Which of the following techniques MOST clearly indicates whether specific risk-reduction controls
should be implemented?

An organization has decided to implement additional security controls to treat the risks of a new
process. This is an example of:

Which of the following roles is PRIMARILY responsible for determining the information
classification levels for a given information asset?

The PRIMARY reason for assigning classes of sensitivity and criticality to information resources is
to provide a basis for:

An organization is already certified to an international security standard. Which mechanism would
BEST help to further align the organization with other data security regulatory requirements as per
new business needs?

When performing a qualitative risk analysis, which of the following will BEST produce reliable
results?

Which of the following is the BEST method to ensure the overall effectiveness of a risk
management program?

The MOST effective use of a risk register is to:

After obtaining commitment from senior management, which of the following should be completed
NEXT when establishing an information security program?

Which of the following are the essential ingredients of a business impact analysis (B1A)?