A risk was identified during a risk assessment. The business process owner has chosen to accept the risk because the cost of remediation is greater than the projected cost of a worst-case scenario. What should be the information security manager's NEXT course of action?

• A.Shut down the business application.
• B.Document and schedule a date to revisit the issue.
• C.Determine a lower-cost approach to remediation.
• D.Document and escalate to senior management.

Comment: *

Name: *

Email: *

Verification: *

Detailed business continuity plans should be based PRIMARILY on:

• A.consideration of different alternatives.
• B.the solution that is least expensive.
• C.strategies that cover all applications.
• D.strategies validated by senior management.

Comment: *

Name: *

Email: *

Verification: *

Senior management wants to provide mobile devices to its sales force. Which of the following should the Information security manager do FIRST to support this objective?

• A.Assess risks introduced by the technology
• B.Research mobile device management (MDM) solutions.
• C.Develop an acceptable use policy.
• D.Conduct a vulnerability assessment on the devices.

Comment: *

Name: *

Email: *

Verification: *

Which of the following should be determined FIRST when establishing a business continuity program?

• A.Cost to rebuild information processing facilities
• B.Incremental daily cost of the unavailability of systems
• C.Location and cost of offsite recovery facilities
• D.Composition and mission of individual recovery teams

Comment: *

Name: *

Email: *

Verification: *

When an organization is implementing an information security governance program, its board of directors should be responsible for:

• A.drafting information security policies.
• B.reviewing training and awareness programs.
• C.setting the strategic direction of the program.
• D.auditing for compliance.

Comment: *

Name: *

Email: *

Verification: *