Security and Risk Management

An organization is implementing a new access control system. Which of the following represents the correct order of the AAA framework components?

A security analyst is evaluating the risk of a data breach. The asset value of the database is $100,000, and the exposure factor is 0.5. If the annual rate of occurrence is 0.2, what is the annualized loss expectancy (ALE)?

Under the ISC2 Code of Ethics, which canon takes precedence over all others?

A company is migrating its critical application to a cloud provider. Which disaster recovery strategy provides the shortest recovery time objective (RTO) and recovery point objective (RPO)?

Which governance framework provides guidance specifically for aligning IT services with business needs and includes a service lifecycle?

In a qualitative risk assessment, a risk with a likelihood rating of 'High' and an impact rating of 'Critical' would typically fall into which category?

Which of the following is an example of a security policy?

Under GDPR, which of the following is a valid lawful basis for processing personal data?

A hospital is subject to HIPAA. Which of the following is required when sharing protected health information (PHI) with a third-party billing company?

In a quantitative risk analysis, if the single loss expectancy (SLE) is $15,000 and the annual rate of occurrence (ARO) is 0.5, what is the annualized loss expectancy (ALE)?

Which of the following is a key objective of a business impact analysis (BIA)?

Under the Sarbanes-Oxley Act (SOX), which of the following is an example of an IT general control that supports financial reporting?

A security manager is choosing a risk response for a high-impact, high-likelihood risk. Which TWO responses are most appropriate? (Select TWO)

A company is implementing PCI DSS compliance. Which THREE requirements are part of the PCI DSS? (Select THREE)

Which of the following is the primary purpose of the CIA triad in information security?

An organization is implementing a new access control system. The security team wants to ensure that users cannot deny having performed an action. Which security principle is being addressed?

A company uses a qualitative risk analysis matrix where likelihood ranges from 1 to 5 and impact ranges from 1 to 5. A risk with a likelihood of 4 and an impact of 5 would fall into which risk level if the matrix defines high risk as scores above 15, medium as 10-15, and low as below 10?

Which of the following is a key requirement under the GDPR regarding personal data breaches?

According to the ISC2 Code of Ethics, which of the following canons has the highest priority when resolving an ethical dilemma?

A security manager is calculating the annual loss expectancy (ALE) for a server valued at $50,000. The exposure factor (EF) is 40%, and the annual rate of occurrence (ARO) is 0.5. What is the ALE?

Under the PCI DSS, which of the following best describes a 'cardholder data environment' (CDE)?

Which component of the AAA framework is responsible for determining what resources a user can access and what actions they can perform?

An organization is implementing a BCP. After completing the BIA, which of the following is the next logical step in the planning process?

Which of the following is a key difference between a policy and a guideline in information security governance?

A healthcare organization covered by HIPAA wants to share protected health information (PHI) with a third-party billing service. What must be in place to comply with HIPAA?

A security auditor is reviewing an organization's governance framework. Which TWO of the following are commonly used frameworks for IT governance and security management?

Which TWO of the following are examples of risk response strategies?

Which of the following is the PRIMARY purpose of the confidentiality principle in the CIA triad?

An organization is implementing a new governance framework to align IT with business goals. Which framework is specifically designed for IT service management?

A security team is performing a quantitative risk analysis for a server valued at $100,000. The exposure factor is 0.4 and the annual rate of occurrence is 2. What is the annualized loss expectancy (ALE)?

Under the GDPR, what is the maximum time frame for notifying the supervisory authority of a personal data breach?

Which of the following is the correct order of priority for the ISC2 Code of Ethics Canons?

Which document provides detailed step-by-step instructions for performing a specific security task?

A company decides to purchase cyber insurance to cover potential losses from data breaches. Which risk response strategy does this represent?

Under HIPAA, what is the primary purpose of a Business Associate Agreement (BAA)?

Which of the following is the PRIMARY goal of a Business Impact Analysis (BIA) in business continuity planning?

A company is implementing PCI DSS compliance. Which requirement is related to protecting cardholder data at rest?

