An IS auditor reviewing security incident processes realizes incidents are resolved and closed, but root causes are not investigated. Which of the following should be the MAJOR concern with this situation?

• A.vulnerabilities have not been properly addressed
• B.Security incident policies are out of date.
• C.Lessons learned have not been properly documented
• D.Abuses by employees have not been reported.

Comment: *

Name: *

Email: *

Verification: *

Which of the following would be of MOST concern for an IS auditor evaluating the design of an organization's incident management processes?

• A.Expected time to resolve incidents is not specified.
• B.Service management standards are not followed.
• C.Metrics are not reported to senior management.
• D.Prioritization criteria are not defined.

Comment: *

Name: *

Email: *

Verification: *

When assessing the overall effectiveness of an organization's disaster recovery planning process, which of the following is MOST important for the IS auditor to verify?

• A.Management reviews and updates the plan annually or as changes occur.
• B.Management documents and distributes a copy of the plan to all personnel.
• C.Management schedules an annual tabletop exercise.
• D.Management contracts with a third party for warm site services.

Comment: *

Name: *

Email: *

Verification: *

An IS auditor has found that an organization is unable to add new servers on demand in a cost-efficient manner Which of the following is the auditor s BEST recommendation?

• A.Hire temporary contract workers for the IT function.
• B.Increase the capacity of existing systems.
• C.Upgrade hardware to newer technology.
• D.Build a virtual environment

Comment: *

Name: *

Email: *

Verification: *

Which of the following is the BEST approach for determining the overall IT risk appetite of an organization when business units use different methods for managing IT risks?

• A.Establish a global IT risk scoring criteria
• B.Average the business units' IT risk levels
• C.Prioritize the organization's IT risk scenarios
• D.Identify the highest-rated IT risk level among the business units

Comment: *

Name: *

Email: *

Verification: *