Question 1

The PRIMARY purpose of implementing information security governance metrics is to:

Options :

A : measure alignment with best practices.

B : refine control operations.

C : assess operational and program metrics.

D : guide security towards the desired state.

Answer: D

Question 2

Which of the following has the MOST direct impact on the usability of an organization's asset classification policy?

Options :

A : The granularity of classifications in the hierarchy

B : The support of IT management for the classification scheme

C : The frequency of updates to the organization-s risk register

D : The business objectives of the organization

Answer: D

Question 3

An organization has implemented a new security control in response to a recently discovered vulnerability. Several employees have voiced concerns that the control disrupts their ability to work. Which of the following is the information security manager's BEST course of action?

Options :

A : Evaluate compensating control options.

B : Educate users about the vulnerability.

C : Accept the vulnerability.

D : Report the control risk to senior management.

Answer: A

Question 4

When scoping a risk assessment, assets need to be classified by:

Options :

A : sensitivity and criticality.

B : likelihood and impact.

C : threats and opportunities.

D : redundancy and recoverability.

Answer: A

Question 5

What should be the information security manager’s FIRST step when updating an information security program?

Options :

A : Review costs and benchmark them against industry norms.

B : Interview business unit managers and key stakeholders.

C : Identify program components that do not align with business objectives.

D : Re-evaluate the organization-s business expectations and objectives.

Answer: D