164You are the IT security manager for a video game software developme

1.6You are the security manager for a small application development company. Your company is considering the use of the cloud for software testing purposes. Which cloud service model is most likely to suit your needs?Response: 选项： A:IaaS B:PaaS C:SaaS D:LaaS

2. Which of the following is the MOST important constraint to be considered when developing an information security strategy? 选项： A: Established security policies and standards B: Information security architecture C: Compliance with an international security standard D: Legal and regulatory requirements

3.Question #409Which of the following is the MOST important constraint to be considered when developing an information security strategy? 选项： A:Established security policies and standards B:Information security architecture C:Compliance with an international security standard D:Legal and regulatory requirements

4.Which of the following are the psychological symptoms of culture shock? 选项： A:crying B:feeling like you have no control over your life C:excessive concern for health or security D:feeling helpless and dependent

5.You are the new Data Protection Officer for your company and have to determine whether the company has implemented appropriate technical and organizational measures as required by Article 32 of the GDPR. Which of the following would be the most important to consider when trying to determine this? 选项： A: How security measures might evolve in the future B: Which security measures are endorsed by a majority of experts. C: How the public perceives what constitutes adequate security measures D: Which kinds of security measures your company has employed in the past

6.Which of the following is the MOST important advantage of participating in beta testing of software products? 选项： A:It improves vendor support and training B:It enables an organization to gain familiarity with new products and their functionality. C:It increases an organization's ability to retain staff who prefer to work with new technology. D:It enhances security and confidentiality

7.A security engineer is required to integrate security into a software project that is implemented by small groups that quickly, continuously, and independently develop, test, and deploy code to the cloud. The engineer will MOST likely integrate with which software development process? 选项： A:Devops Integrated Product Team (IPT). B:Structured Waterfall Programming Development. C:Service-oriented architecture (SOA). D:Spiral Methodology.

8.A government client needs you to set up secure cryptographic key storage for some of their extremely confidential data. You decide that the AWS CloudHSM is the best service for this. However, there seem to be a few pre-requisites before this can happen, one of those being a security group that has certain ports open. Which of the following is correct in regards to those security groups 选项： A: A SECURITY GROUP THAT HAS PORT22 (FOR SSH) OR PORT3389 (FOR RDP) OPEN TO YOUR NETWORK. B: A SECURITY GROUP THAT HAS NO PORTS OPEN TO YOUR NETWORK. C: A SECURITY GROUP THAT HAS ONLY PORT3389 (FOR RDP) OPEN TO YOUR NETWORK. D: A SECURITY GROUP THAT HAS ONLY PORT22 (FOR SSH) OPEN TO YOUR NETWORK.

9. Which of the following has the GREATEST influence on an organization's information security strategy? 选项： A: Industry security standards B: The organizational structure C: The organization's risk tolerance D: Information security awareness

10.Question #:466 - (Exam Topic 15)A security engineer is required to integrate security into a software project that is implemented by smallGroups test quickly, continuously, and independently develop, test, and deploy code to the cloud. The engineerWill MOST likely integrate with which software development process’ 选项： A: Service-oriented architecture (SOA) B: Spiral Methodology C: Structured Waterfall Programming Development D: Devops Integrated Product Team (IPT)

11. When an organization hires a new information security manager, which of the following goals should this individual pursue FIRST? 选项： A: Develop a security architecture B: Establish good communication with steering committee members C: Assemble an experienced staff D: Benchmark peer organizations

12.Which of the following would most likely be considered a security subject to registration and regulation regarding trading? An investment contract.

13.Question #672An organization plans to leverage popular social network platforms to promote its products and services. Which of the following is the BEST course of action for the information security manager to support this initiative? 选项： A:Conduct vulnerability assessments on social network platforms. B:Assess the security risk associated with the use of social networks. C:Establish processes to publish content on social networks. D:Develop security controls for the use of social networks.

14.Which of the following is a characteristic of convert security testing? 选项： A: Tests and validates all security controls in the organization B: Focuses an Identifying vulnerabilities C: Induces less risk than over testing D: Tests staff knowledge and Implementation of the organization's security policy

15.Question #:308 - (Exam Topic 15)What is the BEST method to use for assessing the security impact of acquired software? 选项： A: Common vulnerability review B: Software security compliance validation C: Threat modeling D: Vendor assessment

16.1183As part of an international expansion plan, an organization has acquired a company located in another jurisdiction. Which of the following would be the BEST way to maintain an effective information security program? 选项： A:Determine new factors that could influence the information security strategy. B:Implement the current information security program in the acquired company. C:Merge the two information security programs to establish continuity. D:Ensure information security is included in any change control efforts.

17.Question #751Which of the following MUST be defined in order for an information security manager to evaluate the appropriateness of controls currently in place? 选项： A:Security policy B:Risk management framework C:Security standards D:Risk appetite

18. Which of the following is MOST important to the effectiveness of an information security program? 选项： A: Organizational culture B: Risk management C: IT governance D: Security metrics

19.Question #751Which of the following MUST be defined in order for an information security manager to evaluate the appropriateness of controls currently in place? 选项： A:Security policy B:Risk management framework C:Security standards D:Risk appetite

20.Which of the following statements are correct about the value of data security?( )选项： A:Purposeful value is the roles that data security plays in politics, economy, culture, society and so on.; B:The value as a instrument means the significance of data security as a kind of value itself to the comprehensive and free development of human.; C:Data security from the individual perspective contains values such as freedom and dignity.; D:Data security contributes to the realization of civilization, stability and harmony.

21.A security an alyst needs to implement security features across smartphones. laptops, and tablets. Which of the following would be the MOST effective across heterogeneous platforms? 选项： A:Enforcing encryption B:Deploying GPOs C:Removing administrative permissions D:Applying MDM software

22. Which of the following is the MOST effective approach to ensure IT processes are performed in compliance with the information security policies? 选项： A: Ensuring that key controls are embedded in the processes B: Providing information security policy training to the process owners C: Allocating sufficient resources D: Identifying risks in the processes and managing those risks

23.Question #357Which of the following is MOST important to the effectiveness of an information security program? 选项： A:Organizational culture B:Risk management C:IT governance D:Security metrics

24.Question #32Which of the following is the BEST way for an organization to determine the maturity level of its information security program? 选项： A:Review the results of information security awareness testing. B:Validate the effectiveness of implemented security controls. C:Benchmark the information security policy against industry standards. D:Track the trending of information security incidents.

25.Which of the following is the proper interpretation of the expression “国家安全网络中心“? ( )选项： A:International Internet Safety Center B:National Cyber Security Center C:National Internet Security Center D:National Cyber Safety Center