- (Exam Topic 3)
Which of the following functions evaluates risk present in IT initiatives and/or systems when implementing an information security program?

1. A. Risk Management
2. B. Risk Assessment
3. C. System Testing
4. D. Vulnerability Assessment

Correct Answer: B

- (Exam Topic 1)
The Information Security Management program MUST protect:

1. A. all organizational assets
2. B. critical business processes and /or revenue streams
3. C. intellectual property released into the public domain
4. D. against distributed denial of service attacks

Correct Answer: B

- (Exam Topic 3)
You currently cannot provide for 24/7 coverage of your security monitoring and incident response duties and your company is resistant to the idea of adding more full-time employees to the payroll. Which combination of solutions would help to provide the coverage needed without the addition of more dedicated staff? (choose the best answer):

1. A. Deploy a SEIM solution and have current staff review incidents first thing in the morning
2. B. Contract with a managed security provider and have current staff on recall for incident response
3. C. Configure your syslog to send SMS messages to current staff when target events are triggered
4. D. Employ an assumption of breach protocol and defend only essential information resources

Correct Answer: B

- (Exam Topic 6)
You have been hired as the Information System Security Officer (ISSO) for a US federal government agency. Your role is to ensure the security posture of the system is maintained. One of your tasks is to develop and maintain the system security plan (SSP) and supporting documentation.
Which of the following is NOT documented in the SSP?

1. A. The controls in place to secure the system
2. B. Name of the connected system
3. C. The results of a third-party audits and recommendations
4. D. Type of information used in the system

Correct Answer: C
Reference:
https://www.govinfo.gov/content/pkg/GOVPUB-C13-63e84ab7af43b36228f10e4f0b5f8c38/pdf/GOVPUB-C13- (65)

- (Exam Topic 1)
Which of the following is used to establish and maintain a framework to provide assurance that information security strategies are aligned with organizational objectives?

1. A. Awareness
2. B. Compliance
3. C. Governance
4. D. Management

Correct Answer: C