5.0 · 20% of the exam

Security Program Management and Oversight

Policy versus standard, ALE math, vendor audit rights, PCI scope, and the difference between a tabletop and a pentest.

• 5.1 · FoundationalWhich document should contain the sentence ‘Passwords must be at least 14 characters and must not be reused across company systems’?
• 5.2 · AppliedA laptop fleet is valued at $2,000 each. A loss exposes half the value (exposure factor 0.5). Analysts expect four such losses a year. What is the annualized loss expectancy for one laptop?
• 5.3 · AppliedYou need the contractual ability to inspect a payroll vendor’s controls after an incident, not just a promise of 99.9% uptime. Which clause is that?
• 5.4 · ScenarioA call center takes card numbers over the phone and types them into a payment page. Which system is in PCI DSS scope?
• 5.5 · ScenarioLeadership wants to walk through a ransomware decision tree — who isolates a host, who talks to counsel, who speaks to customers — without touching a production system. Which exercise is this?
• 5.6 · AppliedYou are asked to run a phishing simulation. Which outcome is the point of the exercise?