Which of the following is the BEST performance criterion for evaluating the adequacy of an
organization’s security awareness training?

Which of the following is a risk of cross-training?

Which of the following is normally a responsibility of the chief security officer (CSO)?

To support an organization’s goals, an IS department should have:

In reviewing the IS short-range (tactical) plan, an IS auditor should determine whether:

Which of the following would an IS auditor consider the MOST relevant to short-term planning for
an IS department?

Which of the following goals would you expect to find in an organization’s strategic plan?

Which of the following would an IS auditor consider to be the MOST important when evaluating an
organization’s IS strategy? That it:

An IS auditor reviewing an organization’s IT strategic plan should FIRST review:

When reviewing IS strategies, an IS auditor can BEST assess whether IS strategy supports the
organizations’ business objectives by determining if IS: