True or false?
Proper segregation of duties prohibits a system analyst from performing quality-assurance
functions. True or false?
What should Jenny do with these risk events?
Jenny is the project manager for the NBT projects. She is working with the project team and
several subject matter experts to perform the quantitative risk analysis process.
During this process she and the project team uncover several risks events that were not previously
identified. What should Jenny do with these risk events?
Information security projects should be prioritized on the basis of:
Information security projects should be prioritized on the basis of:
Which of the following is prepared by the business and serves as a starting point for producing the IT Service
Which of the following is prepared by the business and serves as a starting point for producing the
IT Service Continuity Strategy?
What should an IS auditor do if he or she observes that project-approval procedures do not exist?
What should an IS auditor do if he or she observes that project-approval procedures do not exist?
Which of the following elements of planning gap measures the gap between the total potential for the market
Which of the following elements of planning gap measures the gap between the total potential for
the market and the actual current usage by all the consumers in the market?
The process of removing the extra features to remove the risks is called what?
Beth is a project team member on the JHG Project. Beth has added extra features to the project
and this has introduced new risks to the project work. The project manager of the JHG project
elects to remove the features Beth has added. The process of removing the extra features to
remove the risks is called what?
Which of the following is the MOST important information to include in an information security standard?
Which of the following is the MOST important information to include in an information security
standard?
which of the following risk management capability maturity levels do the statement given below is true?
For which of the following risk management capability maturity levels do the statement given
below is true? “Real-time monitoring of risk events and control exceptions exists, as does
automation of policy management”
Who is ultimately accountable for the development of an IS security policy?
Who is ultimately accountable for the development of an IS security policy?