Which of the following measurements of an enterprise’s security state is the process whereby an
organization establishes the parameters within which programs, investments, and acquisitions reach
the desired results?

You are the Network Administrator for a software company. Due to the nature of your company’s
business, you have a significant number of highly computer savvy users. However, you have still
decided to limit each user access to only those resources required for their job, rather
than give wider access to the technical users (such as tech support and software engineering
personnel). What is this an example of?

Which of the following are examples of administrative controls that involve all levels of employees
within an organization and determine which users have access to what resources and information?
Each correct answer represents a complete solution. Choose three.

Which of the following processes provides a standard set of activities, general tasks, and a
management structure to certify and accredit systems, which maintain the information assurance
and the security posture of a system or site?

Which of the following governance bodies provides management, operational and technical controls
to satisfy security requirements?

Which of the following divisions of the Trusted Computer System Evaluation Criteria (TCSEC) is
based on the Mandatory Access Control (MAC) policy?

Which of the following sites are similar to the hot site facilities, with the exception that they are
completely dedicated, self-developed recovery facilities?

Tomas is the project manager of the QWS Project and is worried that the project stakeholders will
want to change the project scope frequently. His fear is based on the many open issues in the
project and how the resolution of the issues may lead to additional project changes. On what
document are Tomas and the stakeholders working in this scenario?

Which of the following plans is documented and organized for emergency response, backup
operations, and recovery maintained by an activity as part of its security program that will ensure
the availability of critical resources and facilitates the continuity of operations in an emergency
situation?

Which of the following refers to the ability to ensure that the data is not modified or tampered
with?