Information Security Programme

A security awareness program includes phishing simulations. Which THREE factors should be considered when designing the simulation frequency and difficulty? (Select THREE)

Which of the following is a leading indicator of security program effectiveness?

A company is designing a third-party risk management (TPRM) program. Which factor should PRIMARILY determine the tier of a vendor?

An information security manager is designing the reporting structure for the CISO. Which reporting structure is most likely to ensure independence and adequate authority for the security function?

An organization is implementing a security champions program. Which of the following is the primary benefit of such a program?

Which TWO of the following are key components of a security operations center (SOC)? (Select TWO)

A security manager is designing a security awareness program. Which TWO metrics are leading indicators of program effectiveness?

A company is selecting a security control framework. They want a prioritized set of controls that are implementation group-based and address common cyber threats. Which framework best meets these requirements?

An organization is implementing a security controls framework and needs to prioritize controls for a small business with limited resources. Which implementation group from CIS Controls v8 should be addressed first?

During third-party risk assessment, a vendor is found to have access to sensitive customer data. The vendor's own supply chain includes a critical fourth-party component. What is the BEST way to address this nth-party risk?

Which TWO of the following are components of a typical vulnerability management program?

A company is implementing a vendor tiering system for third-party risk management. Which TWO factors should be used to determine the tier of a vendor?

An organization with a mature security program is reviewing its budget allocation. The board has asked the CISO to justify a proposed increase. Which of the following provides the STRONGEST justification for the security budget?

Which of the following is a leading indicator of security program effectiveness?

In designing a security operations centre (SOC), which TWO functions are core to the SOC's responsibilities? (Select TWO.)

A security manager is selecting a controls framework for a new organization. Which framework provides the most granular control families and is widely used for US federal agencies?

A company maintains a security scorecard for the executive team. Which metric is MOST appropriate to include as a leading indicator on a one-page dashboard?

An organization's security budget is 12% of the IT budget. Which of the following best describes the maturity of this security program?

An organization uses ISO 27001 Annex A controls. During a risk assessment, they identify a need for a compensating control because the primary control is not feasible. What should the security manager do FIRST?

A CISO is building a security operations center (SOC). Which TWO of the following are primary functions of a SOC?

A CISO is designing a security scorecard for the board of directors. Which metric is most appropriate to include for a one-page executive dashboard?

A security manager is building a business case for additional security budget. Which THREE justifications are most effective for obtaining executive approval? (Select THREE)

A security manager is selecting controls for a new application. Which of the following is the BEST approach for prioritization?

Which of the following is a key objective of implementing a security champions program?

An information security manager needs to justify a budget increase. Which approach would be MOST effective for gaining executive approval?

In the context of defense-in-depth, which control provides protection at the network layer to prevent unauthorized access?

A company is developing security metrics to present to the C-suite. Which metric is a leading indicator of security performance?

An organization's CISO reports to the CIO. The CISO is concerned that security initiatives are often deprioritized due to conflicts of interest. Which reporting structure would best address this concern?

A CISO is establishing a vendor risk management (TPRM) program. Which THREE of the following are key components of an effective TPRM program?

A security manager needs to justify an increase in the security budget. Which metric is MOST compelling to demonstrate the value of security investments to the board?

An organization is developing a vendor risk management program. Which TWO of the following should be included in the vendor onboarding risk assessment?

A company is implementing a third-party risk management program and needs to prioritize vendors for assessment. Which factor should be given the highest weight?

Which metric is considered a lagging indicator of security program performance?

An organization is implementing a defense-in-depth strategy. Which of the following control combinations BEST exemplifies this principle?

During a third-party risk assessment, the security team discovers that a critical vendor's sub-supplier (nth party) has access to sensitive data. The vendor contract does not address nth-party risk. What is the BEST course of action?

Which of the following is a leading indicator for security performance?

An organization is developing a security scorecard for the CISO. Which of the following is a leading indicator that would be most useful for predicting future security incidents?

Which THREE elements are essential components of a third-party risk management (TPRM) program? (Select THREE)

Which TWO of the following are characteristics of a security champions program that contribute to its effectiveness?

Which security control framework is organized into Implementation Groups (IG1, IG2, IG3) based on organizational risk profile and resources?

A security architect is designing a defense-in-depth strategy for a financial institution. Which TWO of the following are essential components of a defense-in-depth approach?

