NEW QUESTION 112
When selecting a security solution with reoccurring maintenance costs after the first year (choose the BEST answer):

NEW QUESTION 113
The total cost of security controls should:

NEW QUESTION 114
Ensuring that the actions of a set of people, applications and systems follow the organization’s rules is BEST described as:

NEW QUESTION 115
Creating good security metrics is essential for a CISO. What would be the BEST sources for creating security metrics for baseline defenses coverage?

NEW QUESTION 116
Which of the following defines the boundaries and scope of a risk assessment?

NEW QUESTION 117
A CISO decides to analyze the IT infrastructure to ensure security solutions adhere to the concepts of how hardware and software is implemented and managed within the organization. Which of the following principles does this best demonstrate?

NEW QUESTION 118
Scenario: You are the CISO and have just completed your first risk assessment for your organization. You find many risks with no security controls, and some risks with inadequate controls. You assign work to your staff to create or adjust existing security controls to ensure they are adequate for risk mitigation needs.
When adjusting the controls to mitigate the risks, how often should the CISO perform an audit to verify the controls?

NEW QUESTION 119
A CISO has recently joined an organization with a poorly implemented security program. The desire is to base the security program on a risk management approach. Which of the following is a foundational requirement in order to initiate this type of program?

NEW QUESTION 120
Which represents PROPER separation of duties in the corporate environment?

NEW QUESTION 121
The amount of risk an organization is willing to accept in pursuit of its mission is known as

NEW QUESTION 122
The single most important consideration to make when developing your security program, policies, and processes is:

NEW QUESTION 123
Risk appetite directly affects what part of a vulnerability management program?

NEW QUESTION 124
Which of the following is MOST likely to be discretionary?

NEW QUESTION 125
Which of the following functions MUST your Information Security Governance program include for formal organizational reporting?

NEW QUESTION 126
An organization is required to implement background checks on all employees with access to databases containing credit card information. This is considered a security