BCS Foundation Certificate in Information Security Management Principles V9.0 CISMP-V9 Exam Questions

Answer : C

The Acceptable Usage Policy (AUP) is the document most likely to contain directives on the security and utilization of an organization's information and IT equipment, including email, internet, and telephony. An AUP outlines the acceptable and unacceptable behaviors for users of the organization's IT systems and services. It typically includes rules and guidelines on the proper use of IT resources, security practices, and the consequences of non-compliance.The AUP is designed to protect both the organization and its users by mitigating risks associated with the misuse of IT resources and ensuring that the use of these resources aligns with the organization's security policies and objectives123.

Answer : C

In a security governance framework, the policy is typically at the highest level because it defines the overall direction and principles that govern the security posture of an organization. Policies are high-level statements that provide guidance to all members of an organization and form the foundation upon which standards, procedures, and guidelines are built. They are approved by the highest levels of management and are meant to be more stable over time, providing a consistent framework for security across the organization.

Answer : C

The cryptographic protocol that preceded Transport Layer Security (TLS) is Secure Sockets Layer (SSL). SSL was the standard security protocol designed to provide communications security over a computer network before TLS was introduced. TLS evolved from SSL, with the first version of TLS (1.0) being developed as SSL version 3.1.However, the name was changed to TLS to indicate that it was no longer associated with Netscape, the company that developed SSL123.

SSL was used from 1994 until it was deprecated in 2015 by the Internet Engineering Task Force (IETF) due to security vulnerabilities.Before its deprecation, TLS was already being used as a backup protocol for SSL 3.0 and quickly became the successor to SSL3. This transition highlights the continuous effort to improve cryptographic protocols to ensure secure communications over the internet.

Answer : D

Quantitative risk assessment is the process of objectively measuring risk by assigning numerical values to the probability of an event occurring and its potential impact. This method is most likely to provide objective support for a security Return on Investment (ROI) case because it allows for the calculation of potential losses in monetary terms, which can be directly compared to the cost of implementing security measures. By quantifying risks and their financial implications, organizations can make informed decisions about where to allocate resources and how to prioritize security investments to maximize ROI. This approach is particularly useful when making a business case to stakeholders who require clear, financial justification for security expenditures.

Answer : A

The main issue with qualitative risk assessments is their inherent subjectivity. Unlike quantitative assessments that use numerical data, qualitative assessments rely on the judgment and experience of the assessors to estimate risks. This can lead to inconsistencies if the criteria for ranking and categorizing risks are not clearly defined and agreed upon by all stakeholders involved in the assessment process. The subjective nature of this method can also influence the prioritization of risks, potentially affecting the decision-making process regarding which security controls to implement.

Answer : D

The term ''Break Glass'' refers to an emergency access procedure that allows users to bypass normal security controls to gain access to a system or service during a critical situation. This method is analogous to breaking the glass of a fire alarm to handle an emergency. In the context of information security management, it is a controlled process that is typically documented, monitored, and audited to ensure it is used only during genuine emergencies.It is a part of an organization's disaster recovery and business continuity planning, ensuring that critical systems can still be accessed when standard authentication methods fail or are unavailable due to various reasons such as service outages, DDoS attacks, or loss of access by the primary administrator12.

Microsoft Entra ID documentation on managing emergency access admin accounts3.

StrongDM's blog explaining the need for ''Break Glass'' accounts for privileged access1.

SSH Academy's definition of ''Break Glass'' access2.

Answer : D

The ISO/IEC 27000 series, particularly ISO/IEC 27001, provides a framework for information security management systems (ISMS) that helps organizations secure their information assets. This series covers various aspects of information security, including the protection of organizational records and data protection & privacy, which are legal compliance requirements in many jurisdictions. Intellectual Property Rights (IPR) are also considered within the scope of information security as they pertain to the protection of proprietary information and assets. Forensic recovery of data and data deduplication are technical and operational considerations but are not directly addressed as compliance legal requirements within the ISO/IEC 27000 series.