A security manager is developing metrics for the executive dashboard. Which combination of metrics provides a balanced view of security program performance?

An organization is designing a vendor tiering process for its third-party risk management program. Which TWO factors are MOST appropriate for determining a vendor's risk tier?

Which control family in NIST SP 800-53 addresses the identification and authentication of users?

An organization uses ISO 27001 Annex A as its control framework. During a risk assessment, a control weakness is identified that could lead to a high-impact data breach. However, implementing the recommended control is cost-prohibitive. Which approach BEST addresses this situation?

During a third-party risk assessment, the security team discovers that a critical vendor has subcontracted data processing to another company without notification. This represents which type of risk?

A security awareness program includes phishing simulations. Which metric best measures the long-term effectiveness of the program?

An organization is implementing a defense-in-depth strategy. Which of the following control combinations BEST exemplifies this approach?

A company is designing a security awareness program. Which approach is MOST effective for ensuring that employees apply security principles in their daily work?

In designing a security programme for a mid-sized enterprise, the CISO is deciding which security framework to adopt for control selection. Which of the following frameworks is specifically structured around implementation groups (IG1, IG2, IG3) to help organizations prioritize controls based on risk and maturity?

An organization is implementing an identity and access management (IAM) program. Which THREE of the following are key components of a mature IAM program?

Which TWO metrics are considered leading indicators for information security program performance?

Which TWO budget components are considered 'services' in a typical security budget?

A security manager is designing a security awareness program for a mid-sized organization. Which of the following is the MOST effective approach to ensure that training is relevant to different employee roles?

In a vendor tiering system for third-party risk management, which factor is most critical for determining the tier?

Which THREE of the following are key activities in a third-party risk management (TPRM) program?

A security manager is developing a set of objectives and key results (OKRs) for the security program. Which THREE would be considered effective security OKRs?

A CISO is presenting security metrics to the board. Which of the following metrics would be MOST relevant for a one-page executive dashboard?

A CISO is evaluating the reporting structure for the information security team. Which reporting line is generally considered MOST effective for ensuring independence and organizational influence?

A security manager is designing a security budget for a mid-sized company. Which TWO of the following are typical components of a security budget?

An organization is implementing a vendor risk management program. A vendor that provides cloud-based HR services will have access to employee PII. According to industry best practices, what should be the first step in the vendor lifecycle?

An organization is implementing a security controls framework based on NIST SP 800-53. The CISO wants to prioritize controls that will provide the greatest risk reduction for critical assets. Which approach should be used to select the initial set of controls?

An organization with a mature security program allocates 12% of its IT budget to security. Which factor is MOST likely to support this level of investment?

Which THREE of the following are components of a security operations center (SOC)?

A company wants to establish a security champions program. What is the primary benefit of embedding security champions in development teams?

What is the PRIMARY purpose of a security champions program?

A security manager is designing a metrics dashboard for the CISO. Which TWO metrics are leading indicators of security performance? (Select TWO)

A company is designing its security awareness program. Which approach BEST addresses the need for role-based training?

Which role is primarily responsible for designing and reviewing an organization's security architecture?

A CISO is developing key risk indicators (KRIs) for the security programme. Which TWO of the following are lagging indicators? (Select TWO.)

Which of the following BEST describes the role of a security architect in a security program?

In a security awareness program, which training approach is most appropriate for software developers?

Which of the following is a leading indicator of security program effectiveness?

A CISO is designing the security organization for a financial services firm. Which reporting structure is most likely to ensure the independence and authority of the information security function?

A CISO is evaluating metrics for an executive security report. Which TWO of the following are lagging indicators?

What is the primary function of a Security Operations Center (SOC)?

A security manager is selecting controls for a new application. Which TWO controls are most important to include in a defense-in-depth strategy? (Select TWO)

Which of the following is the BEST reporting structure for a CISO to ensure independent oversight and alignment with business strategy?

An organization uses CIS Controls v8. They are a small business with limited cybersecurity resources. Which implementation group (IG) should they prioritize?

Which control framework is most appropriate for an organization that wants a prioritized set of controls based on implementation groups (IG1, IG2, IG3)?

In a security operations center (SOC), which function is PRIMARILY responsible for analyzing alerts and determining whether they represent actual security incidents?

In a third-party risk management programme, what is the primary purpose of vendor tiering?

