Q281. What does RACI stand for?

Q282. When deploying an Intrusion Prevention System (IPS) the BEST way to get maximum protection from the system is to deploy it

Q283. Which of the following activities must be completed BEFORE you can calculate risk?

Q284. A Security Operations Centre (SOC) manager is informed that a database containing highly sensitive corporate strategy information is under attack. Information has been stolen and the database server was disconnected. Who must be informed of this incident?

Q285. Scenario: Your corporate systems have been under constant probing and attack from foreign IP addresses for more than a week. Your security team and security infrastructure have performed well under the stress. You are confident that your defenses have held up under the test, but rumors are spreading that sensitive customer data has been stolen and is now being sold on the Internet by criminal elements. During your investigation of the rumored compromise you discover that data has been breached and you have discovered the repository of stolen data on a server located in a foreign country. Your team now has full access to the data on the foreign server.
What action should you take FIRST?

Q286. The process for identifying, collecting, and producing digital information in support of legal proceedings is called

Q287. When developing the Business Impact Assessment (BIA), which of the following MOST closely relates to data backup and restoration?

Q288. Which of the following has the GREATEST impact on the implementation of an information security governance model?

Q289. When would it be more desirable to develop a set of decentralized security policies and procedures within an enterprise environment?

Q290. Smith, the project manager for a larger multi-location firm, is leading a software project team that has 18 members, 5 of which are assigned to testing. Due to recent recommendations by an organizational quality audit team, the project manager is convinced to add a quality professional to lead to test team at additional cost to the project.
The project manager is aware of the importance of communication for the success of the project and takes the step of introducing additional communication channels, making it more complex, in order to assure quality levels of the project. What will be the first project management document that Smith should change in order to accommodate additional communication channels?

Q291. Bob waits near a secured door, holding a box. He waits until an employee walks up to the secured door and uses the special card in order to access the restricted area of the target company. Just as the employee opens the door, Bob walks up to the employee (still holding the box) and asks the employee to hold the door open so that he can enter. What is the best way to undermine the social engineering activity of tailgating?

Q292. Acme Inc. has engaged a third party vendor to provide 99.999% up-time for their online web presence and had them contractually agree to this service level agreement. What type of risk tolerance is Acme exhibiting? (choose the BEST answer):

Q293. Creating a secondary authentication process for network access would be an example of?

Q294. When selecting a security solution with reoccurring maintenance costs after the first year (choose the BEST answer):

Q295. Which of the following is critical in creating a security program aligned with an organization’s goals?

Q296. A cloud computing environment that is bound together by technology that allows data and applications to be shared between public and private clouds is BEST referred to as a?

Q297. When creating a vulnerability scan schedule, who is the MOST critical person to communicate with in order to ensure impact of the scan is minimized?

Q298. The Information Security Governance program MUST:

Q299. Risk that remains after risk mitigation is known as

Q300. A company wants to fill a Chief Information Security Officer position. Which of the following qualifications and experience would be MOST desirable in a candidate?

Q301. The purpose of NIST SP 800-53 as part of the NIST System Certification and Accreditation Project is to establish a set of standardized, minimum security controls for IT systems addressing low, moderate, and high levels of concern for

Q302. A recent audit has identified a few control exceptions and is recommending the implementation of technology and processes to address the finding. Which of the following is the MOST likely reason for the organization to reject the implementation of the recommended technology and processes?

Q303. Regulatory requirements typically force organizations to implement