Q126. What is the main purpose of the Incident Response Team?

Q127. Ensuring that the actions of a set of people, applications and systems follow the organization’s rules is BEST described as:

Q128. A newly-hired CISO needs to understand the organization’s financial management standards for business units and operations. Which of the following would be the best source of this information?

Q129. Control Objectives for Information and Related Technology (COBIT) is which of the following?

Q130. Information security policies should be reviewed:

Q131. Risk is defined as:

Q132. When dealing with risk, the information security practitioner may choose to:

Q133. What oversight should the information security team have in the change management process for application security?

Q134. Which of the following are the triple constraints of project management?

Q135. You have implemented a new security control. Which of the following risk strategy options have you engaged in?

Q136. Which of the following is a major benefit of applying risk levels?

Q137. What process defines the framework of rules and practices by which a board of directors ensure accountability, fairness and transparency in an organization’s relationship with its shareholders?

Q138. An organization’s Information Security Policy is of MOST importance because

Q139. Which of the following is considered one of the most frequent failures in project management?

Q140. Which of the following is a benefit of information security governance?

Q141. When entering into a third party vendor agreement for security services, at what point in the process is it BEST to understand and validate the security posture and compliance level of the vendor?

Q142. Scenario: An organization has made a decision to address Information Security formally and consistently by adopting established best practices and industry standards. The organization is a small retail merchant but it is expected to grow to a global customer base of many millions of customers in just a few years.
Which of the following frameworks and standards will BEST fit the organization as a baseline for their security program?

Q143. Access Control lists (ACLs), Firewalls, and Intrusion Prevention Systems are examples of

Q144. When operating under severe budget constraints a CISO will have to be creative to maintain a strong security organization.
Which example below is the MOST creative way to maintain a strong security posture during these difficult times?

Q145. When is an application security development project complete?

Q146. Which of the following is true regarding expenditures?

Q147. Which of the following is the MAIN reason to follow a formal risk management process in an organization that hosts and uses privately identifiable information (PII) as part of their business models and processes?

Q148. A method to transfer risk is to:

Q149. The purpose of NIST SP 800-53 as part of the NIST System Certification and Accreditation Project is to establish a set of standardized, minimum security controls for IT systems addressing low, moderate, and high levels of concern for: