- (Exam Topic 1)
Quantitative Risk Assessments have the following advantages over qualitative risk assessments:

1. A. They are objective and can express risk / cost in real numbers
2. B. They are subjective and can be completed more quickly
3. C. They are objective and express risk / cost in approximates
4. D. They are subjective and can express risk /cost in real numbers

Correct Answer: A

- (Exam Topic 5)
SCENARIO: A Chief Information Security Officer (CISO) recently had a third party conduct an audit of the security program. Internal policies and international standards were used as audit baselines. The audit report was presented to the CISO and a variety of high, medium and low rated gaps were identified.
The CISO has validated audit findings, determined if compensating controls exist, and started initial remediation planning. Which of the following is the MOST logical next step?

1. A. Validate the effectiveness of current controls
2. B. Create detailed remediation funding and staffing plans
3. C. Report the audit findings and remediation status to business stake holders
4. D. Review security procedures to determine if they need modified according to findings

Correct Answer: C

- (Exam Topic 5)
Which of the following is MOST useful when developing a business case for security initiatives?

1. A. Budget forecasts
2. B. Request for proposals
3. C. Cost/benefit analysis
4. D. Vendor management

Correct Answer: C

- (Exam Topic 1)
Which of the following is a benefit of information security governance?

1. A. Questioning the trust in vendor relationships.
2. B. Increasing the risk of decisions based on incomplete management information.
3. C. Direct involvement of senior management in developing control processes
4. D. Reduction of the potential for civil and legal liability

Correct Answer: D

- (Exam Topic 5)
The rate of change in technology increases the importance of:

1. A. Outsourcing the IT functions.
2. B. Understanding user requirements.
3. C. Hiring personnel with leading edge skills.
4. D. Implementing and enforcing good processes.

Correct Answer: D