1. Which of the following is MOST important for the IS auditor to verify when reviewing the development process of a security policy?
A) Evidence of active involvement of key stakeholders B) Output from the enterprise's risk management system C) Identification of the control framework D) Evidence of management approval
2. Which of the following should be the PRIMARY reason to establish a social media policy for all employees?
A) To publish acceptable messages to be used by employees when posting B) To raise awareness and provide guidance about social media risks C) To restrict access to social media during business hours to maintain productivity D) To prevent negative public social media postings and comments
3. An internal IS auditor discovers that a service organization did not notify its customers following a data breach. Which of the following should the auditor doFIRST?
A) Notify audit management of the finding. B) Report the finding to regulatory authorities. C) Notify the service organization's customers. D) Require the service organization to notify its customers.
4. A small organization is experiencing rapid growth and plans to create a new information security policy. Which of the following is MOST relevant to creating the policy?
A) Industry standards B) The business impact analysis C) The business objectives D) Previous audit recommendations
5. A CEO requests access to corporate documents from a mobile device that does not comply with organizational policy. The information security manager shouldFIRST:
A) evaluate the business risk B) evaluate a third-party solution C) initiate an exception approval process D) deploy additional security controls
Leave a comment