Exam 1: EC-Council Certified Incident Handler

When an organization claims it is secure because it is PCI-DSS certified, what is a good first question to ask towards assessing the effectiveness of their security program?

Which of the following has the GREATEST impact on the implementation of an information security governance model?

Which of the following functions MUST your Information Security Governance program include for formal organizational reporting?

A company wants to fill a Chief Information Security Officer position in the organization. They need to define and implement a more holistic security program. Which of the following qualifications and experience would be MOST desirable to find in a candidate?

An organization licenses and uses personal information for business operations, and a server containing that information has been compromised. What kind of law would require notifying the owner or licensee of this incident?

Which of the following is used to establish and maintain a framework to provide assurance that information security strategies are aligned with organizational objectives?

The PRIMARY objective for information security program development should be:

Who in the organization determines access to information?

When creating a vulnerability scan schedule, who is the MOST critical person to communicate with in order to ensure impact of the scan is minimized?

Which of the following is a MAJOR consideration when an organization retains sensitive customer data and uses this data to better target the organization's products and services?

Which of the following is the MOST important benefit of an effective security governance process?

According to ISO 27001, of the steps for establishing an Information Security Governance program listed below, which comes first?

Which of the following provides an audit framework?

From an information security perspective, information that no longer supports the main purpose of the business should be:

Which of the following should be determined while defining risk management strategies?

The Information Security Management program MUST protect:

An organization is looking for a framework to measure the efficiency and effectiveness of their Information Security Management System. Which of the following international standards can BEST assist this organization?

An organization has defined a set of standard security controls.  This organization has also defined the circumstances and conditions in which they must be applied. What is the NEXT logical step in applying the controls in the organization?

What is the MAIN reason for conflicts between Information Technology and Information Security programs?

The PRIMARY objective of security awareness is to: