True or false?
Network environments often add to the complexity of program-to-program communication, making
the implementation and maintenance of application systems more difficult. True or false?
What type of analysis would be most appropriate for the end of project review?
You are the project manager of the GHY Project and would like to perform a review of your project
from several different characteristics. You would like to review what worked in the project and what
needed improvement. What type of analysis would be most appropriate for the end of project
review?
Which of the following is a benefit of information security governance?
Which of the following is a benefit of information security governance?
Which one of the following is the only output for the qualitative risk analysis process?
Which one of the following is the only output for the qualitative risk analysis process?
Fill in the blanks
______________ risk analysis is not always possible because the IS auditor is attempting to
calculate risk using nonquantifiable threats and potential losses. In this event, a ______________
risk assessment is more appropriate. Fill in the blanks.
Which of the following best describes the identification, analysis, and ranking of risks?
Which of the following best describes the identification, analysis, and ranking of risks?
Investment in security technology and processes should be based on:
Investment in security technology and processes should be based on:
How often should compliance be audited by an external organization?
FISMA requires federal agencies to protect IT systems and data. How often should compliance be
audited by an external organization?
What must an IS auditor understand before performing an application audit?
What must an IS auditor understand before performing an application audit? Choose the BEST
answer.
Which one of the following is NOT an input to the perform quantitative risk analysis process?
There are five inputs to the quantitative risk analysis process. Which one of the following is NOT
an input to the perform quantitative risk analysis process?