- (Exam Topic 1)
Why is it vitally important that senior management endorse a security policy?

1. A. So that they will accept ownership for security within the organization.
2. B. So that employees will follow the policy directives.
3. C. So that external bodies will recognize the organizations commitment to security.
4. D. So that they can be held legally accountable.

Correct Answer: A

- (Exam Topic 2)
The implementation of anti-malware and anti-phishing controls on centralized email servers is an example of what type of security control?

1. A. Organization control
2. B. Procedural control
3. C. Management control
4. D. Technical control

Correct Answer: D

- (Exam Topic 1)
Which of the following functions MUST your Information Security Governance program include for formal organizational reporting?

1. A. Audit and Legal
2. B. Budget and Compliance
3. C. Human Resources and Budget
4. D. Legal and Human Resources

Correct Answer: A

- (Exam Topic 3)
What oversight should the information security team have in the change management process for application security?

1. A. Information security should be informed of changes to applications only
2. B. Development team should tell the information security team about any application security flaws
3. C. Information security should be aware of any significant application security changes and work with developer to test for vulnerabilities before changes are deployed in production
4. D. Information security should be aware of all application changes and work with developers before changes are deployed in production

Correct Answer: C

- (Exam Topic 5)
Scenario: An organization has made a decision to address Information Security formally and consistently by adopting established best practices and industry standards. The organization is a small retail merchant but it is expected to grow to a global customer base of many millions of customers in just a few years.
This global retail company is expected to accept credit card payments. Which of the following is of MOST concern when defining a security program for this organization?

1. A. International encryption restrictions
2. B. Compliance to Payment Card Industry (PCI) data security standards
3. C. Compliance with local government privacy laws
4. D. Adherence to local data breach notification laws

Correct Answer: B