Q46. A security manager regularly checks work areas after business hours for security violations; such as unsecured files or unattended computers with active sessions.
This activity BEST demonstrates what part of a security program?

Q47. The alerting, monitoring and life-cycle management of security related events is typically handled by the_________________.

Q48. Which of the following reports should you as an IT auditor use to check on compliance with a Service Level Agreement (SLA) requirement for uptime?

Q49. Your company has a “no right to privacy” notice on all logon screens for your information systems and users sign an Acceptable Use Policy informing them of this condition. A peer group member and friend comes to you and requests access to one of her employee’s email account. What should you do? (choose the BEST answer):

Q50. When measuring the effectiveness of an Information Security Management System which one of the following would be MOST LIKELY used as a metric framework?

Q51. Which of the following are necessary to formulate responses to external audit findings?

Q52. A recent audit has identified a few control exceptions and is recommending the implementation of technology and processes to address the finding.
Which of the following is the MOST likely reason for the organization to reject the implementation of the recommended technology and processes?

Q53. How often should the SSAE16 report of your vendors be reviewed?

Q54. Using the Transport Layer Security (TLS) protocol enables a client in a network to be:

Q55. How often should the SSAE16 report of your vendors be reviewed?

Q56. How often should the Statements of Standards for Attestation Engagements-16 (SSAE16)/International Standard on Assurance Engagements 3402 (ISAE3402) report of your vendors be reviewed?

Q57. Which of the following activities results in change requests?

Q58. The ability to hold intruders accountable in a court of law is important. Which of the following activities are needed to ensure the highest possibility for successful prosecution?

Q59. The effectiveness of social engineering penetration testing using phishing can be used as a Key Performance Indicator (KPI) for the effectiveness of an organization’s

Q60. According to the National Institute of Standards and Technology (NIST) SP 800-40, which of the following considerations are MOST important when creating a vulnerability management program?

Q61. As the Risk Manager of an organization, you are task with managing vendor risk assessments. During the assessment, you identified that the vendor is engaged with high profiled clients, and bad publicity can jeopardize your own brand.
Which is the BEST type of risk that defines this event?

Q62. What is the primary reason for performing a return on investment analysis?

Q63. When operating under severe budget constraints a CISO will have to be creative to maintain a strong security organization.
Which example below is the MOST creative way to maintain a strong security posture during these difficult times?