Question 1

During the risk assessment phase of the project the CISO discovered that a college within the University is collecting Protected Health Information (PHI) data via an application that was developed in-house. The college collecting this data is fully aware of the regulations for Health Insurance Portability and Accountability Act (HIPAA) and is fully compliant.

What is the best approach for the CISO?

During the risk assessment phase of the project the CISO discovered that a college within the University is collecting Protected Health Information (PHI) data via an application that was developed in-house. The college collecting this data is fully aware of the regulations for Health Insurance Portability and Accountability Act (HIPAA) and is fully compliant.

What is the best approach for the CISO?

Options :

A : Document the system as high risk

B : Perform a vulnerability assessment

C : Perform a quantitative threat assessment

D : Notate the information and move on

Answer: B

Question 2

Which of the following is an attacker MOST likely to target to gain privileged access to a system?

Options :

A : Programs that write to system resources

B : Programs that write to user directories

C : Log files containing sensitive information

D : Log files containing system calls

Answer: A

Question 3

The Open Web Application Security Project's (OWASP) Software Assurance Maturity Model (SAMM) allows organizations to implement a flexible software security strategy to

measure organizational impact based on what risk management aspect?

Options :

A : Risk tolerance

B : Risk exception

C : Risk treatment

D : Risk response

Answer: D

Question 4

An organization wants to share data securely with their partners via the Internet. Which standard port is typically used to meet this requirement?

Options :

A : Setup a server on User Datagram Protocol (UDP) port 69

B : Setup a server on Transmission Control Protocol (TCP) port 21

C : Setup a server on Transmission Control Protocol (TCP) port 22

D : Setup a server on Transmission Control Protocol (TCP) port 80

Answer: C

Question 5

Which of the fallowing statements is MOST accurate regarding information assets?

Options :

A : International Organization for Standardization (ISO) 27001 compliance specifies which information assets must be included in asset inventory.

B : S3 Information assets include any information that is valuable to the organization,

C : Building an information assets register is a resource-intensive job.

D : Information assets inventory is not required for risk assessment.

Answer: B