Information Security Program practice questions

Security Policy

Why wrong: Matching item, not directly evaluated here.

Incident Response Plan

Why wrong: Matching item.

Risk Assessment

Why wrong: Matching item.

Describes the organization's high-level security objectives and management commitment

Why wrong: Correct match for Security Policy.

Provides step-by-step actions to detect, respond, and recover from security incidents

Why wrong: Correct match for Incident Response Plan.

Identifies threats, vulnerabilities, and impacts to determine risk levels

Why wrong: Correct match for Risk Assessment.

C. Identification and analysis of threats

Why wrong: This is correct matching; but in JSON we mark all false and use pbq_config.

List of specific security tools to be deployed.

Why wrong: Tools are tactical; not part of charter.

Vendor selection criteria.

Why wrong: Operational detail; not charter-level.

Detailed budget allocation.

Why wrong: Budget is separate; charter is strategic.

Total number of security staff.

Why wrong: Resource metric, not a performance indicator.

Average number of firewall rules per device.

Why wrong: Does not reflect performance or outcomes.

Free and open-source security tools

Why wrong: Tools are not part of the governance framework.

Formal risk appetite statement

Why wrong: While important, risk appetite is often a component of risk management, not always an essential framework element.

Quarterly board meetings

Why wrong: Board meetings are governance, not a continuous improvement process.

Monthly patching

Why wrong: Patching is a routine operational activity, not a continuous improvement mechanism.

Regular security awareness training

Why wrong: Training is for maintaining awareness, not directly for program improvement.

Use of phishing simulations

Why wrong: Simulations are a tool, not the core factor of program effectiveness.

Frequency of training sessions

Why wrong: More frequent training is not effective if not relevant.

Management endorsement

Why wrong: Support is important but not the primary driver of effectiveness.

List of approved security technologies.

Why wrong: Technology decisions are operational, not charter level.

Detailed annual budget allocation.

Why wrong: Budget is a supporting document, not a charter component.

List of approved third-party vendors.

Why wrong: Vendor management is a separate process.

Implement the SIEM system immediately to achieve real-time threat detection.

Why wrong: A SIEM is costly and resource-intensive; a small company cannot justify the expense or management overhead.

Outsource all security operations to a managed security service provider (MSSP).

Why wrong: Outsourcing can be effective but is not the first priority; internal foundational controls should be established first.

Develop a custom security software solution tailored to the company's payment processing system.

Why wrong: Custom development is expensive, time-consuming, and prone to errors; off-shelf products are more reliable and cost-effective.

Automate security compliance monitoring across all business units.

Why wrong: Automation is a tool, but without understanding the current state, it may not address inconsistencies.

Update the information security policy to mandate compliance.

Why wrong: A policy update alone does not ensure consistent application; enforcement and monitoring are needed.

Implement additional security controls across all business units.

Why wrong: Implementing controls without a risk assessment may not address the actual risks and could be inefficient.

Implement the strictest regulatory requirements globally to ensure compliance everywhere.

Why wrong: This can be excessively restrictive and reduce business agility in regions with lighter regulations.

Adopt a baseline of controls that meet the lowest common denominator of all regulations.

Why wrong: This may leave high-risk areas under-protected and does not address stricter requirements.

Allow each business unit to define its own security controls based on local requirements.

Why wrong: Without central coordination, this can lead to fragmentation and ineffective risk management.

Develop a security awareness training program.

Why wrong: Awareness is a component, but not the first step in program development.

Design the security architecture based on industry frameworks.

Why wrong: Architecture should be driven by business strategy and risk, not chosen in isolation.

Conduct a comprehensive risk assessment.

Why wrong: A risk assessment is important but should be guided by business goals and risk appetite.

Adopt the more stringent security program from the acquirer across the entire entity.

Why wrong: This may not be cost-effective and could disrupt business operations.

Merge the two programs by combining all controls from each.

Why wrong: This could lead to redundant or conflicting controls without addressing gaps.

Implement a completely new framework that meets both regulations.

Why wrong: This may ignore existing controls and cause unnecessary disruption.

An incident response plan that defines roles and procedures.

Why wrong: Incident response is operational, not governance.

A vulnerability scanning schedule and remediation SLAs.

Why wrong: This is a technical control, not a governance element.

A firewall policy that specifies allowed and denied traffic.

Why wrong: Firewall policy is a technical control, not governance.

A SYN flood attack is in progress.

Why wrong: Each connection completes the handshake, so it is not a SYN flood.

A single host is using multiple IP addresses to scan the server.

Why wrong: The requests are to the same server but from different legitimate sources.

A distributed denial-of-service (DDoS) attack is occurring.

Why wrong: The traffic volume is low and appears normal; no indication of overload.

Encrypt all data in transit and at rest using the organization's own encryption keys.

Why wrong: Encryption is a control, but without assessing the CSP's overall security, data could still be at risk.

Implement compensating controls such as tokenization for all cardholder data stored in the cloud.

Why wrong: Compensating controls are a secondary measure; the primary need is to assess the CSP's security posture.

Require the mobile app development team to undergo formal security training and implement a peer review process for all code deployments.

Why wrong: While important for secure development, this does not address the immediate cloud risk.

Compliance with industry regulations

Why wrong: Compliance is a requirement but not the primary driver; the program must support business goals to be effective.

Reducing information security costs

Why wrong: Cost reduction is a possible outcome but not the primary driver for alignment.

Implementing the latest security technologies

Why wrong: Adopting new technologies is a tactic, not the primary driver.

Percentage of employees who completed security awareness training

Why wrong: Training completion is a leading indicator but does not measure program effectiveness in handling incidents.

Total cost of security investments compared to industry benchmarks

Why wrong: Cost comparison does not indicate how well the program performed.

Number of vulnerabilities identified in the latest penetration test

Why wrong: Vulnerability counts are point-in-time and not a comprehensive measure of program effectiveness.

Develop information security policies and procedures

Why wrong: Policies should be based on risk assessment results, not developed first.

Select and implement security controls

Why wrong: Controls are selected after risks are identified.

Define security metrics and reporting

Why wrong: Metrics are defined after program objectives and controls are established.

The cost of implementing the control

Why wrong: Cost is a factor but not the most important; risk acceptance is paramount.

The number of users affected by the exception

Why wrong: Number of users is less important than the risk exposure.

The duration of the exception

Why wrong: Duration matters but is secondary to the risk level.