The executive board has requested that the CISO of an organization define and Key Performance Indicators (KPI) to measure the effectiveness of the security awareness program provided to call center employees. Which of the following can be used as a KPI?

• A.Number of callers who report a lack of customer service from the call center
• B.Number of callers who abandon the call before speaking with a representative
• C.Number of successful social engineering attempts on the call center
• D.Number of callers who report security issues.

Comment: *

Name: *

Email: *

Verification: *

Dataflow diagrams are used by IT auditors to:

• A.Order data hierarchically.
• B.Portray step-by-step details of data generation.
• C.Highlight high-level data definitions.
• D.Graphically summarize data paths and storage processes.

Comment: *

Name: *

Email: *

Verification: *

Scenario: A Chief Information Security Officer (CISO) recently had a third party conduct an audit of the security program. Internal policies and international standards were used as audit baselines. The audit report was presented to the CISO and a variety of high, medium and low rated gaps were identified.
Which of the following is the FIRST action the CISO will perform after receiving the audit report?

• A.Determine if security policies and procedures are adequate
• B.Create remediation plans to address program gaps
• C.Validate gaps and accepts or dispute the audit findings
• D.Inform peer executives of the audit results

Comment: *

Name: *

Email: *

Verification: *

Which of the following tests is an IS auditor performing when a sample of programs is selected to determine if the source and object versions are the same?

• A.A compliance test of the program compiler controls
• B.A compliance test of program library controls
• C.A substantive test of program library controls
• D.A substantive test of the program compiler controls

Comment: *

Name: *

Email: *

Verification: *

Scenario: Your organization employs single sign-on (user name and password only) as a convenience to your employees to access organizational systems and data. Permission to individual systems and databases is vetted and approved through supervisors and data owners to ensure that only approved personnel can use particular applications or retrieve information. All employees have access to their own human resource information, including the ability to change their bank routing and account information and other personal details through the Employee Self-Service application. All employees have access to the organizational VPN.
The organization wants a more permanent solution to the threat to user credential compromise through phishing. What technical solution would BEST address this issue?

• A.Professional user education on phishing conducted by a reputable vendor
• B.Multi-factor authentication employing hard tokens
• C.Decreasing the number of employees with administrator privileges
• D.Forcing password changes every 90 days

Comment: *

Name: *

Email: *

Verification: *