Security and Risk Management

A financial institution is required to comply with SOX. Which of the following is a key focus area for IT under SOX?

A company is implementing PCI DSS compliance. Which requirement is related to protecting cardholder data at rest?

Which component of the CIA triad ensures that information is not disclosed to unauthorized individuals, entities, or processes?

During a business impact analysis (BIA), which metric represents the maximum amount of time a business process can be disrupted before causing significant harm to the organization?

A healthcare organization covered by HIPAA wants to share protected health information (PHI) with a third-party billing service. What must be in place to comply with HIPAA?

Which document is mandatory, high-level, and sets the direction for security within an organization?

In a quantitative risk analysis, if the single loss expectancy (SLE) is $15,000 and the annual rate of occurrence (ARO) is 0.5, what is the annualized loss expectancy (ALE)?

Which TWO of the following are lawful bases for processing personal data under the GDPR? (Select two)

In the context of business continuity planning, which THREE of the following are typically identified during a business impact analysis (BIA)? (Select THREE.)

A company's disaster recovery plan includes an agreement with another company to provide backup computing facilities in case of a disaster. The agreement allows the second company to use the facilities for its own operations if needed. This arrangement is best described as:

Which of the following is the correct order of the ISC2 Code of Ethics canons from highest to lowest priority?

Under GDPR, which TWO of the following are valid lawful bases for processing personal data?

Under the ISC2 Code of Ethics, which canon takes precedence over all others?

A security manager is calculating the annual loss expectancy (ALE) for a server valued at $50,000. The exposure factor (EF) is 40%, and the annual rate of occurrence (ARO) is 0.5. What is the ALE?

An organization is implementing a new access control system. The security team wants to ensure that users cannot deny having performed an action. Which security principle is being addressed?

A security analyst is evaluating the risk of a data breach. The asset value of the database is $100,000, and the exposure factor is 0.5. If the annual rate of occurrence is 0.2, what is the annualized loss expectancy (ALE)?

Which of the following is an example of a security policy?

Under GDPR, which of the following is a valid lawful basis for processing personal data?

In a qualitative risk assessment, a risk with a likelihood rating of 'High' and an impact rating of 'Critical' would typically fall into which category?

Which component of the AAA framework is responsible for determining what resources a user can access and what actions they can perform?

A company is migrating its critical application to a cloud provider. Which disaster recovery strategy provides the shortest recovery time objective (RTO) and recovery point objective (RPO)?

A security manager is evaluating risk responses for a high-likelihood, low-impact risk. The cost of mitigation exceeds the potential loss. Which risk response strategy is most appropriate?

An organization is implementing a BCP. After completing the BIA, which of the following is the next logical step in the planning process?

During a Business Impact Analysis (BIA), the maximum amount of time a business process can be unavailable before causing significant harm is determined. Which metric represents this?

A company is implementing a risk management program. They have identified a critical server with an asset value of $50,000. The exposure factor due to a potential threat is 40%, and the annual rate of occurrence is 2. What is the Annualized Loss Expectancy (ALE)?

Which of the following is the correct order of priority for the ISC2 Code of Ethics Canons?

A company uses a qualitative risk analysis matrix where likelihood ranges from 1 to 5 and impact ranges from 1 to 5. A risk with a likelihood of 4 and an impact of 5 would fall into which risk level if the matrix defines high risk as scores above 15, medium as 10-15, and low as below 10?

An organization is implementing a new access control system. Which of the following represents the correct order of the AAA framework components?

Which document provides detailed step-by-step instructions for performing a specific security task?

Under HIPAA, what is the primary purpose of a Business Associate Agreement (BAA)?

A hospital is subject to HIPAA. Which of the following is required when sharing protected health information (PHI) with a third-party billing company?

A security manager is choosing a risk response for a high-impact, high-likelihood risk. Which TWO responses are most appropriate? (Select TWO)

Under the ISC2 Code of Ethics, which canon has the highest priority?

Which type of risk remains after management has implemented controls to mitigate the identified risks?

