Which entity provides formal authorization on access decisions?

In your companys first ever security awareness training class, Ron asked the question "Why do we have to have security awareness training anyway?" What should the trainers answer be?

Control Objectives for Information and related Technology provides all of the following except:

i. control objectives
ii. control practices
iii. goal indicators
iv. performance indicators
v. success factors
vi. maturity models

Jack is the CEO of a ticket brokerage house and has called a meeting with his executive team to discuss the rising security concerns that hes been made aware of. After probing his team for answers, Jack learns that which of the following entities are his biggest threat?

Mike is working on a risk assessment project. His boss, Pam, is very numbers-driven and analytical. What type of approach would be the smartest course of action for Mike to take?

A risk management team is in the middle of one of their quarterly review meetings and a debate ignites about why security controls exist at all. Which of the following arguments is true?

Once a year, a full evaluation is conducted to evaluate the effectiveness of existing security within a company. Controls are evaluated and a final report is created. Who handles this kind of activity?

Which of the following is an underlying activity of risk management?

Drew determines that the cost of buying anti-spyware for technician laptops exceeds the loss expectancy if spyware threats were to happen. Drew should _____ the risk.

Amy reads a document from her workstation:
1.Access the Aspen Bridge by telnet.
2.Enter into privileged mode.
3.Execute command 6 and press Enter.
4.Load the config file.
5.Hit Run.

What type of document is Amy reading?