Which of the following controls do NOT come under technical class of control?

• A.Program management control
• B.System and Communications Protection control
• C.Identification and Authentication control
• D.Access Control
• E.Explanation:
  Program Management control comes under management class of controls, not technical. Program Management control is driven by the Federal Information Security Management Act (FISMA). It provides controls to ensure compliance with FISMA. These controls complement other controls. They don't replace them.

Comment: *

Name: *

Email: *

Verification: *

Numerous media reports indicate a recently discovered technical vulnerability is being actively exploited. Which of the following would be the BEST response to this scenario?

• A.Reassess the inherent risk of the target.
• B.Conduct a control serf-assessment.
• C.Assess the vulnerability management process.
• D.Conduct a vulnerability assessment.

Comment: *

Name: *

Email: *

Verification: *

Harry is the project manager of HDW project. He has identified a risk that could injure project team members.
He does not want to accept any risk where someone could become injured on this project so he hires a professional vendor to complete this portion of the project work. What type of risk response is Harry implementing?

• A.Transference
• B.Mitigation
• C.Acceptance
• D.Avoidance

Comment: *

Name: *

Email: *

Verification: *

Which of the following is a key component of strong internal control environment?

• A.RMIS
• B.Segregation of duties
• C.Manual control
• D.Automated tools

Comment: *

Name: *

Email: *

Verification: *

What should be considered while developing obscure risk scenarios?
Each correct answer represents a part of the solution. Choose two.

• A.Visibility
• B.Controls
• C.Assessment methods
• D.Recognition

Correct Answer: A,D

Explanation/Reference:
Explanation:
The enterprise must consider risk that has not yet occurred and should develop scenarios around unlikely, obscure or non-historical events.
Such scenarios can be developed by considering two things:
Visibility

Recognition

For the fulfillment of this task enterprise must:
Be in a position that it can observe anything going wrong

Have the capability to recognize an observed event as something wrong

Comment: *

Name: *

Email: *

Verification: *