Which choice below is NOT an example of appropriate security management
practice?

A.
Reviewing access logs for unauthorized behavior

B.
Monitoring employee performance in the workplace

C.
Promoting and implementing security awareness programs

D.
Researching information on new intrusion exploits

Explanation:
Monitoring employee performance is not an example of security
management, or a job function of the Information Security Officer.
Employee performance issues are the domain of human resources
and the employee’s manager. The other three choices are appropriate
practice for the information security area.