You identify a security risk that you do not have in-house skills to address. You decide to procure contract resources. This contractor will be responsible for handling and managing this security risk. Which type of risk response strategy are you demonstrating?

Your company develops an incident response plan. When the Web server undergoes a DoS attack, the incident response team follows the incident response plan and returns the Web server to normal operation. What should be the final outcome of this incident?

When calculating risks by using the quantitative method, what is the result of multiplying the asset values by the exposure factor (EF)?

As your organization's security administrator, you are reviewing the audit results to assess if your organization's security baselines are maintained. In which phase of the security management life cycle are you engaged?

Which policy defines the sensitivity of a company's data?

Your company contracts with a third-party janitorial service to clean the offices every night. Which one of these policies presents the greatest risk to the organization if it is NOT implemented?

Which concept involves contracting with a third party who will provide a location and equipment to be used in the event of an emergency?

What is defined in an acceptable use policy?

Which technique attempts to predict the likelihood a threat will occur and assigns monetary values in the event a loss occurs?

You are the security administrator for your company. You identify a security risk. You decide to continue with the current security plan. However, you develop a contingency plan for if the security risk occurs. Which type of risk response strategy are you demonstrating?

Your client is a small retailer that accepts orders via e-mail. The e-mail form submitted by a client's customer includes credit card information, and you demonstrate to the client how risky that is. As a result, the client adds secure credit card processing to their website, and no longer accepts e-mail orders. Which risk management concept does this represent?

What is meant by MTBF?

Which events should be considered as part of the business continuity plan? (Choose all that apply.)

Which process allows you to deploy, configure, and manage data centers through scripts?

Which principle stipulates that multiple modifications to a computer system should NOT be made at the same time?

Your client's HR practices include promotion from within, and transferring people between offices on a regular basis. It seems like the most common question you hear when employees talk on the phone is "What office are you working at now and what are you doing?" What practice will ensure that a user's permissions are relevant and current?

The business continuity team is interviewing users to gather information about business units and their functions. Which part of the business continuity plan includes this analysis?

Which type of analysis involves comparing the cost of implementing a safeguard to the impact of a possible threat?

Your company is establishing new employment candidate screening processes. Which of the following should be included? (Choose all that apply.)

In role-based awareness training, which of the following user groups would need to learn about implementing, managing, and monitoring controls?

The company who just hired you provides a fixed amount to new employees so that the employee can purchase the laptop of their choice. After the purchase, the employee only needs to submit the receipt. What should you implement so that the company is able to better track the laptops?

You are about to begin a forensic investigation. Which of the following is NOT part of the investigation?

What concept is being illustrated when user accounts are created by one employee and user permissions are configured by another employee?

As your organization's security officer, you are currently completing audits to ensure that your security settings meet the established baselines. In which phase of the security management life cycle are you engaged?