In qualitative risk analysis, a risk is assessed with a likelihood of 4 (on a scale of 1-5) and an impact of 5. The risk matrix defines scores of 15-25 as high. What is the risk rating?

Under the GDPR, a data controller experiences a personal data breach that is likely to result in a risk to the rights and freedoms of individuals. What is the maximum time frame within which the controller must notify the supervisory authority?

According to the ISC2 Code of Ethics, which of the following canons has the highest priority when resolving an ethical dilemma?

An organization wants to avoid a particular risk entirely by not engaging in the activity that creates the risk. Which risk response strategy is being used?

An organization's security policy requires that all data at rest must be encrypted. Which security principle is primarily being addressed?

An organization has identified a risk with a high likelihood and high impact. Management decides to implement controls to reduce the likelihood. After controls, the risk is reassessed as medium likelihood and medium impact. What is the residual risk?

Which governance framework provides guidance specifically for aligning IT services with business needs and includes a service lifecycle?

Which of the following is a key requirement under the GDPR regarding personal data breaches?

Which TWO of the following are examples of risk response strategies?

A company is implementing PCI DSS compliance. Which THREE requirements are part of the PCI DSS? (Select THREE)

Under the GDPR, which THREE of the following are rights of data subjects? (Select THREE.)

Which TWO of the following are examples of non-repudiation controls? (Select two)

A security administrator is reviewing the organization's security policy framework. The administrator needs to identify the document that provides detailed, step-by-step instructions for configuring a new server securely. Which type of document should the administrator reference?

A company is designing a disaster recovery plan. They need to recover critical systems within 4 hours and lose no more than 15 minutes of data. Which combination of RTO and RPO should be specified?

Which of the following is the PRIMARY goal of a Business Impact Analysis (BIA) in business continuity planning?

Which of the following is a key difference between a policy and a guideline in information security governance?

A security manager is conducting a risk assessment and needs to categorize the following risk responses: risk avoidance, risk transfer, risk mitigation, and risk acceptance. Which TWO of the following actions are examples of risk transfer? (Choose two.)

Which of the following is the PRIMARY purpose of the confidentiality principle in the CIA triad?

Under the PCI DSS, which of the following best describes a 'cardholder data environment' (CDE)?

A security auditor is reviewing an organization's governance framework. Which TWO of the following are commonly used frameworks for IT governance and security management?

Which of the following is a key objective of a business impact analysis (BIA)?

An organization is implementing a new governance framework to align IT with business goals. Which framework is specifically designed for IT service management?

An organization's security team is drafting a document that defines the organization's intent to protect information assets and assigns responsibilities to the information security manager. The document must align with ISO/IEC 27001 requirements and be approved by executive management. Which type of document is being created?

Under the Sarbanes-Oxley Act (SOX), which of the following is an example of an IT general control that supports financial reporting?

A security analyst is evaluating the risk of a data breach in a healthcare organization. The asset value of the patient database is $500,000, and the exposure factor is 0.2. The annual rate of occurrence is estimated at 0.1. What is the annualized loss expectancy (ALE)?

A company decides to purchase cyber insurance to cover potential losses from data breaches. Which risk response strategy does this represent?

Under HIPAA, a covered entity must have a Business Associate Agreement (BAA) with which of the following?

Which THREE of the following are key components of a disaster recovery plan for a hot site? (Select three)

Under the GDPR, what is the maximum time frame for notifying the supervisory authority of a personal data breach?

A security team is performing a quantitative risk analysis for a server valued at $100,000. The exposure factor is 0.4 and the annual rate of occurrence is 2. What is the annualized loss expectancy (ALE)?

An organization is required to report a personal data breach to the supervisory authority within 72 hours. Which regulation imposes this requirement?

Which THREE of the following are valid risk response strategies?

A company is implementing a hot site as a disaster recovery option. Which of the following best describes a hot site?

An organization is implementing a new access control system. They want to ensure that users are who they claim to be, that actions can be traced to individuals, and that access rights are managed appropriately. Which framework encompasses all three of these goals?

Which of the following is the primary purpose of the CIA triad in information security?