security Officer (CISO), you decide to deploy the Incident Response Team (IRT) to determine the details of this incident and take action according to the information available to the team.
During initial investigation, the team suspects criminal activity but cannot initially prove or disprove illegal actions. What is the MOST critical aspect of the team’s activities?

1. A. Regular communication of incident status to executives
2. B. Eradication of malware and system restoration
3. C. Determination of the attack source
4. D. Preservation of information

Correct Answer: D

- (Topic 2)
Which of the following activities results in change requests?

1. A. Preventive actions
2. B. Inspection
3. C. Defect repair
4. D. Corrective actions

Correct Answer: A

- (Topic 2)
The executive board has requested that the CISO of an organization define and Key Performance Indicators (KPI) to measure the effectiveness of the security awareness program provided to call center employees. Which of the following can be used as a KPI?

1. A. Number of callers who report security issues.
2. B. Number of callers who report a lack of customer service from the call center
3. C. Number of successful social engineering attempts on the call center
4. D. Number of callers who abandon the call before speaking with a representative

Correct Answer: C

- (Topic 5)
Which of the following conditions would be the MOST probable reason for a security project to be rejected by the executive board of an organization?

1. A. The Net Present Value (NPV) of the project is positive
2. B. The NPV of the project is negative
3. C. The Return on Investment (ROI) is larger than 10 months
4. D. The ROI is lower than 10 months

Correct Answer: B