The PRIMARY reason for using information security metrics is to:

• A.ensure alignment with corporate requirements.
• B.adhere to legal and regulatory requirements
• C.monitor the effectiveness of controls
• D.achieve senior management commitment.

Comment: *

Name: *

Email: *

Verification: *

Which of the following techniques MOST clearly indicates whether specific risk-reduction controls should be implemented?

• A.Countermeasure cost-benefit analysis
• B.Penetration testing
• C.Frequent risk assessment programs
• D.Annual loss expectancy (ALE) calculation

Comment: *

Name: *

Email: *

Verification: *

A risk mitigation report would include recommendations for:

• A.assessment.
• B.acceptance.
• C.evaluation.
• D.quantification.

Comment: *

Name: *

Email: *

Verification: *

Of the following, retention of business records should be PRIMARILY based on:

• A.periodic vulnerability assessment.
• B.regulatory and legal requirements.
• C.device storage capacity and longevity.
• D.past litigation.

Comment: *

Name: *

Email: *

Verification: *

The MOST important element in achieving executive commitment to an information security governance program is:

• A.a defined security framework
• B.identified business drivers
• C.established security strategies
• D.a process improvement model

Comment: *

Name: *

Email: *

Verification: *