Which of the following is the MOST important requirement for monitoring key risk indicators (KRIs) using log analysis?

• A.Collecting logs from the entire set of IT systems
• B.Providing accurate logs in a timely manner
• C.Implementing an automated log analysis tool
• D.Obtaining logs in an easily readable format

Comment: *

Name: *

Email: *

Verification: *

When reporting risk assessment results to senior management, which of the following is MOST important to include to enable risk-based decision making?

• A.Potential losses compared to treatment cost
• B.A list of assets exposed to the highest risk
• C.Recent audit and self-assessment results
• D.Risk action plans and associated owners

Comment: *

Name: *

Email: *

Verification: *

Which of the following are true for quantitative analysis?
Each correct answer represents a complete solution. Choose three.

• A.Determines risk factors in terms of high/medium/low.
• B.Produces statistically reliable results
• C.Allows discovery of which phenomena are likely to be genuine and which are merely chance occurrences
• D.Allows data to be classified and counted

Correct Answer: B,C,D

Explanation/Reference:
Explanation:
As quantitative analysis is data driven, it:
Allows data classification and counting.

Allows statistical models to be constructed, which help in explaining what is being observed.

Generalizes findings for a larger population and direct comparisons between two different sets of data

or observations.
Produces statistically reliable results.

Allows discovery of phenomena which are likely to be genuine and merely occurs by chance.

Incorrect Answers:
A: Risk factors are expressed in terms of high/medium/low in qualitative analysis, and not in quantitative analysis.

Comment: *

Name: *

Email: *

Verification: *

The best way to test the operational effectiveness of a data backup procedure is to:

• A.inspect a selection of audit trails and backup logs
• B.conduct an audit of files stored offsite
• C.demonstrate a successful recovery from backup files
• D.interview employees to compare actual with expected procedures

Comment: *

Name: *

Email: *

Verification: *

Which of the following are the security plans adopted by the organization?
Each correct answer represents a complete solution. (Choose three.)

• A.Business continuity plan
• B.Backup plan
• C.Disaster recovery plan
• D.Project management plan

Correct Answer: A,B,C

Explanation/Reference:
Explanation:
Organizations create different security plans to address different scenarios. Many of the security plans are common to most organizations.
Most used security plans found in many organizations are:
Business continuity plan

Disaster recovery plan

Backup plan

Incident response plan

Incorrect Answers:
D: Project management plan is not a security plan, but a plan which describes the implementation of the project.

Comment: *

Name: *

Email: *

Verification: *