Security Management chapter 1

Matt is updating the organization's threat assessment process.

• A. Operational
• B. Technical
• C. Corrective
• D. Managerial

Answer explanation

Managerial controls are procedural mechanisms that focus on the mechanics of the risk management process. Threat assessment is an example of one of these activities.

Jade's organization recently suffered a security breach that affected stored credit card data. Jade's primary concern is the fact that the organization is subject to sanctions for violating the provisions of the Payment Card Industry Data Security Standard. What category of risk is concerning Jade?

• A. Strategic
• B. Compliance
• C. Operational
• D. Financial

Answer explanation

The breach of credit card information may cause many different impacts on the organization, including compliance, operational, and financial risks. However, in this scenario, Jade's primary concern is violating PCI DSS, making the concern a compliance risk.

Chris is responding to a security incident that compromised one of his organization's web servers. He believes that the attackers defaced one or more pages on the website. What cybersecurity objective did this attack violate?

• A. Confidentiality
• B. Nonrepudiation
• C. Integrity
• D. Availability

Answer explanation

The defacement of a website alters content without authorization and is, therefore, a violation of the integrity objective. The attackers may also have breached the confidentiality or availability of the website, but the scenario does not provide us with enough information to draw those conclusions.

Which one of the following elements is most important to gaining the support of senior leaders for cybersecurity initiatives?

• A. Using plain, understandable language
• B. Communicating often and in the format desired by the leaders
• C. Demonstrating the alignment between business objectives and security needs
• D. Adopting emerging technologies

Answer explanation

The most important consideration when gaining stakeholder support for security initiatives is demonstrating the alignment between a request and the objectives of the business. While managers should certainly use plain language and communicate in the format desired by leaders, these are secondary considerations. Adopting emerging technologies is not necessary to underscore the importance of security initiatives.

Tonya is concerned about the risk that an attacker will attempt to gain access to her organization's database server. She is searching for a control that would discourage the attacker from attempting to gain access. What type of security control is she seeking to implement?

• A. Preventive
• B. Detective
• C. Corrective
• D. Deterrent

Answer explanation

Deterrent controls are designed to prevent an attacker from attempting to violate security policies in the first place. Preventive controls would attempt to block an attack that was about to take place. Corrective controls would remediate the issues that arose during an attack.

Which one of the following individuals bears ultimate responsibility for protecting an organization's data?

• A. Data steward
• B. End users
• C. Data custodian
• D. Data owner

Answer explanation

All individuals within an organization have some responsibility for protecting data. However, the data owner is the senior-most leader who bears ultimate responsibility for this protection. The data owner may delegate some authority and/or responsibility to data stewards, data custodians, and end users, but they still bear ultimate responsibility.

Brooke is conducting a SWOT analysis for her organization's cybersecurity program. She recently learned about a cybersecurity insurance offering that may allow the organization to transfer some financial risk and is considering purchasing a policy. Where would this offering fit in the SWOT analysis?

• A. Strength
• B. Weakness
• C. Opportunity
• D. Threat

Answer explanation

The availability of this cybersecurity insurance offering is an external factor that the organization might exploit to better achieve its objectives and, therefore, should be classified as an opportunity. Strengths and weaknesses are internal characteristics of the organization. Threats are external factors that pose a risk to the organization.

Tina is tuning her organization's intrusion prevention system to prevent false positive alerts. What type of control is Tina implementing?

• A. Technical control
• B. Physical control
• C. Managerial control
• D. Operational control

Answer explanation

Technical controls enforce confidentiality, integrity, and availability in the digital space. Examples of technical security controls include firewall rules, access control lists, intrusion prevention systems, and encryption.

Dan is the CISO of an organization and he is spearheading the development of a new security operations center (SOC). He bears responsibility for the success of this initiative. In the RACI matrix entry for this initiative, how would Dan best be labeled?

• A. R
• B. A
• C. C
• D. I

Answer explanation

As the ultimate stakeholder for the initiative, Dan is the accountable individual and should be labeled with an “A” in the RACI matrix. Others who are directly contributing to the effort would be labeled as responsible (“R”). Stakeholders who are not directly working on the SOC implementation would be labeled as either consulted (“C”) or informed (“I”), as appropriate.

Tony is reviewing the status of his organization's defenses against a breach of their file server. He believes that a compromise of the file server could reveal information that would prevent the company from continuing to do business. What term best describes the risk that Tony is considering?

• A. Strategic
• B. Reputational
• C. Financial
• D. Operational

Answer explanation

The risk that Tony is contemplating could fit any one of these categories. However, his primary concern is that the company may no longer be able to do business if the risk materializes. This is a strategic risk.