Security monitoring is an important control measure to make sure that the required security level is maintained. In order to realize 24/7 availability of the service, this service is outsourced to a partner in the cloud.
What should be an important control in the contract?

• A.The third party is certified against ISO/IEC 27001.
• B.The network communication channel is secured by using encryption.
• C.The third party is certified for adhering to privacy protection controls.
• D.Your IT auditor has the right to audit the external party's service management processes.

Comment: *

Name: *

Email: *

Verification: *

An employee has worked on the organizational risk assessment. The goal of the assessment is not to bring residual risks to zero, but to bring the residual risks in line with an organization's risk appetite.
When has the risk assessment program accomplished its primary goal?

• A.Once the transference of the risk is complete
• B.When decision makers have been informed of uncontrolled risks and proper authority groups decide to leave the risks in place
• C.Once the controls are implemented
• D.When the risk analysis is completed

Comment: *

Name: *

Email: *

Verification: *

A security architect argues with the internal fire prevention team about the statement in the information security policy, that doors to confidential areas should be locked at all times. The emergency response team wants to access to those areas in case of fire.
What is the best solution to this dilemma?

• A.The doors should stay closed in case of fire to prevent access to confidential areas.
• B.The security architect will be informed when there is a fire.
• C.The doors will automatically open in case of fire.

Comment: *

Name: *

Email: *

Verification: *

A security manager for a large company has the task to achieve physical protection for corporate data stores.
Through which control can physical protection be achieved?

• A.Having visitors sign in and out of the corporate datacenter
• B.Using a firewall to prevent access to the network infrastructure
• C.Using access control lists to prevent logical access to organizational infrastructure
• D.Using key access controls for employees needing access

Comment: *

Name: *

Email: *

Verification: *

A risk manager is asked to perform a complete risk assessment for a company.
What is the best method to identify most of the threats to the company?

• A.Have a brainstorm with representatives of all stakeholders
• B.Interview top management
• C.Send a checklist for threat identification to all staff involved in information security

Comment: *

Name: *

Email: *

Verification: *