Exam 2: Certified Network Defender

As the CISO, you have been tasked with the execution of the company's key management program. You MUST ensure the integrity of encryption keys at the point of generation. Which principal of encryption key control will ensure no single individual can constitute or re-constitute a key?

What two methods are used to assess risk impact?

Which of the following provides an audit framework?

Scenario: As you begin to develop the program for your organization, you assess the corporate culture and determine that there is a pervasive opinion that the security program only slows things down and limits the performance of the "real workers." What must you do first in order to shift the prevailing opinion and reshape corporate culture to understand the value of information security to the organization?

The process for identifying, collecting, and producing digital information in support of legal proceedings is called _____________________________.

What is the MAIN reason for conflicts between Information Technology and Information Security programs?

Which regulation or policy governs protection of personally identifiable user data gathered during a cyber investigation?

Printing under a Windows Computer normally requires which one of the following files types to be created?

A security manager has created a risk program. Which of the following is a critical part of ensuring the program is successful?

What is the following command trying to accomplish?

An information security department is required to remediate system vulnerabilities when they are discovered. Please select the three primary remediation methods that can be used on an affected system.

If the result of an NPV is positive, then the project should be selected. The net present value shows the present value of the project, based on the decisions taken for its selection. What is the net present value equal to?

Scenario: You are the CISO and are required to brief the C-level executive team on your information security audit for the year. During your review of the audit findings you discover that many of the controls that were put in place the previous year to correct some of the findings are not performing as needed. You have thirty days until the briefing. To formulate a remediation plan for the non-performing controls what other document do you need to review before adjusting the controls?

Which of the following represents the BEST method of ensuring security program alignment to business needs?

A missing/ineffective security control is identified. Which of the following should be the NEXT step?

Which of the following are the MOST important factors for proactively determining system vulnerabilities?

Annual Loss Expectancy is derived from the function of which two factors?

Your company has a "no right to privacy" notice on all logon screens for your information systems and users sign an Acceptable Use Policy informing them of this condition. A peer group member and friend comes to you and requests access to one of her employee's email account. What should you do?

The CIO of an organization has decided to assign the responsibility of internal IT audit to the IT team. This is consider a bad practice MAINLY because_______________.

The establishment of a formal risk management framework and system authorization program is essential. The LAST step of the system authorization process is: