Who would be in the BEST position to determine the recovery point objective (RPO) for business applications?

• A.Business continuity coordinator
• B.Chief operations officer (COO)
• C.Information security manager
• D.Internal audit

Comment: *

Name: *

Email: *

Verification: *

An information security manager wants to implement a security information and event management (SIEM) system that will aggregate log data from all systems that control perimeter access. Which of the following would BEST support the business case for this initiative to senior management?

• A.Metrics related to the number of systems to be consolidated
• B.Independent evidence of a SIEM system's ability to reduce risk
• C.Industry examples of threats detected using a SIEM system
• D.Alignment with industry best practices

Comment: *

Name: *

Email: *

Verification: *

The BEST way to ensure that an external service provider complies with organizational security policies is to:

• A.Explicitly include the service provider in the security policies.
• B.Receive acknowledgment in writing stating the provider has read all policies.
• C.Cross-reference to policies in the service level agreement
• D.Perform periodic reviews of the service provider.

Comment: *

Name: *

Email: *

Verification: *

Which of the following is the BEST way to align security and business strategies?

• A.Integrate information security governance into corporate governance.
• B.Include security risk as part of corporate risk management.
• C.Establish key performance indicators (KPIs) for business through security processes.
• D.Develop a balanced scorecard for security.

Comment: *

Name: *

Email: *

Verification: *

An organization has implemented an enhanced password policy for business applications which requires significantly more business unit resource to support clients. The BEST approach to obtain the support of business unit management would be to:

• A.present an analysis of the cost and benefit of the changes
• B.discuss the risk and impact of security incidents if not implemented
• C.present industry benchmarking results to business units
• D.elaborate on the positive impact to information security

Comment: *

Name: *

Email: *

Verification: *