An organization's information security strategy should be based on:

• A.managing risk relative to business objectives.
• B.managing risk to a zero level and minimizing insurance premiums.
• C.avoiding occurrence of risks so that insurance is not required.
• D.transferring most risks to insurers and saving on control costs.

Comment: *

Name: *

Email: *

Verification: *

Which of the following is the MAIN objective in contracting with an external company to perform penetration testing?

• A.To mitigate technical risks
• B.To have an independent certification of network security
• C.To receive an independent view of security exposures
• D.To identify a complete list of vulnerabilities

Comment: *

Name: *

Email: *

Verification: *

Management decisions concerning information security investments will be MOST effective when they are based on:

• A.an annual loss expectancy (ALE) determined from the history of security events.
• B.the formalized acceptance of risk analysis by management.
• C.the reporting of consistent and periodic assessments of risks.
• D.a process for identifying and analyzing threats and vulnerabilities.

Comment: *

Name: *

Email: *

Verification: *

Which of the following will ensure confidentiality of content when accessing an email system over the Internet?

• A.Digital signatures
• B.Digital encryption
• C.Data masking
• D.Multi-factor authentication

Comment: *

Name: *

Email: *

Verification: *

The PRIMARY advantage of involving end users in continuity planning is that they:

• A.are more objective than information security management.
• B.can balance the technical and business risks.
• C.have a better understanding of specific business needs.
• D.can see the overall impact to the business.

Comment: *

Name: *

Email: *

Verification: *