1. Which of the following is an indicator of improvement in the ability to identify security risks?

A) Increased number of reported security incidents.
B) Decreased number of staff requiring information security training.
C) Decreased number of information security risk assessments.
D) Increased number of security audit issues resolved.



2. Which of the following is the -important step in risk ranking?

A) Impact assessment
B) Mitigation cost
C) Threat assessment
D) Vulnerability analysis



3. An organization is considering moving one of its critical business applications to a cloud hosting service. The cloud provider may not provide the same level ofBEST -security for this application as the organization. Which of the following will provide the information to help maintain the security posture?

A) Risk assessment
B) Cloud security strategy
C) Vulnerability assessment
D) Risk governance framework



4. Following a significant change to the underlying code of an application, it is MOST important for the information security manager to:

A) inform senior management
B) update the risk assessment
C) validate the user acceptance testing
D) modify key risk indicators



5. Which of the following would BEST mitigate identified vulnerabilities in a timely manner?

A) Continuous vulnerability monitoring tool
B) Categorization of the vulnerabilities based on system's criticality
C) Monitoring of key risk indicators (KRIs)
D) Action plan with responsibilities and deadlines