A method to transfer risk is to:

• A.Alignment with business operations
• B.move operations to another region
• C.Implement redundancy
• D.purchase breach insurance

Comment: *

Name: *

Email: *

Verification: *

As a new CISO at a large healthcare company you are told that everyone has to badge in to get in the building. Below your office window you notice a door that is normally propped open during the day for groups of people to take breaks outside. Upon looking closer you see there is no badge reader. What should you do?

• A.Close and chain the door shut and send a company-wide memo banning the practice.
• B.Have a risk assessment performed.
• C.Nothing, this falls outside your area of influence.
• D.Post a guard at the door to maintain physical security

Comment: *

Name: *

Email: *

Verification: *

Providing oversight of a comprehensive information security program for the entire organization is the primary responsibility of which group under the InfoSec governance framework?

• A.Senior Executives
• B.Office of the Auditor
• C.All employees and users
• D.Office of the General Counsel

Comment: *

Name: *

Email: *

Verification: *

Which of the following represents the BEST method of ensuring security program alignment to business needs?

• A.Ensure the organization has strong executive-level security representation through clear sponsorship or the creation of a CISO role
• B.Create security consortiums, such as strategic security planning groups, that include business unit participation
• C.Ensure security implementations include business unit testing and functional validation prior to production rollout
• D.Create a comprehensive security awareness program and provide success metrics to business units

Comment: *

Name: *

Email: *

Verification: *

When an organization claims it is secure because it is PCI-DSS certified, what is a good first question to ask towards assessing the effectiveness of their security program?

• A.How many credit card records are stored?
• B.What is the value of the assets at risk?
• C.What is the scope of the certification?
• D.How many servers do you have?

Comment: *

Name: *

Email: *

Verification: *