The primary responsibility of IT security Management is concerned with:

Which of the following activities is generally considered part of the Governance Process according to the COBIT domains mentioned?

IT Security Governance ensures that security strategies are aligned with which organizational element?

Which body is typically an elected group of individuals that represents shareholders and sets policies for corporate management and oversight?

Which type of control involves a training program, policy, or procedure designed to change the behavior of people?

A strict security policy stating severe consequences for employees if violated is an example of which type of deterrent control?

Which of the following is an example of a Physical Control?

A proxy server that redirects a user to a warning page when they attempt to access a restricted site is an example of a:

Encryption and Smart Cards are examples of which broad category of security controls?

Which document type details specific steps/requirements to fulfill policy objectives and is generally more detailed than a policy?

Compliance is the adherence of a company to a certain standard or guidelines and is typically driven by regulatory requirements (law) or which internal requirement?

Which well-known regulatory framework sets security standards for organizations that process or store credit card information?

Which document type consists of a set sequence of necessary activities that performs a specific security task or function, designed to be followed as a consistent, repetitive cycle?

What is the leading international standard that details requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS)?

A cybersecurity framework, such as NIST or ISO 27000, serves primarily as a roadmap to organize which type of activities for an organization?

The NIST Cybersecurity Framework identifies five core functions. Which of the following is NOT one of the five functions?

The process of managing information security risks for an organization is known as:

Which term is defined as a known weakness of an asset that can be exploited by one or more attackers?

Which term refers to a potential circumstance or event that is measured by the extent to which an entity is threatened, typically a function of adverse impact and likelihood of occurrence?

Which risk mitigating strategy involves not performing any activity that may carry risk, such as declining to take a stake in a high-risk industry?

Which step of the Operational Security (OPSEC) process involves identifying sensitive data, intellectual property, and customer/employee information?

Which step in the NIST Cybersecurity Framework involves making a list of all equipment, software, and data the business uses?

In the RACI matrix, the letter 'A' stands for the role that has the final decision-making authority and accountability for completion, with only one person assigned this per task. What does 'A' represent?

According to the RACI matrix, which role is an adviser or subject matter expert who is consulted before a decision or action?

Incident Handling is defined as the summary of processes and predefined procedural actions to effectively and actionably manage an incident, focusing on which aspects?

Which incident handling stage involves performing a root cause analysis, process review, and formally documenting lessons learned?

Which risk mitigating strategy involves the contractual shifting of a pure risk from one party to another, such as purchasing an insurance policy?

According to the COBIT domains, which two activities fall under the Management Processes and relate to ensuring performance, compliance, and control?

A Steering Committee is described as an advisory body whose guiding principles include giving Strategic Direction and performing what other key action?