When would it be more desirable to develop a set of decentralized security policies and procedures within an enterprise environment?

When the enterprise is made up of many business units with diverse business activities, risks profiles and regulatory requirements.

When there is a need to develop a more unified incident response capability.

When the enterprise is made up of many business units with diverse business activities, risks profiles and regulatory requirements.

When there is a variety of technologies deployed in the infrastructure.

When it results in an overall lower cost of operating the security program.

What is the relationship between information protection and regulatory compliance?

That the protection of some information such as National ID information is mandated by regulation and other information such as trade secrets are protected based on business need.

That all information in an organization must be protected equally.

The information required to be protected by regulatory mandate does not have to be identified in the organizations data classification policy.

That the protection of some information such as National ID information is mandated by regulation and other information such as trade secrets are protected based on business need.

There is no relationship between the two.

If your organization operates under a model of "assumption of breach", you should:

Purchase insurance for your compliance liability

Protect all information resource assets equally

Establish active firewall monitoring protocols

Purchase insurance for your compliance liability

Focus your security efforts on high value assets

A method to transfer risk is to:

move operations to another region

Alignment with business operations

A company wants to fill a Chief Information Security Officer position in the organization. They need to define and implement a more holistic security program. Which of the following qualifications and experience would be MOST desirable to find in a candidate?

Industry certifications, technical knowledge and program management skills

Multiple certifications, strong technical capabilities and lengthy resume

Industry certifications, technical knowledge and program management skills

College degree, audit capabilities and complex project management

Multiple references, strong background check and industry certifications

An organization licenses and uses personal information for business operations, and a server containing that information has been compromised. What kind of law would require notifying the owner or licensee of this incident?

Special circumstance disclosure

An organization's firewall technology needs replaced. A specific technology has been selected that is less costly than others and lacking in some important capabilities. The security officer has voiced concerns about sensitive data breaches but the decision is made to purchase. What does this selection indicate?

A high risk tolerance environment

A low risk tolerance environment

I low vulnerability environment

A high risk tolerance environment

An organization has defined a set of standard security controls. This organization has also defined the circumstances and conditions in which they must be applied. What is the NEXT logical step in applying the controls in the organization?

Perform an asset classification

Create an architecture gap analysis

Analyze existing controls on systems

A security manager has created a risk program. Which of the following is a critical part of ensuring the program is successful?

Providing a risk program governance structure

Ensuring developers include risk control comments in code

Creating risk assessment templates based on specific threats

Allowing for the acceptance of risk for regulatory compliance requirements