An organization has identified a risk with a high likelihood and high impact. Management decides to implement controls to reduce the likelihood. After controls, the risk is reassessed as medium likelihood and medium impact. What is the residual risk?

Which TWO of the following are lawful bases for processing personal data under the GDPR? (Select two)

Which THREE of the following are key components of a disaster recovery plan for a hot site? (Select three)

Which TWO of the following are examples of non-repudiation controls? (Select two)

A security analyst is evaluating the risk of a data breach in a healthcare organization. The asset value of the patient database is $500,000, and the exposure factor is 0.2. The annual rate of occurrence is estimated at 0.1. What is the annualized loss expectancy (ALE)?

Which of the following is the correct order of the ISC2 Code of Ethics canons from highest to lowest priority?

An organization is implementing a new access control system. They want to ensure that users are who they claim to be, that actions can be traced to individuals, and that access rights are managed appropriately. Which framework encompasses all three of these goals?

Under the GDPR, a data controller experiences a personal data breach that is likely to result in a risk to the rights and freedoms of individuals. What is the maximum time frame within which the controller must notify the supervisory authority?

Which type of risk remains after management has implemented controls to mitigate the identified risks?

A financial institution is required to comply with SOX. Which of the following is a key focus area for IT under SOX?

During a business impact analysis (BIA), which metric represents the maximum amount of time a business process can be disrupted before causing significant harm to the organization?

In qualitative risk analysis, a risk is assessed with a likelihood of 4 (on a scale of 1-5) and an impact of 5. The risk matrix defines scores of 15-25 as high. What is the risk rating?

Which document is mandatory, high-level, and sets the direction for security within an organization?

Under HIPAA, a covered entity must have a Business Associate Agreement (BAA) with which of the following?

An organization wants to avoid a particular risk entirely by not engaging in the activity that creates the risk. Which risk response strategy is being used?

Which component of the CIA triad ensures that information is not disclosed to unauthorized individuals, entities, or processes?

A company is designing a disaster recovery plan. They need to recover critical systems within 4 hours and lose no more than 15 minutes of data. Which combination of RTO and RPO should be specified?

A company is implementing a hot site as a disaster recovery option. Which of the following best describes a hot site?

Under the GDPR, which THREE of the following are rights of data subjects? (Select THREE.)

In the context of business continuity planning, which THREE of the following are typically identified during a business impact analysis (BIA)? (Select THREE.)

An organization's security policy requires that all data at rest must be encrypted. Which security principle is primarily being addressed?

A company is implementing a risk management program. They have identified a critical server with an asset value of $50,000. The exposure factor due to a potential threat is 40%, and the annual rate of occurrence is 2. What is the Annualized Loss Expectancy (ALE)?

During a Business Impact Analysis (BIA), the maximum amount of time a business process can be unavailable before causing significant harm is determined. Which metric represents this?

A security manager is evaluating risk responses for a high-likelihood, low-impact risk. The cost of mitigation exceeds the potential loss. Which risk response strategy is most appropriate?

Under the ISC2 Code of Ethics, which canon has the highest priority?

An organization is required to report a personal data breach to the supervisory authority within 72 hours. Which regulation imposes this requirement?

A company's disaster recovery plan includes an agreement with another company to provide backup computing facilities in case of a disaster. The agreement allows the second company to use the facilities for its own operations if needed. This arrangement is best described as:

Which THREE of the following are valid risk response strategies?

Under GDPR, which TWO of the following are valid lawful bases for processing personal data?

An organization's security team is drafting a document that defines the organization's intent to protect information assets and assigns responsibilities to the information security manager. The document must align with ISO/IEC 27001 requirements and be approved by executive management. Which type of document is being created?

A security manager is conducting a risk assessment and needs to categorize the following risk responses: risk avoidance, risk transfer, risk mitigation, and risk acceptance. Which TWO of the following actions are examples of risk transfer? (Choose two.)

A security administrator is reviewing the organization's security policy framework. The administrator needs to identify the document that provides detailed, step-by-step instructions for configuring a new server securely. Which type of document should the administrator reference?