An organization plans to contract with an outside service provider to host its corporate web site. The MOST important concern for the information security manager is to ensure that:

• A.an audit of the service provider uncovers no significant weakness.
• B.the contract includes a nondisclosure agreement (NDA) to protect the organization's intellectual property.
• C.the contract should mandate that the service provider will comply with security policies.
• D.the third-party service provider conducts regular penetration testing.

Comment: *

Name: *

Email: *

Verification: *

Which of the following is the BEST approach for improving information security management processes?

• A.Conduct periodic security audits.
• B.Perform periodic penetration testing.
• C.Define and monitor security metrics.
• D.Survey business units for feedback.

Comment: *

Name: *

Email: *

Verification: *

Which of the following would BEST prepare an information security manager for regulatory reviews?

• A.Assign an information security administrator as regulatory liaison
• B.Perform self-assessments using regulatory guidelines and reports
• C.Assess previous regulatory reports with process owners input
• D.Ensure all regulatory inquiries are sanctioned by the legal department

Comment: *

Name: *

Email: *

Verification: *

When designing security controls, it is

• A.apply controls to confidential information.
• B.evaluate the costs associated with the controls.
• C.apply a risk-based approach.
• D.focus on preventive controls.

Comment: *

Name: *

Email: *

Verification: *

When training an incident response team, the advantage of using tabletop exercises is that they:

• A.enable the team to develop effective response interactions.
• B.remove the need to involve senior managers in the response process.
• C.ensure that the team can respond to any incident
• D.provide the team with practical experience in responding to incidents.

Comment: *

Name: *

Email: *

Verification: *