A risk practitioner has become aware of production data being used in a test environment. Which of the following should be the practitioner’s PRIMARY concern?A . Security of the test environment.B . Readability of...
On a company's e-commerce web site, a good legal statement regarding data privacy should include:A . a statement regarding what the company will do with the information it collects.B . a disclaimer regarding the...
The BEST key performance indicator (KPI) to measure the effectiveness of a backup process would be the number of:A . backup recovery requests.B . resources to monitor backups.C . restoration monitoring reports.D . recurring...
Information classification is a fundamental step in determining:A . whether risk analysis objectives are met.B . who has ownership of information.C . the type of metrics that should be captured.D . the security strategy...
An IT license audit has revealed that there are several unlicensed copies of commercial applications installed on company laptops. The risk practitioner’s BEST course of action would be to:A . immediately uninstall the unlicensed...
Business units within an organization are resistant to proposed changes to the information security program. Which of the following is the BEST way to address this issue?A . Implementing additional security awareness trainingB ....
Which of the following are seldom changed in response to technological changes?A . StandardsB . ProceduresC . PoliciesD . GuidelinesView AnswerAnswer: C Explanation: Policies are high-level statements of objectives. Because of their high-level nature...
An organization performed a risk analysis and found a large number of assets with low-impact vulnerabilities. The NEXT action of the information security manager should be to:A . determine appropriate countermeasures.B . transfer the...
Which of the following would BEST prepare an information security manager for regulatory reviews?A . Assign an information security administrator as regulatory liaisonB . Perform self-assessments using regulatory guidelines and reportsC . Assess previous...
The MOST important reason that security risk assessments should be conducted frequently throughout an organization is because:A . control effectiveness may weakenB . compliance with legal and regulatory standards should be reassessedC . controls...
