What oversight should the information security team have in the change management process for application security?

• A.Information security should be informed of changes to applications only
• B.Information security should be aware of all application changes and work with developers before changes are deployed in production
• C.Development team should tell the information security team about any application security flaws
• D.Information security should be aware of any significant application security changes and work with developer to test for vulnerabilities before changes are deployed in production

Comment: *

Name: *

Email: *

Verification: *

Which of the following should be determined while defining risk management strategies?

• A.Organizational objectives and risk tolerance
• B.IT architecture complexity
• C.Enterprise disaster recovery plans
• D.Risk assessment criteria

Comment: *

Name: *

Email: *

Verification: *

The remediation of a specific audit finding is deemed too expensive and will not be implemented. Which of the following is a TRUE statement?

• A.The remediation costs are irrelevant; it must be implemented regardless of cost.
• B.The asset is more expensive than the remediation
• C.The audit finding is incorrect
• D.The asset being protected is less valuable than the remediation costs

Comment: *

Name: *

Email: *

Verification: *

When analyzing and forecasting a capital expense budget what are not included?

• A.Network connectivity costs
• B.Purchase of new mobile devices to improve operations
• C.Upgrade of mainframe
• D.New datacenter to operate from

Comment: *

Name: *

Email: *

Verification: *

Scenario: An organization has made a decision to address Information Security formally and consistently by adopting established best practices and industry standards. The organization is a small retail merchant but it is expected to grow to a global customer base of many millions of customers in just a few years.
Which of the following would be the FIRST step when addressing Information Security formally and consistently in this organization?

• A.Define formal roles and responsibilities for Information Security
• B.Define formal roles and responsibilities for Internal audit functions
• C.Contract a third party to perform a security risk assessment
• D.create an executive security steering committee

Comment: *

Name: *

Email: *

Verification: *