Security program development is PRIMARILY driven by which of the following?

• A.Available resources
• B.Risk appetite
• C.Regulatory requirements
• D.Business strategy

Comment: *

Name: *

Email: *

Verification: *

One way to determine control effectiveness is by determining:

• A.whether it is preventive, detective or compensatory.
• B.the capability of providing notification of failure.
• C.the test results of intended objectives.
• D.the evaluation and analysis of reliability.

Comment: *

Name: *

Email: *

Verification: *

Which of the following would be MOST helpful in gaining support for a business case for an information security initiative?

• A.Referencing control deficiencies
• B.Presenting a solution comparison matrix
• C.Demonstrating organizational alignment
• D.Emphasizing threats to the organization

Comment: *

Name: *

Email: *

Verification: *

Change management procedures to ensure that disaster recovery/business continuity plans are kept up-to- date can be BEST achieved through which of the following?

• A.Reconciliation of the annual systems inventory to the disaster recovery, business continuity plans
• B.Periodic audits of the disaster recovery/business continuity plans
• C.Comprehensive walk-through testing
• D.Inclusion as a required step in the system life cycle process

Comment: *

Name: *

Email: *

Verification: *

Which of the following is an advantage of a centralized information security organizational structure?

• A.It is easier to promote security awareness.
• B.It is easier to manage and control.
• C.It is more responsive to business unit needs.
• D.It provides a faster turnaround for security requests.

Comment: *

Name: *

Email: *

Verification: *