When investigating an information security incident, details of the incident should be shared:

1. A. widely to demonstrate positive intent.
2. B. only with management.
3. C. only as needed,
4. D. only with internal audit.

Correct Answer: C

Which of the following should be the PRIMARY basis for determining the value of assets?

1. A. Cost of replacing the assets
2. B. Business cost when assets are not available
3. C. Original cost of the assets minus depreciation
4. D. Total cost of ownership (TCO)

Correct Answer: B

Which of the following BEST indicates that information security governance and corporate governance are integrated?

1. A. The information security team is aware of business goals.
2. B. The board is regularly informed of information security key performance indicators (KPIs),
3. C. The information security steering committee is composed of business leaders.
4. D. A cost-benefit analysis is conducted on all information security initiatives.

Correct Answer: C

Reviewing which of the following would be MOST helpful when a new information security manager is developing an information security strategy for a non-regulated organization?

1. A. Management's business goals and objectives
2. B. Strategies of other non-regulated companies
3. C. Risk assessment results
4. D. Industry best practices and control recommendations

Correct Answer: A

A PRIMARY purpose of creating security policies is to:

1. A. define allowable security boundaries.
2. B. communicate management's security expectations.
3. C. establish the way security tasks should be executed.
4. D. implement management's security governance strategy.

Correct Answer: B