NO.110 When implementing security controls, an information security manager must PRIMARILY focus on:

NO.111 In an organization, the responsibilities for IT security are clearly assigned and enforced and an IT security risk and impact analysis is consistently performed. This represents which level of ranking in the information security governance maturity model?

NO.112 During an incident, which of the following entities would MOST likely be contacted directly by an organization’s incident response team without management approval?

NO.113 Executive leadership becomes involved in decisions about information security governance.
Executive leadership views information security governance primarily as a concern of the information security management team. What should be an information security manager’s MOST important consideration when reviewing a proposed upgrade to a business unit’s production database?

NO.114 Which of the following is the MOST important criterion when deciding whether to accept residual risk?

NO.115 For risk management purposes, the value of an asset should be based on:

NO.116 Which of the following would be MOST useful in developing a series of recovery time objectives (RTOs)?

NO.117 When developing an escalation process for an incident response plan, the information security manager should PRIMARILY consider the:

NO.118 Which of the following would be the MOST effective way to present quarterly reports to the board on the status of the information security program?

NO.119 Which of the following is the BEST way to determine if an information security profile is aligned with business requirements?

NO.120 Which of the following is the MOST important step in risk ranking?

NO.121 An organization permits the storage and use of its critical and sensitive information on employee-owned smartphones. Which of the following is the BEST security control?

NO.122 Which of the following messages would be MOST effective in obtaining senior management’s commitment to information security management?

NO.123 Which of the following is the MOST important incident management consideration for an organization subscribing to a cloud service?

NO.124 An employee is found to be using an external cloud storage service to share corporate information with a third-party consultant, which is against company policy. Which of the following should be the information security manager s FIRST course of action?

NO.125 An internal audit has identified major weaknesses over IT processing. Which of the following should an information security manager use to BEST convey a sense of urgency to management?