Regulatory requirements typically force organizations to implement

• A.Discretionary controls
• B.Mandatory controls
• C.Financial controls
• D.Optional controls

Comment: *

Name: *

Email: *

Verification: *

The effectiveness of an audit is measured by?

• A.How the recommendations directly support the goals of the company
• B.How it exposes the risk tolerance of the company
• C.The number of security controls the company has in use
• D.The number of actionable items in the recommendations

Comment: *

Name: *

Email: *

Verification: *

An organization is looking for a framework to measure the efficiency and effectiveness of their Information Security Management System. Which of the following international standards can BEST assist this organization?

• A.International Organization for Standardizations - 27005 (ISO-27005)
• B.Payment Card Industry Data Security Standards (PCI-DSS)
• C.International Organization for Standardizations - 27004 (ISO-27004)
• D.Control Objectives for Information Technology (COBIT)

Comment: *

Name: *

Email: *

Verification: *

Scenario: An organization has made a decision to address Information Security formally and consistently by adopting established best practices and industry standards. The organization is a small retail merchant but it is expected to grow to a global customer base of many millions of customers in just a few years.
Which of the following would be the FIRST step when addressing Information Security formally and consistently in this organization?

• A.Define formal roles and responsibilities for Information Security
• B.Contract a third party to perform a security risk assessment
• C.Create an executive security steering committee
• D.Define formal roles and responsibilities for Internal audit functions

Comment: *

Name: *

Email: *

Verification: *

According to the National Institute of Standards and Technology (NIST) SP 800-40, which of the following considerations are MOST important when creating a vulnerability management program?

• A.Susceptibility to attack, mitigation response time, and cost
• B.Attack vectors, controls cost, and investigation staffing needs
• C.Susceptibility to attack, expected duration of attack, and mitigation availability
• D.Vulnerability exploitation, attack recovery, and mean time to repair

Comment: *

Name: *

Email: *

Verification: *