California 1386, Sarbanes-Oxley, and HIPAA are examples of what kinds of security policy directives?

Which of the following is not an acceptable approach to handling risk?

Which of the following is not a characteristic typically considered important when initially considering security countermeasures?

Which category best describes threat modeling?

Which of the following will risk analysis not yield?

Based on quantitative calculations, the company has determined that by implementing a better firewall, they will reduce their risk exposure by 80 percent.
What does the other 20 percent represent?

A company needs to determine its security budget for the next year. It interviews users, administrators, and managers in the information technology division, who render opinions and recommendations based upon their perceptions of security risk. This is an example of what kind of approach to risk analysis?

John’s company bought security liability insurance covering the cost of equipment only to find that the policy did not fully compensate for the damage done after thieves broke in and stole the data center equipment, because the loss in productivity had not been factored in. What kind of risk did management fail to consider?

Which of the following represents the best approach to implementing a security program?

"Shoulder surfing" is an example of what kind of security failure?