Acceptable risk is achieved when:

• A.residual risk is minimized.
• B.transferred risk is minimized.
• C.control risk is minimized.
• D.inherent risk is minimized.

Comment: *

Name: *

Email: *

Verification: *

Business applications should be selected for disaster recovery testing on the basis of:

• A.criticality to the enterprise.
• B.the results of contingency desktop checks.
• C.the number of failure points that are being tested.
• D.recovery time objectives (RTOs).

Comment: *

Name: *

Email: *

Verification: *

Which of the following is the MOST important objective of testing a security incident response plan?

• A.Ensure the thoroughness of the response plan.
• B.Verify the response assumptions are valid
• C.Confirm that systems are recovered in the proper order.
• D.Validate the business impact analysis (BIA).

Comment: *

Name: *

Email: *

Verification: *

Which of the following is the MOST likely outcome of a well-designed information security awareness course?

• A.Increased reporting of security incidents to the incident response function
• B.Decreased reporting of security incidents to the incident response function
• C.Decrease in the number of password resets
• D.Increase in the number of identified system vulnerabilities

Comment: *

Name: *

Email: *

Verification: *

Which of the following would BEST help to ensure the alignment between information security and business functions?

• A.Developing information security polices
• B.Establishing an information security governance committee
• C.Establishing a security awareness program
• D.Providing funding for information security efforts

Comment: *

Name: *

Email: *

Verification: *