Which of the following BEST facilitates the development of information security procedures that effectively support the information security policy?

• A.Considering the impact of systemic risk events
• B.Aligning procedures with industry best practices
• C.Classifying the information assets to be protected
• D.Conducting an external benchmarking exercise

Comment: *

Name: *

Email: *

Verification: *

Because of its importance to the business, an organization wants to quickly implement a technical solution which deviates from the company's policies. An information security manager should:

• A.conduct a risk assessment and allow or disallow based on the outcome.
• B.recommend a risk assessment and implementation only if the residual risks are accepted.
• C.recommend against implementation because it violates the company's policies.
• D.recommend revision of current policy.

Comment: *

Name: *

Email: *

Verification: *

The fundamental purpose of establishing security metrics is to:

• A.increase return on investment (ROI)
• B.provide feedback on control effectiveness
• C.adopt security best practices
• D.establish security benchmarks

Comment: *

Name: *

Email: *

Verification: *

Which of the following would be helpful to reduce the amount of time needed by an incident response team to determine appropriate actions?

• A.Validating the incident response plan against industry best practices
• B.Rehearsing incident response procedures, roles, and responsibilities
• C.Providing annual awareness training regarding incident response for team members
• D.Defining incident severity levels during a business impact analysis (BIA)

Comment: *

Name: *

Email: *

Verification: *

Which of the following would BEST enable a new information security manager to assess the current state of information security governance within the organization?

• A.Conducting a business impact analysis (BIA) to understand business priorities
• B.Analyzing the integration of information security policies and practices within business processes
• C.Performing both quantitative and qualitative risk analyses
• D.Interviewing key personnel identified within the governance framework

Comment: *

Name: *

Email: *

Verification: *