A security manager is developing a security scorecard for the CISO. Which THREE of the following metrics are considered LEADING indicators?

Which of the following is the PRIMARY purpose of a security awareness program?

A security architect is designing a defense-in-depth strategy. Which combination of controls best exemplifies this approach?

An organization is selecting security controls from NIST SP 800-53. Which TWO control families are most directly related to access control? (Select TWO)

A financial institution uses CIS Controls v8 and must prioritize implementation. The organization has limited resources and high exposure to ransomware. Which implementation group should be addressed FIRST?

An organization is redesigning its information security program to better align with business objectives. The CISO reports to the CIO, but business leaders feel security decisions are too IT-centric. Which reporting structure would best address this concern?

An organization is implementing a security champions program to improve application security. Which THREE of the following are key success factors for such a program?

Which control selection framework includes implementation groups (IG1, IG2, IG3) that help organizations prioritize controls based on their risk profile?

A CISO is evaluating security metrics for reporting to the board. Which TWO of the following are leading indicators?

A CISO wants to present a high-level security status to the board using a one-page dashboard. Which of the following metrics is MOST appropriate for this audience?

Which role within a security team is primarily responsible for designing and reviewing security architectures to ensure alignment with business requirements and security standards?

Which security team role is primarily responsible for defining and maintaining security architecture standards?

Which control framework is structured around Implementation Groups (IG1, IG2, IG3) to help organizations prioritize security controls based on risk?

A security manager is designing an executive security report. Which content is most appropriate for a one-page C-suite dashboard?

When implementing security controls, which approach ensures that multiple layers of defense are applied so that if one control fails, others compensate?

A security manager is designing a vulnerability management program. Which TWO of the following are essential processes?

Which role is primarily responsible for developing and maintaining the organization's security architecture?

A security manager is evaluating OKRs for the vulnerability management team. Which key result best aligns with an objective to reduce risk from vulnerabilities?

An organization is implementing a third-party risk management (TPRM) program. Which approach best addresses nth-party risk?

A CISO is preparing the security budget for the next fiscal year. The current IT budget is $10 million. For a mature security program, what is the recommended security budget range?

In a defence-in-depth strategy, which control is considered a compensating control when a critical application cannot be patched immediately due to operational constraints?

What is the primary purpose of a vulnerability management program?

A security manager is developing metrics for the C-suite dashboard. Which combination of metrics would provide the best view of security program effectiveness, including both leading and lagging indicators?

A CISO is evaluating a cloud provider's security posture. Which of the following should be the MOST important consideration in the vendor risk assessment?

An organization is designing a third-party risk management (TPRM) program. They have identified a vendor that stores sensitive customer data. According to best practices, what should be the minimum requirement for this vendor's contract?

A company is designing a third-party risk management (TPRM) program. Which THREE of the following are essential components of the ongoing monitoring phase for a critical vendor?

An organization is designing a security operations center (SOC). Which of the following functions is PRIMARILY responsible for analyzing alerts and determining if they represent genuine threats?

A security manager needs to justify an increase in the security budget to the board. The current budget is 0.15% of revenue. Which approach would most effectively demonstrate the need for additional funding?

Which of the following is a LEADING indicator of security performance?

An organization wants to establish a security champions program. What is the primary benefit of embedding security advocates in development teams?

A SOC analyst receives an alert about a potential malware infection on a critical server. Which step should the analyst take FIRST?

Which of the following is the PRIMARY benefit of a security champions program?

A security dashboard is being designed for the C-suite. Which metric is most appropriate for a one-page executive summary?

A security awareness manager is designing role-based training. Which training is most appropriate for software developers?

Which of the following is the primary objective of a security champions programme?

Which of the following is a leading indicator for measuring the effectiveness of a security awareness program?

An organization is implementing a security controls framework and needs to prioritize which controls to implement first. According to CIS Controls v8, which approach aligns with the principle of 'implementation groups'?

Which of the following is the PRIMARY purpose of a security champions program?

Which of the following security team roles is primarily responsible for designing and implementing security solutions to protect an organization's systems and data?

An organization is defining objectives and key results (OKRs) for the security program. Which TWO of the following are examples of leading indicators that could be used as key results?

A large organization is implementing a security controls framework and wants to prioritize controls that provide the greatest risk reduction with the least operational friction. Which approach should the security manager adopt?

