An architect has been engaged to write the security viewpoint of a new initiative. Which of the
following BEST describes a repeatable process that can be used for establishing the security
architecture?

Within the company, there is executive management pressure to start advertising to a new target
market. Due to the perceived schedule and budget inefficiencies of engaging a technology
business unit to commission a new micro-site, the marketing department is engaging third parties
to develop the site in order to meet time-to-market demands. From a security perspective, which of
the following options BEST balances the needs between marketing and risk management?

Several business units have requested the ability to use collaborative web-based meeting places
with third party vendors. Generally these require user registration, installation of client-based
ActiveX or Java applets, and also the ability for the user to share their desktop in read-only or
read-write mode. In order to ensure that information security is not compromised, which of the
following controls is BEST suited to this situation?

A new web application system was purchased from a vendor and configured by the internal
development team. Before the web application system was moved into production, a vulnerability
assessment was conducted. A review of the vulnerability assessment report indicated that the
testing team discovered a minor security issue with the configuration of the web application. The
security issue should be reported to:

A security consultant is hired by a company to determine if an internally developed web application
is vulnerable to attacks. The consultant spent two weeks testing the application, and determines
that no vulnerabilities are present. Based on the results of the tools and tests available, which of
the following statements BEST reflects the security status of the application?

In an effort to reduce internal email administration costs, a company is determining whether to
outsource its email to a managed service provider that provides email, spam, and malware
protection. The security manager is asked to provide input regarding any security implications of
this change.

Which of the following BEST addresses risks associated with disclosure of intellectual property?