Question 1

A Chief Information Security Officer (CISO) is developing a new BIA for the organization. The CISO wants to gather requirements to determine the appropriate RTO and RPO for the organization's ERP. Which of the following should the CISO interview as MOST qualified to provide RTO/RPO metrics?

Options :

A : Data custodian

B : Data owner

C : Security analyst

D : Business unit director

E : Chief Executive Officer (CEO)

Answer: C

Question 2

During a security assessment, an organization is advised of inadequate control over network segmentation. The assessor explains that the organization's reliance on VLANs to segment traffic is insufficient to provide segmentation based on regulatory standards.

Which of the following should the organization consider implementing along with VLANs to provide a greater level of segmentation?

Options :

A : Air gaps

B : Access control lists

C : Spanning tree protocol

D : Network virtualization

E : Elastic load balancing

Answer: D

Question 3

During a routine network scan, a security administrator discovered an unidentified service running on a new embedded and unmanaged HVAC controller, which is used to monitor the company's datacenter

Port state

161/UDP open

162/UDP open

163/TCP open

The enterprise monitoring service requires SNMP and SNMPTRAP connectivity to operate. Which of the following should the security administrator implement to harden the system?

Options :

A : Patch and restart the unknown services.

B : Segment and firewall the controller-s network

C : Disable the unidentified service on the controller.

D : Implement SNMPv3 to secure communication.

E : Disable TCP/UDP PORTS 161 THROUGH 163

Answer: D

Question 4

The Chief Executive Officer (CEO) instructed the new Chief Information Security Officer (CISO) to provide a list of enhancements to the company's cybersecurity operation. As a result, the CISO has identified the need to align security operations with industry best practices. Which of the following industry references is appropriate to accomplish this?

Options :

A : OSSM

B : NIST

C : PCI

D : OWASP

Answer: B

Question 5

Ann, a member of the finance department at a large corporation, has submitted a suspicious email she received to the information security team. The team was not expecting an email from Ann, and it contains a PDF file inside a ZIP compressed archive. The information security learn is not sure which files were opened. A security team member uses an air-gapped PC to open the ZIP and PDF, and it appears to be a social engineering attempt to deliver an exploit.

Which of the following would provide greater insight on the potential impact of this attempted attack?

Options :

A : Run an antivirus scan on the finance PC.

B : Use a protocol analyzer on the air-gapped PC.

C : Perform reverse engineering on the document.

D : Analyze network logs for unusual traffic.

E : Run a baseline analyzer against the user-s computer.

Answer: B

Smartly Prepare Exam with Free Online CAS-003 Practice Test

Buying Options: