- (Exam Topic 1)
Which of the following is the BEST key performance indicator (KPI) to measure the effectiveness of a disaster recovery plan (DRP)?

1. A. Number of users that participated in the DRP testing
2. B. Number of issues identified during DRP testing
3. C. Percentage of applications that met the RTO during DRP testing
4. D. Percentage of issues resolved as a result of DRP testing

Correct Answer: B

- (Exam Topic 3)
A violation of segregation of duties is when the same:

1. A. user requests and tests the change prior to production.
2. B. user authorizes and monitors the change post-implementation.
3. C. programmer requests and tests the change prior to production.
4. D. programmer writes and promotes code into production.

Correct Answer: D

- (Exam Topic 3)
An organization's IT infrastructure is running end-of-life software that is not allowed without exception approval. Which of the following would provide the MOST helpful information to justify investing in updated software?

1. A. The balanced scorecard
2. B. A cost-benefit analysis
3. C. The risk management frameworkD, A roadmap of IT strategic planning

Correct Answer: B

- (Exam Topic 3)
Which of the following would BEST help to address the risk associated with malicious outsiders modifying application data?

1. A. Multi-factor authentication
2. B. Role-based access controls
3. C. Activation of control audits
4. D. Acceptable use policies

Correct Answer: A

- (Exam Topic 2)
When establishing leading indicators for the information security incident response process it is MOST important to consider the percentage of reported incidents:

1. A. that result in a full root cause analysis.
2. B. used for verification within the SLA.
3. C. that are verified as actual incidents.
4. D. resolved within the SLA.

Correct Answer: C