1. When a new key business application goes into production, the PRIMARY reason to update relevant business impact analysis (BIA) and business continuity/ disaster recovery plans is because:

A) this is a requirement of the security policy.
B) software licenses may expire in the future without warning.
C) the asset inventory must be maintained.
D) service level agreements may not otherwise be met.



2. To reduce the possibility of service interruptions, an entity enters into contracts with multiple Internet service providers (ISPs). Which of the following would be theMOST important item to include?

A) Service level agreements (SLAs)
B) Right to audit clause
C) Intrusion detection system (IDS) services
D) Spam filtering services



3. To mitigate a situation where one of the programmers of an application requires access to production data, the information security manager could BEST recommend to.

A) create a separate account for the programmer as a power user.
B) log all of the programmers' activity for review by supervisor.
C) have the programmer sign a letter accepting full responsibility.
D) perform regular audits of the application.



4. Before engaging outsourced providers, an information security manager should ensure that the organization's data classification requirements:

A) are compatible with the provider's own classification.
B) are communicated to the provider.
C) exceed those of the outsourcer.
D) are stated in the contract.



5. What is the GREATEST risk when there is an excessive number of firewall rules?

A) One rule may override another rule in the chain and create a loophole
B) Performance degradation of the whole network
C) The firewall may not support the increasing number of rules due to limitations
D) The firewall may show abnormal behavior and may crash or automatically shut down