Question 1

Which of the following provides the MOST useful information for identifying security control gaps on an application server?

Options :

A : Risk assessments

B : Penetration testing

C : Threat models

D : Internal audit reports

Answer: B

Question 2

When scoping a risk assessment, assets need to be classified by:

Options :

A : sensitivity and criticality.

B : likelihood and impact.

C : threats and opportunities.

D : redundancy and recoverability.

Answer: A

Question 3

What is the BEST approach for the information security manager to reduce the impact on a security program due to turnover within the security staff?

Options :

A : Recruit certified staff

B : Revise the information security program

C : Document security procedures

D : Ensure everyone is trained in their roles

Answer: C

Question 4

During the due diligence phase of an acquisition, the MOST important course of action for an information security manager is to:

Options :

A : review the state of security awareness

B : review information security policies

C : perform a risk assessment

D : perform a gap analysis

Answer: C

Question 5

When deciding to move to a cloud-based model, the FIRST consideration should be:

Options :

A : data classification

B : physical location of the data

C : storage in a shared environment

D : availability of the data

Answer: A