Which of the following is the MOST effective inhibitor of relevant and efficient communication?

• A.A false sense of confidence at the top on the degree of actual exposure related to IT and lackof a well- understood direction for risk management from the top down
• B.The perception that the enterprise is trying to cover up known risk from stakeholders
• C.Existence of a blame culture
• D.Misalignment between real risk appetite and translation into policies

Comment: *

Name: *

Email: *

Verification: *

Which of the following is the BEST key performance indicator (KPI) to measure the effectiveness of a vulnerability management process?

• A.Percentage of vulnerabilities remediated within the agreed service level
• B.Number of vulnerabilities identified during the period
• C.Number of vulnerabilities re-opened during the period
• D.Percentage of vulnerabilities escalated to senior management

Comment: *

Name: *

Email: *

Verification: *

The PRIMARY reason for periodic penetration testing of Internet-facing applications is to:

• A.assess the proliferation of new threats.
• B.ensure policy and regulatory compliance.
• C.verify Internet firewall control settings.
• D.identify vulnerabilities in the system.

Comment: *

Name: *

Email: *

Verification: *

Which of the following approaches will BEST help to ensure the effectiveness of risk awareness training?

• A.Reviewing content with senior management
• B.Piloting courses with focus groups
• C.Using reputable third-party training programs
• D.Creating modules for targeted audiences

Comment: *

Name: *

Email: *

Verification: *

Which of the following is the MOST important reason to test new controls?

• A.To verify controls work as intended.
• B.To justify the cost of control investment.
• C.To identify exceptions that elevate risk.
• D.To ensure an accurate and up-to-date controls register.

Comment: *

Name: *

Email: *

Verification: *