Which of the following is MOST important to convey to employees in building a security risk-aware culture?

1. A. Personal information requires different security controls than sensitive information.
2. B. Employee access should be based on the principle of least privilege.
3. C. Understanding an information asset's value is critical to risk management.
4. D. The responsibility for security rests with all employees.

Correct Answer: D
In building a security risk-aware culture, it is most important to convey to employees that the responsibility for security rests with all employees. Every employee plays a role in ensuring the security of the organization's information assets, and it is essential that they understand their role and take security seriously. This means not only following security policies and procedures but also being vigilant in identifying and reporting potential security incidents.
The other items listed (personal information requiring different security controls than sensitive information, employee access should be based on the principle of least privilege, and understanding an information asset's value is critical to risk management) are all important elements of a comprehensive security program, but they are secondary to the fundamental message that security is a shared responsibility. By emphasizing this message and empowering employees to take an active role in security, organizations can build a stronger, more effective security risk-aware culture.

When properly implemented, secure transmission protocols protect transactions:

1. A. from eavesdropping.
2. B. from denial of service (DoS) attacks.
3. C. on the client desktop.
4. D. in the server's database.

Correct Answer: A

Which of the following messages would be MOST effective in obtaining senior management's commitment to information security management?

1. A. Effective security eliminates risk to the business.
2. B. Adopt a recognized framework with metrics.
3. C. Security is a business product and not a process.
4. D. Security supports and protects the business.

Correct Answer: D

A Seat a-hosting organization's data center houses servers, appli
BEST approach for developing a physical access control policy for the organization?

1. A. Review customers’ security policies.
2. B. Conduct a risk assessment to determine security risks and mitigating controls.
3. C. Develop access control requirements for each system and application.
4. D. Design single sign-on (SSO) or federated access.

Correct Answer: B

Which of the following is the BEST course of action when an online company discovers a network attack in progress?

1. A. Dump all event logs to removable media
2. B. Isolate the affected network segment
3. C. Enable trace logging on ail events
4. D. Shut off all network access points

Correct Answer: B
The BEST course of action when an online company discovers a network attack in progress is to isolate the affected network segment. This prevents the attacker from gaining further access to the network and limits the scope of the attack. Dumping event logs to removable media and enabling trace logging may be useful for forensic purposes, but should not be the first course of action in the midst of an active attack. Shutting off all network access points would be too drastic and would prevent legitimate traffic from accessing the network.