Security Program Management and Oversight practice questions

Answer: A) ISO/IEC 27001

ISO/IEC 27001 specifies a certifiable ISMS that covers the whole security program. ISO/IEC 27002 is guidance that can't be certified against, PCI DSS covers only cardholder data, and CIS Benchmarks are system-level configuration baselines.

• ACorrect. ISO/IEC 27001 formally specifies an information security management system (ISMS). It sets requirements for implementing, monitoring, maintaining and continually improving that system. Organizations are certified against it by accredited third-party auditors.
• BIncorrect. ISO/IEC 27002 gives guidelines and best practices for putting security controls in place. It is not a management standard, so an organization can't be certified against it. Certification is done against ISO/IEC 27001, which relies on 27002 for control guidance.
• CIncorrect. PCI DSS applies to organizations that store, process or transmit cardholder data, and it focuses on protecting that data. A Qualified Security Assessor produces a Report on Compliance and an Attestation of Compliance. It does not certify a management system that covers the whole security program.
• DIncorrect. CIS Benchmarks are configuration baselines and best practices for securely configuring specific systems and products, such as Windows Server or Azure. They help harden systems but do not define a program-wide management system that can be certified.

Answer: A) A conflict of interest

• AA personal financial stake can bias selection, so it must be disclosed and managed, often by recusal.
• BA right-to-audit clause lets the customer inspect the vendor; it doesn't address the manager's stake.
• CSupply chain analysis assesses a vendor's own suppliers; it doesn't cover the evaluator's interests.
• DAn SLA sets performance targets after selection; it doesn't resolve bias in choosing.

Answer: A) A business partnership agreement (BPA)

• AA BPA defines the terms of a business partnership, including responsibilities, contributions and profit sharing.
• BAn NDA only protects confidential information shared between the parties.
• CAn SLA sets measurable service targets for a provider, not partnership terms.
• DAn SOW describes specific deliverables for a project, not an ongoing partnership.

Answer: A) A master service agreement (MSA) for the overarching terms, and a statement of work (SOW) for each specific engagement

• AAn MSA sets reusable terms (liability, IP, payment, confidentiality) once; each SOW references the MSA and specifies scope, deliverables, schedule, and cost for a particular piece of work.
• BAn NDA governs confidentiality and an AUP governs how users may use systems — neither structures a multi-project commercial relationship.
• CAn SLA defines service metrics and an MOU is a non-binding statement of intent; they don't fill the MSA/SOW roles described.
• DThose are internal continuity documents, not inter-company contract structures.

Answer: A) Mean time between failures (MTBF)

The average time a repairable component runs normally before it fails again is MTBF. MTTR measures repair time, while RTO and RPO are business recovery targets.

• AMTBF is the average time a repairable system performs its expected function without interruption before it fails again. That is the uptime figure on the datasheet.
• BMTTR is the average time needed to restore a component after a failure is detected. It measures the length of the outage, not how long the array runs.
• CRTO is the maximum time a business will accept a system being unavailable after an incident. It is a recovery target, not a measured hardware reliability figure.
• DRPO is the maximum acceptable amount of data loss during an incident, expressed in time. It has nothing to do with how long hardware runs before failing.

Answer: A) Recovery point objective (RPO)

• ARPO defines how far back in time recovery must reach — effectively how much recent data the business can afford to lose, which drives backup frequency.
• BRTO is the maximum tolerable time to restore the service, not the amount of data loss.
• CMTTR is the average time taken to fix a failed component — a reliability measure, not a data-loss target.
• DMTBF estimates how long a system runs before failing; it isn't about data loss.

Answer: A) A memorandum of agreement (MOA)

• AAn MOA documents agreed terms and responsibilities more formally than an MOU.
• BAn NDA only covers confidentiality.
• CAn SLA sets measurable service targets.
• DA risk register lists organizational risks.

Answer: A) Business continuity policy

• AA business continuity policy covers maintaining essential functions during disruptions.
• BAn AUP defines permitted use of systems.
• CA password policy sets credential requirements.
• DA classification policy defines data sensitivity levels.

Answer: A) FedRAMP

• AFedRAMP standardizes security assessment and authorization for cloud services used by US federal agencies.
• BPCI DSS governs payment-card data for merchants and processors, not federal cloud authorization.
• CGDPR is an EU personal-data privacy regulation.
• DSOC 1 is an attestation about controls relevant to financial reporting, not a federal cloud program.

Answer: A) Mean time to detect (MTTD)

MTTD measures the average time between an incident occurring and its detection. MTTR measures recovery time, MTBF measures reliability, and the false positive rate measures alert quality.

• AMTTD is the average time from when an incident or compromise occurs to when it is detected by monitoring or reported. That is exactly how long activity goes unnoticed.
• BMTTR measures how long it takes to repair or restore an affected system after a failure or incident. It reflects recovery speed, not how long activity went unnoticed.
• CMTBF is the average time between consecutive failures. It measures reliability, not how quickly the team becomes aware of an incident.
• DThe false positive rate is the percentage of alerts that turn out not to need action. It reflects alert quality and alert fatigue, not the average time before an incident is noticed.