Mitigating technology risks to acceptable levels should be based PRIMARILY upon:

• A.information security budget.
• B.business process reengineering.
• C.business process requirements.
• D.legal and regulatory requirements.

Comment: *

Name: *

Email: *

Verification: *

Which of the following is the MOST important step when establishing guidelines for the use of social networking sites in an organization?

• A.Establish disciplinary actions for noncompliance.
• B.Perform a vulnerability assessment.
• C.Define acceptable information for posting
• D.Identify secure social networking sites.

Comment: *

Name: *

Email: *

Verification: *

Which of the following would be MOST helpful when justifying the funding required for a compensating control?

• A.Business case
• B.Risk analysis
• C.Business impact analysis
• D.Threat assessment

Comment: *

Name: *

Email: *

Verification: *

An organization wants to integrate information security into its HR management processes. Which of the following should be the FIRST step?

• A.Assess the business objectives of the processes.
• B.Benchmark the processes with best practice to identify gaps.
• C.Provide security awareness training to HR.
• D.Calculate the return on investment (ROI).

Comment: *

Name: *

Email: *

Verification: *

When an organization and its IT-hosting service provider are establishing a contract with each other, it is MOST important that the contract includes:

• A.recovery time objectives (RTOs).
• B.penalties for noncompliance with security policy
• C.details of expected security metrics
• D.each party s security responsibilities.

Comment: *

Name: *

Email: *

Verification: *