QUESTION: 13

Which of the following examples is NOT a principle of COBIT 2019?

Meeting stakeholder needs
Enabling a holistic approach
Implementing agile development practices

Answer(s): C

Explanation:

COBIT 2019, a framework for the governance and management of enterprise IT, is built on several core principles. Implementing agile development practices is not one of these principles.

Detailed
COBIT 2019 Principles:

Meeting Stakeholder Needs: Ensuring that all stakeholder needs are considered and met through governance and management processes.

Enabling a Holistic Approach: Integrating governance and management activities to ensure a comprehensive approach to IT management.

Governance System: Tailored to the enterprise's needs, considering all enablers.

Separating Governance from Management: Clarifying roles, responsibilities, and activities related to governance and management.

Agile Development Practices:

Definition: A set of principles for software development under which requirements and solutions evolve through the collaborative effort of cross-functional teams.

Relevance: While agile practices are important in software development, they are not a principle of COBIT 2019.

Cybersecurity

Reference:

COBIT 2019 Framework: Outlines the principles and objectives for effective governance and management of enterprise IT.

ISACA: The organization behind COBIT, provides detailed documentation on the principles and application of COBIT 2019.

Implementing agile development practices is related to software development methodologies, whereas COBIT 2019 focuses on governance and management principles.

Reveal Solution Next Question

QUESTION: 14

According to the NIST Cyber security Framework, which of the following steps involves Identifying related systems and assets, regulatory requirements, and the overall risk approach?

Step 1: Prioritise and scope
Step 2: Orient
Step 3: Create a current profile

Answer(s): B

Explanation:

NIST Cybersecurity Framework Steps:

Step 1: Prioritize and Scope: Identify business/mission objectives and prioritize organizational efforts.

Step 2: Orient: Identify related systems, assets, regulatory requirements, and overall risk approach.

Step 3: Create a Current Profile: Develop a current profile by identifying existing cybersecurity practices.

Orient Step:

Purpose: To establish a comprehensive understanding of the organization's environment, including systems, assets, regulatory requirements, and the risk management approach.

Activities: Involves mapping out the organizational context and identifying key elements that influence cybersecurity posture.

Cybersecurity

Reference:

NIST Cybersecurity Framework: Provides a policy framework of computer security guidance for how private sector organizations in the U.S. can assess and improve their ability to prevent, detect, and respond to cyber attacks.

NIST SP 800-53: Further details on risk management and security controls relevant to the orient step.

The Orient step is crucial for setting the foundation for an effective cybersecurity strategy by understanding the full scope of the organization's environment and requirements.

Reveal Solution Next Question

QUESTION: 15

Scenario 3: EsteeMed is a cardiovascular institute located in Orlando. Florida H Is known for tis exceptional cardiovascular and thoracic services and offers a range of advanced procedures, including vascular surgery, heart valve surgery, arrhythmia and ablation, and lead extraction. With a dedicated team of over 30 cardiologists and cardiovascular surgeons, supported by more than IUU specialized nurses and technicians, EsteeMed Is driven by a noble mission to save lives Every year. it provides its services to over 50,000 patients from across the globe.

As Its reputation continued to grow. EsteeMed recognized the importance of protecting Its critical assets. It Identified these assets and implemented the necessary measures to ensure their security Employing a widely adopted approach to Information security governance. EsteeMed established an organizational structure that connects the cybersecurity team with the information security sector under the IT Department.

Soon after these changes, there was an incident where an unauthorized employee transferred highly restricted patient data to the cloud The Incident was detected by Tony, the IT specialist. As no specific guidelines were in place to address such unlikely scenarios, Tony promptly reported the incident to his colleagues and, together. they alerted the board of managers Following that, the management of EsteeMed arranged a meeting with their cloud provider to address the situation.

During the meeting, the representatives of the cloud provider assured the management of the EsteeMed that the situation will be managed effectively The cloud provider considered the existing security measures sufficient to ensure the confidentiality, Integrity, and availability of the transferred data Additionally, they proposed a premium cloud security package that could offer enhanced protection for assets of this nature. Subsequently, EsteeMed's management conducted an internal meeting following the discussion with the cloud provider.

After thorough discussions, the management determined that the associated costs of implementing further security measures outweigh the potential risks at the present lime Therefore, they decided to accept the actual risk level for the time being. The likelihood of a similar incident occurring in the future was considered low. Furthermore, the cloud provider had already implemented robust security protocols.

To ensure effective risk management. EsteeMed had documented and reported its risk management process and outcomes through appropriate mechanisms, it recognized that decisions about the creation, retention, and handling of documented information should consider various factors. These factors include aspects such as the intended use of the Information. Its sensitivity, and the external and internal context in which It operates.

Lastly. EsteeMed identified and recorded its assets in an inventory to ensure their protection. The inventory contained detailed information such as the type of assets, their size, location, owner, and backup information.

