A security officer wants to implement a vulnerability scanning program. The officer is uncertain of the state of vulnerability resiliency within the organization's large IT infrastructure.
What would be the BEST approach to minimize scan data output while retaining a realistic view of system vulnerability?

• A.Perform the scans only during off-business hours
• B.Filter the scan output so only pertinent data is analyzed
• C.Scan a representative sample of systems
• D.Decrease the vulnerabilities within the scan tool settings

Comment: *

Name: *

Email: *

Verification: *

A newly-hired CISO needs to understand the organization's financial management standards for business units and operations. Which of the following would be the best source of this information?

• A.The internal accounting department
• B.The managers of the accounts payables and accounts receivables teams
• C.The external financial audit service
• D.The Chief Financial Officer (CFO)

Comment: *

Name: *

Email: *

Verification: *

A CISO implements smart cards for credential management, and as a result has reduced costs associated with help desk operations supporting password resets. This demonstrates which of the following principles?

• A.Regulatory compliance effectiveness
• B.Proper organizational policy enforcement
• C.Security alignment to business goals
• D.Increased security program presence

Comment: *

Name: *

Email: *

Verification: *

Which of the following reports should you as an IT auditor use to check on compliance with a Service Level Agreement (SLA) requirement for uptime?

• A.Systems logs
• B.Hardware error reports
• C.Availability reports
• D.Utilization reports

Comment: *

Name: *

Email: *

Verification: *

An auditor is reviewing the security classifications for a group of assets and finds that many of the assets are not correctly classified.
What should the auditor's NEXT step be?

• A.Correct the classifications immediately based on the auditor's knowledge of the proper classification
• B.Identify the owner of the asset and induce the owner to apply a proper classification
• C.Document the missing classifications
• D.Immediately notify the board of directors of the organization as to the finding

Comment: *

Name: *

Email: *

Verification: *