Which of the following terms generally refers to small programs designed to take advantage of a software flaw
that has been discovered?

The ‘trusted systems’ approach has been predominant in the design of:

Security should ALWAYS be an all or nothing issue.

Under the concept of “”defense in depth””, subsystems should be designed to:

Which of the following refers to the proving of mathematical theorems by a computer program?

Talking about the different approaches to security in computing, the principle of regarding the computer system
itself as largely an untrusted system emphasizes:

Default permit is only a good approach in an environment where:

Everything not explicitly permitted is forbidden has which of the following kinds of tradeoff?

A medium-sized organization, whose IT disaster recovery measures have been in place and regularly tested for
years, has just developed a formal business continuity plan (BCP). A basic BCP tabletop exercise has been
performed successfully. Which testing should an IS auditor recommend be performed NEXT to verify the
adequacy of the new BCP?

A financial services organization is developing and documenting business continuity measures. In which of the
following cases would an IS auditor MOST likely raise an issue?