Which of the following is considered a project versus a managed process?

• A. continuous vulnerability assessment and vulnerability repair
• B. monitoring external and internal environment during incident response
• C. ongoing risk assessments of routine operations
• D. installation of a new firewall system

Which of the following activities is the MAIN purpose of the risk assessment process?

• A. Calculating the risks to which assets are exposed in their current setting
• B. Assigning value to each information asset
• C. Classifying and organizing information assets into meaningful groups
• D. Creating an inventory of information assets

The effectiveness of social engineering penetration testing using phishing can be used as a Key Performance Indicator (KPI) for the effectiveness of an organization's

• A. Risk Management Program.
• B. Identity and Access Management Program.
• C. Security Awareness Program.
• D. Anti-Spam controls.

At what level of governance are individual projects monitored and managed?

• A. Portfolio
• B. Milestone
• C. Enterprise
• D. Program

You currently cannot provide for 24/7 coverage of your security monitoring and incident response duties and your company is resistant to the idea of adding more full-time employees to the payroll. Which combination of solutions would help to provide the coverage needed without the addition of more dedicated staff? (choose the best answer):

• A. Contract with a managed security provider and have current staff on recall for incident response
• B. Configure your syslog to send SMS messages to current staff when target events are triggered
• C. Deploy a SEIM solution and have current staff review incidents first thing in the morning
• D. Employ an assumption of breach protocol and defend only essential information resources