A security manager is developing OKRs for the security team. Which TWO key results are appropriate leading indicators? (Select TWO)

An organization's SOC team is measured on mean time to detect (MTTD) and mean time to respond (MTTR). The security manager notices that MTTD is low but MTTR is high. What is the most likely cause?

Which of the following is a key objective of a Security Operations Center (SOC)?

In a vendor risk assessment, a third-party vendor will have access to sensitive customer data. According to TPRM best practices, what should the organization do first?

When designing phishing simulations, which approach best balances user learning and operational disruption?

A company is assessing nth-party risk from a critical cloud provider. Which approach should be taken to manage this risk effectively?

When selecting security controls, a company must prioritize which controls first?

During a security architecture review, the security architect identifies that a new application stores sensitive customer data in plaintext in the database. The application owner argues that performance requirements prevent encryption. What is the most appropriate compensating control to reduce risk?

A company uses a SaaS provider that processes sensitive customer data. The provider undergoes annual SOC 2 audits. Which additional step is essential to manage nth-party risk?

A CISO is deciding on the organizational structure for the information security team. Which reporting structure is most likely to ensure the security function has sufficient independence and authority?

An information security manager is designing a security awareness program. Which approach BEST addresses the different learning needs of various employee groups?

An organization is implementing a security champions program. What is the primary purpose of this initiative?

An organization is implementing CIS Controls v8. Which THREE of the following are implementation groups (IGs) defined in the CIS Controls?

Which of the following is a leading indicator for measuring the effectiveness of a security awareness program?

A multinational organization is implementing a vendor risk management programme. Which THREE of the following should be included in the programme to effectively manage nth-party risk? (Select THREE.)

Which TWO are key elements of a security awareness program designed to change employee behavior?

A security manager is developing a security scorecard for the C-suite. Which combination of metrics would be MOST appropriate for a one-page dashboard?

An organization is implementing a data security program. Which of the following is the most effective approach to protect sensitive data at rest?

An organization is implementing a vendor tiering program for third-party risk management. Which TWO criteria should be used to classify vendors into high, medium, or low risk tiers? (Select TWO)

An organization is implementing a defense-in-depth strategy. Which of the following is the BEST example of a compensating control?

An information security manager is asked to justify an increase in the security budget. Which approach BEST demonstrates the value of the security program?

An organization is designing a security awareness program. Which TWO of the following should be included for developers?

Which TWO of the following are typical components of a security awareness program?

Which of the following is a LEADING indicator of security performance?

Which of the following best describes the role of a security architect in a security program?

A security awareness program includes phishing simulations. After six months, the click rate has decreased from 15% to 8%, but the number of reported phishing emails has also dropped. The CISO wants to measure the effectiveness of the program. Which metric would best indicate sustained improvement in security behavior?

A CISO is planning the security programme budget and wants to justify the investment to the CFO. The organization has a moderate risk appetite and an IT budget of $10 million. What is the most appropriate budget range for the security programme based on industry benchmarks?

A security manager needs to justify an increase in the security budget. Which approach provides the strongest quantitative justification?

An information security manager is developing a security scorecard for the board. Which combination of metrics BEST provides a balanced view of security program effectiveness?

A mature security program allocates 12% of IT budget to security. Which combination of budget components is most balanced for a program seeking to improve detection and response capabilities?

An organization's security budget is 8% of the IT budget. Industry benchmarks suggest 10-15% for mature programs. Which of the following should the CISO do FIRST to justify an increase?

An organization wants to implement a defense-in-depth strategy for its web application. Which set of controls best exemplifies this approach?

When selecting security controls based on NIST SP 800-53, which control family is MOST directly related to protecting the confidentiality of data?

Which control family from NIST SP 800-53 is MOST directly associated with ensuring that users have appropriate access rights?

A company has implemented a security awareness program with quarterly phishing simulations. The click rate has remained at 15% for the past two quarters. What is the most effective next step?

Which of the following metrics would be MOST useful for measuring the effectiveness of a phishing simulation program?

An organization's third-party risk management program has been in place for two years. Which of the following is the MOST critical action to ensure the program remains effective?

An organization wants to measure the effectiveness of its security awareness programme. Which metric is a leading indicator of improved security culture?

An organization is implementing a security controls framework and must decide on prioritization. According to defense-in-depth principles, which approach should be taken first?