Which choice below is NOT an example of appropriate security management practice?

A.
Reviewing access logs for unauthorized behavior

B.
Monitoring employee performance in the workplace

C.
Promoting and implementing security awareness programs

D.
Researching information on new intrusion exploits

Explanation:
Monitoring employee performance is not an example of security management, or a job function of
the Information Security Officer. Employee performance issues are the domain of human resources
and the employee’s manager. The other three choices are appropriate practice for the information
security area.