512-50 Online Practice Questions and Answers

A method to transfer risk is to:

A. Implement redundancy

B. move operations to another region

C. purchase breach insurance

D. Alignment with business operations

What two methods are used to assess risk impact?

A. Cost and annual rate of expectance

B. Subjective and Objective

C. Qualitative and percent of loss realized

D. Quantitative and qualitative

You have recently drafted a revised information security policy. From whom should you seek endorsement in order to have the GREATEST chance for adoption and implementation throughout the entire organization?

A. Chief Information Security Officer

B. Chief Executive Officer

C. Chief Information Officer

D. Chief Legal Counsel

Information security policies should be reviewed:

A. by stakeholders at least annually

B. by the CISO when new systems are brought online

C. by the Incident Response team after an audit

D. by internal audit semiannually

During the course of a risk analysis your IT auditor identified threats and potential impacts. Next, your IT auditor should:

A. Identify and evaluate the existing controls.

B. Disclose the threats and impacts to management.

C. Identify information assets and the underlying systems.

D. Identify and assess the risk assessment process used by management.

How often should an environment be monitored for cyber threats, risks, and exposures?

A. Weekly

B. Monthly

C. Quarterly

D. Daily

Step-by-step procedures to regain normalcy in the event of a major earthquake is PRIMARILY covered by which of the following plans?

A. Incident response plan

B. Business Continuity plan

C. Disaster recovery plan

D. Damage control plan

Which of the following tests is an IS auditor performing when a sample of programs is selected to determine if the source and object versions are the same?

A. A substantive test of program library controls

B. A compliance test of program library controls

C. A compliance test of the program compiler controls

D. A substantive test of the program compiler controls

Which of the following is the MOST important reason to measure the effectiveness of an Information Security Management System (ISMS)?

A. Meet regulatory compliance requirements

B. Better understand the threats and vulnerabilities affecting the environment

C. Better understand strengths and weaknesses of the program

D. Meet legal requirements

Which of the following illustrates an operational control process:

A. Classifying an information system as part of a risk assessment

B. Installing an appropriate fire suppression system in the data center

C. Conducting an audit of the configuration management process

D. Establishing procurement standards for cloud vendors

Which of the following information may be found in table top exercises for incident response?

A. Security budget augmentation

B. Process improvements

C. Real-time to remediate

D. Security control selection

An application vulnerability assessment has identified a security flaw in an application. This is a flaw that was previously identified and remediated on a prior release of the application. Which of the following is MOST likely the reason for this recurring issue?

A. Ineffective configuration management controls

B. Lack of change management controls

C. Lack of version/source controls

D. High turnover in the application development department

The ability to hold intruders accountable in a court of law is important. Which of the following activities are needed to ensure the highest possibility for successful prosecution?

A. Well established and defined digital forensics process

B. Establishing Enterprise-owned Botnets for preemptive attacks

C. Be able to retaliate under the framework of Active Defense

D. Collaboration with law enforcement

The primary purpose of a risk register is to:

A. Maintain a log of discovered risks

B. Track individual risk assessments

C. Develop plans for mitigating identified risks

D. Coordinate the timing of scheduled risk assessments

Which type of physical security control scan a person's external features through a digital video camera before granting access to a restricted area?

A. Iris scan

B. Retinal scan

C. Facial recognition scan D. Signature kinetics scan