Which of the following would be the BEST way for an information security manager to justify ongoing annual maintenance fees associated with an intrusion prevention system (IPS)?

A. Perform a penetration test to demonstrate the ability to protect.
B. Perform industry research annually and document the overall ranking of the IPS.
C. Establish and present appropriate metrics that track performance.
D. Provide yearly competitive pricing to illustrate the value of the IPS.

When developing an escalation process for an incident response plan, the information security manager should PRIMARILY consider the:

A. media coverage.
B. availability of technical resources.
C. incident response team.
D. affected stakeholders.

Which of the following is the PRIMARY purpose of establishing an information security governance framework?

A. To minimize security risks
B. To proactively address security objectives
C. To reduce security audit issues
D. To enhance business continuity planning

When facilitating the alignment of corporate governance and information security governance, which of the following is the MOST important role of an organization's security steering committee?

A. Obtaining support for the integration from business owners
B. Defining metrics to demonstrate alignment
C. Obtaining approval for the information security budget
D. Evaluating and reporting the degree of integration

To integrate security into system development life cycle (SDLC) processes, an organization MUST ensure that security:

A. is represented on the configuration control board.
B. performance metrics have been met.
C. roles and responsibilities have been defined.
D. is a prerequisite for completion of major phases.

For an enterprise implementing a bring your own device (BYOD) program, which of the following would provide the BEST security of corporate data residing on unsecured mobile devices?

A. Acceptable use policy
B. Device certification process
C. Containerization solution
D. Data loss prevention (DLP)

Which of the following is the BEST reason for reevaluating an information security program?

A. Ineffectiveness of the information security strategy execution
B. Misalignment between information security priorities and business objectives
C. Change in senior management
D. Noncompliance with information security policies and procedures

The department head of application development has decided to accept the risks identified in a recent assessment. No recommendations will be implemented, even though the recommendations are required by regulatory oversight. What should the information security manager do NEXT?

A. Formally document the decision.
B. Review the risk monitoring plan.
C. Perform a risk reassessment.
D. Implement the recommendations.

Which of the following has the GREATEST influence on an organization's information security strategy?

A. The organization's risk tolerance
B. The organizational structure
C. Information security awareness
D. Industry security standards

Which of the following is the MAIN benefit of performing an assessment of existing incident response processes?

A. Identification of threats and vulnerabilities
B. Prioritization of action plans
C. Validation of current capabilities
D. Benchmarking against industry peers