Based on the scenario above, answer the following question:

What type of organizational structure did EsteeMed adopt?

Functional model
Modern model
Traditional model

Answer(s): A

Explanation:

Functional Model:

Definition: An organizational structure where departments are defined by functions or roles, such as IT, HR, Finance, etc.

Characteristics: Each department specializes in its specific function, with a clear hierarchy and reporting structure within each function.

Application in the Scenario:

Structure: The cybersecurity team is part of the broader IT Department, indicating a function-based organization.

Benefits: Clear lines of responsibility and expertise, efficient management of specialized roles, and streamlined communication within functions.

Cybersecurity

Reference:

ISO/IEC 27032: This standard on cybersecurity often aligns with functional models by defining clear roles and responsibilities within the organization's security framework.

NIST Cybersecurity Framework: Emphasizes the importance of having structured roles and responsibilities for effective cybersecurity governance.

By adopting a functional model, EsteeMed ensures specialized focus and expertise within the IT Department, aiding in efficient management and response to cybersecurity incidents.

Reveal Solution Next Question

QUESTION: 16

Scenario 3: EsteeMed is a cardiovascular institute located in Orlando. Florida H Is known for tis exceptional cardiovascular and thoracic services and offers a range of advanced procedures, including vascular surgery, heart valve surgery, arrhythmia and ablation, and lead extraction. With a dedicated team of over 30 cardiologists and cardiovascular surgeons, supported by more than IUU specialized nurses and technicians, EsteeMed Is driven by a noble mission to save lives Every year. it provides its services to over 50,000 patients from across the globe.

As Its reputation continued to grow. EsteeMed recognized the importance of protecting Its critical assets. It Identified these assets and implemented the necessary measures to ensure their security Employing a widely adopted approach to Information security governance. EsteeMed established an organizational structure that connects the cybersecurity team with the information security sector under the IT Department.

Soon after these changes, there was an incident where an unauthorized employee transferred highly restricted patient data to the cloud The Incident was detected by Tony, the IT specialist. As no specific guidelines were in place to address such unlikely scenarios, Tony promptly reported the incident to his colleagues and, together. they alerted the board of managers Following that, the management of EsteeMed arranged a meeting with their cloud provider to address the situation.

During the meeting, the representatives of the cloud provider assured the management of the EsteeMed that the situation will be managed effectively The cloud provider considered the existing security measures sufficient to ensure the confidentiality, Integrity, and availability of the transferred data Additionally, they proposed a premium cloud security package that could offer enhanced protection for assets of this nature. Subsequently, EsteeMed's management conducted an internal meeting following the discussion with the cloud provider.

After thorough discussions, the management determined that the associated costs of implementing further security measures outweigh the potential risks at the present lime Therefore, they decided to accept the actual risk level for the time being. The likelihood of a similar incident occurring in the future was considered low. Furthermore, the cloud provider had already implemented robust security protocols.

To ensure effective risk management. EsteeMed had documented and reported its risk management process and outcomes through appropriate mechanisms, it recognized that decisions about the creation, retention, and handling of documented information should consider various factors. These factors include aspects such as the intended use of the Information. Its sensitivity, and the external and internal context in which It operates.

Lastly. EsteeMed identified and recorded its assets in an inventory to ensure their protection. The inventory contained detailed information such as the type of assets, their size, location, owner, and backup information.

Based on the scenario above, answer the following question:

What did EsteeMed's approach 10 protecting its critical assets Include after the incident occurred' Refer to scenario 3

Protecting both physical and virtual assets
Protecting physical assets owned by the organization
Ensuring the security of virtual assets in the cyberspace

Answer(s): C

Explanation:

After the incident where an unauthorized employee transferred highly restricted patient data to the cloud, EsteeMed focused on ensuring the security of virtual assets in cyberspace. The scenario indicates that the response to the incident involved discussions with the cloud provider about the security measures in place and the potential adoption of a premium cloud security package. This highlights EsteeMed's approach to protecting their critical assets by focusing on the cybersecurity measures necessary to safeguard their virtual assets stored and managed in the cloud.

Reference:

ISO/IEC 27017:2015 - Provides guidelines for information security controls applicable to the provision and use of cloud services by providing additional implementation guidance for relevant controls specified in ISO/IEC 27002.

NIST SP 800-144 - Guidelines on Security and Privacy in Public Cloud Computing which emphasize the importance of protecting virtual assets in the cloud environment.

Reveal Solution Next Question

Free Lead-Cybersecurity-Manager Exam Braindumps (page: 5)

QUESTION: 13

Explanation:

Reference:

QUESTION: 14

Explanation:

Reference:

QUESTION: 15

Explanation:

Reference:

QUESTION: 16

Explanation:

Reference:

Lead-Cybersecurity-Manager Exam Discussions & Posts