The PRIMARY purpose of using risk analysis within a security program is to:

Which of the following types of information would the information security manager expect to have the
LOWEST level of security protection in a large, multinational enterprise?

Which would be one of the BEST metrics an information security manager can employ to effectively evaluate
the results of a security program?

A global financial institution has decided not to take any further action on a denial of service (DoS) risk found by
the risk assessment team. The MOST likely reason they made this decision is that:

Which of the following would help management determine the resources needed to mitigate a risk to the
organization?

Risk assessment should be built into which of the following systems development phases to ensure that risks
are addressed in a development project?

A risk management program would be expected to:

Which of the following would a security manager establish to determine the target for restoration of normal
processing?

Which of the following risks is represented in the risk appetite of an organization?

The systems administrator did not immediately notify the security officer about a malicious attack. An
information security manager could prevent this situation by: