The success of the Chief Information Security Officer is MOST dependent upon:

A. favorable audit findings

B. following the recommendations of consultants and contractors

C. development of relationships with organization executives

D. raising awareness of security issues with end users

When would it be more desirable to develop a set of decentralized security policies and procedures within an enterprise environment?

A. When there is a need to develop a more unified incident response capability.

B. When the enterprise is made up of many business units with diverse business activities, risks profiles and regulatory requirements.

C. When there is a variety of technologies deployed in the infrastructure.

D. When it results in an overall lower cost of operating the security program.

A CISO implements smart cards for credential management, and as a result has reduced costs associated with help desk operations supporting password resets. This demonstrates which of the following principles?

A. Security alignment to business goals

B. Regulatory compliance effectiveness

C. Increased security program presence

D. Proper organizational policy enforcement

As the Chief Information Security Officer, you want to ensure data shared securely, especially when shared with third parties outside the organization. What protocol provides the ability to extend the network perimeter with the use of encapsulation and encryption?

A. File Transfer Protocol (FTP)

B. Virtual Local Area Network (VLAN)

C. Simple Mail Transfer Protocol

D. Virtual Private Network (VPN)

Scenario: You are the CISO and have just completed your first risk assessment for your organization. You find many risks with no security controls, and some risks with inadequate controls. You assign work to your staff to create or adjust existing security controls to ensure they are adequate for risk mitigation needs.

You have identified potential solutions for all of your risks that do not have security controls.

What is the NEXT step?

A. Get approval from the board of directors

B. Screen potential vendor solutions

C. Verify that the cost of mitigation is less than the risk

D. Create a risk metrics for all unmitigated risks