Q1. The amount of data that will be collected during an audit is PRIMARILY determined by the 

A. audit scope. 

B. auditor's experience level. 

C. availability of the data. 

D. integrity of the data. 

View Answer

Q2. Which of the following is an advantage of on-premise Credential Management Systems? 

A. Improved credential interoperability 

B. Control over system configuration 

C. Lower infrastructure capital costs 

D. Reduced administrative overhead 

View Answer

Q3. Which of the following BEST describes a Protection Profile (PP)? 

A. A document that expresses an implementation independent set of security requirements for an IT product that meets specific consumer needs. 

B. A document that is used to develop an IT security product from its security requirements definition. 

C. A document that expresses an implementation dependent set of security requirements which contains only the security functional requirements. 

D. A document that represents evaluated products where there is a one-to-one correspondence between a PP and a Security Target (ST). 

View Answer

Q4. Refer.to the information below to answer the question. 

An organization has hired an information security officer to lead their security department. The officer has adequate people resources but is lacking the other necessary components to have an effective security program. There are numerous initiatives requiring security involvement. 

The effectiveness of the security program can PRIMARILY be measured through 

A. audit findings. 

B. risk elimination. 

C. audit requirements. 

D. customer satisfaction. 

View Answer

Q5. What type of test assesses a Disaster Recovery (DR) plan using realistic disaster scenarios while maintaining minimal impact to business operations? 

A. Parallel 

B. Walkthrough 

C. Simulation 

D. Tabletop 

View Answer

Q6. The key benefits of a signed and encrypted e-mail include 

A. confidentiality, authentication, and authorization. 

B. confidentiality, non-repudiation, and authentication. 

C. non-repudiation, authorization, and authentication. 

D. non-repudiation, confidentiality, and authorization. 

View Answer

Q7. Refer.to the information below to answer the question. 

An organization has hired an information security officer to lead their security department. The officer has adequate people resources but is lacking the other necessary components to have an effective security program. There are numerous initiatives requiring security involvement. 

Given the number of priorities, which of the following will MOST likely influence the selection of top initiatives? 

A. Severity of risk 

B. Complexity of strategy 

C. Frequency of incidents 

D. Ongoing awareness 

View Answer

Q8. Which of the following is the MOST important element of change management documentation? 

A. List of components involved 

B. Number of changes being made 

C. Business case justification 

D. A stakeholder communication 

View Answer

Q9. Refer.to the information below to answer the question. 

A security practitioner detects client-based attacks on the organization’s network. A plan will be necessary to address these concerns. 

What MUST the plan include in order to reduce client-side exploitation? 

A. Approved web browsers 

B. Network firewall procedures 

C. Proxy configuration 

D. Employee education 

View Answer

Q10. What is the MOST efficient way to secure a production program and its data? 

A. Disable default accounts and implement access control lists (ACL) 

B. Harden the application and encrypt the data 

C. Disable unused services and implement tunneling 

D. Harden the servers and backup the data 

View Answer