CCISO Core IT Security 5 — Questions and Answers
Question 1: Which security concept requires that systems and processes be designed so that a failure defaults to a secure state rather than an insecure one?
- Fail secure (fail closed) (Correct answer)
- Fail open
- Redundancy
- Fault tolerance
Correct answer: Fail secure (fail closed)
Fail secure means that when a system fails, access is denied by default, preventing unauthorized access during system failures.
Question 2: A CISO discovers that an employee has been exfiltrating sensitive data using steganography embedded in image files. Which security tool would be MOST effective at detecting this activity?
- Antivirus software
- Data Loss Prevention (DLP) (Correct answer)
- Intrusion Detection System (IDS)
- Web Application Firewall (WAF)
Correct answer: Data Loss Prevention (DLP)
DLP solutions monitor and control data transfers, inspecting content leaving the organization to detect unauthorized exfiltration regardless of obfuscation method.
Question 3: Under the NIST Cybersecurity Framework, which core function involves developing and implementing activities to identify a cybersecurity incident?
- Identify
- Protect
- Detect (Correct answer)
- Respond
Correct answer: Detect
The Detect function in the NIST CSF focuses on developing and implementing appropriate activities to identify the occurrence of a cybersecurity event.
Question 4: An attacker intercepts communication between two parties and secretly relays modified messages between them. Which attack type is this?
- Replay attack
- Man-in-the-middle (MITM) attack (Correct answer)
- Denial of service attack
- Spoofing attack
Correct answer: Man-in-the-middle (MITM) attack
A MITM attack positions the attacker between two communicating parties to intercept, read, and potentially modify messages in transit.
Question 5: A security team implements a honeypot on the network. What is the PRIMARY purpose of this deception technology?
- Blocking malicious traffic at the perimeter
- Detecting and studying attacker behavior (Correct answer)
- Encrypting sensitive data in transit
- Providing redundancy for critical systems
Correct answer: Detecting and studying attacker behavior
Honeypots are decoy systems designed to attract attackers, allowing security teams to study their tactics and gather threat intelligence.
Question 6: Which regulatory framework requires organizations that process payment card data to implement specific security controls and undergo regular compliance assessments?
- HIPAA
- SOX
- PCI DSS (Correct answer)
- GDPR
Correct answer: PCI DSS
PCI DSS (Payment Card Industry Data Security Standard) mandates security controls for any organization that stores, processes, or transmits cardholder data.
Question 7: A CISO is implementing a security awareness training program. Which metric best measures the program's effectiveness at reducing human risk?
- Number of training sessions completed
- Reduction in phishing simulation click rates over time (Correct answer)
- Total hours of security training delivered
- Number of security policies acknowledged
Correct answer: Reduction in phishing simulation click rates over time
Tracking phishing simulation click rates over time measures actual behavioral change, which is the ultimate goal of security awareness training.
CCISO Core IT Security 5
Which security concept requires that systems and processes be designed so that a failure defaults to a secure state rather than an insecure one?