Question 1

Enterprise risk management is a valuable approach that can better align security functions with the business mission while offering opportunities to lower costs.

Accepted Answer

Enterprise risk management helps align security functions with business objectives and can identify cost-saving opportunities, making it a valuable approach.

Question 2

According to the Corporate Governance Task Force (CGTF),during which phase in the IDEAL model and framework does the organization plan the specifics of how it will reach its destination?

Accepted Answer

The Establishing phase in the IDEAL model and framework is where the organization plans the specifics of how it will reach its destination. This includes defining goals, creating a project plan, identifying team members, and allocating resources. Therefore, option B is the correct answer.

Question 3

According to the Corporate Governance Task Force (CGTF),which phase in the IDEAL model and framework lays the groundwork for a successful improvement effort?

Accepted Answer

The Initiating phase in the IDEAL model and framework is designed to lay the groundwork for a successful improvement effort by identifying the need for change and preparing the organization for it.

Question 4

Which of the following is true about planning?

Accepted Answer

Strategic plans provide guidance and direction for creating tactical plans, which in turn guide the development of operational plans. Therefore, strategic plans are used to create tactical plans.

Question 5

​A person or organization that has a vested interest in a particular aspect of the planning or operation of the organization is a stockbroker.

Accepted Answer

stakeholder

Question 6

Because it sets out general business intentions,a mission statement does not need to be concise.

Accepted Answer

A mission statement should be concise and clearly communicate the company's purpose and goals. A lengthy statement may lose its impact and be difficult to remember or communicate effectively to stakeholders.

Question 7

​The ISA 27014:2013 standard promotes five risk management processes,which should be adopted by the organization's executive ​management and its governing board.

Accepted Answer

governance

Question 8

Which of the following explicitly declares the business of the organization and its intended areas of operations?

Accepted Answer

A mission statement explicitly declares the business of the organization and its intended areas of operations. Vision statement outlines the company's future aspirations and Values statement defines the company's core beliefs and principles. There is no such thing as a "business statement."

Question 9

Internal and external stakeholders such as customers,suppliers,or employees who interact with the information in support of their organization's planning and operations  are known as ____________.

Accepted Answer

Data users are stakeholders who interact with information to support their organization's planning and operations. Data owners are responsible for the accuracy and security of the data, data custodians are responsible for the technical management of the data, and data generators are responsible for creating and inputting the data into the system.

Question 10

A clearly directed strategy flows from top to bottom rather than from bottom to top.

Accepted Answer

A clearly directed strategy involves top management setting the overall direction and goals of the organization, which then flows downwards to lower-level managers and employees for implementation. This ensures that everyone is working towards the same objectives and reduces the risk of conflicting priorities or confusion about the organization's direction.

Question 11

The primary goal of external monitoring is to maintain an informed awareness of the state of all of the organization's networks,information systems,and information security defenses.

Accepted Answer

The answer of The primary goal of external monitoring is...

Question 12

​Values statements should therefore be ambitous; after all,they are meant to express the aspirations of the organization.

Accepted Answer

Vision,vision

Question 13

The basic outcomes of InfoSec governance should include all but which of the following?

Accepted Answer

Time management is not part of information security governance outcomes. The other three choices are all outcomes that should be included in implementing InfoSec governance.

Question 14

Penetration testing is often conducted by penetration testers-consultants or outsourced contractors who might be referred to as red teams.

Accepted Answer

Penetration testing is indeed often conducted by penetration testers, who may be consultants or outsourced contractors known as red teams.

Question 15

Which of the following should be included in an InfoSec governance program?

Accepted Answer

The answer of Which of the following should be included...

Question 16

A top-down approach to information security usually begins with a systems administrator's attempt to improve the security of their systems.

Accepted Answer

A top-down approach to information security typically starts with the involvement and support of senior management, setting the strategic direction and policies for security measures across the organization.

Question 17

The National Association of Corporate Directors (NACD)recommends four essential practices for boards of directors.Which of the following is NOT one of these recommended practices?

Accepted Answer

The National Association of Corporate Directors recommends holding regular meetings with the CISO (Chief Information Security Officer) instead of the CIO (Chief Information Officer) to discuss tactical InfoSec planning. Therefore, option A is NOT one of the recommended practices. The other options (B, C, and D) are recommended practices.

Question 18

Which type of planning is the primary tool in determining the long-term direction taken by an organization?

Accepted Answer

Strategic planning is focused on determining the long-term direction of an organization by defining its mission, vision, and goals, and outlining strategies to achieve those goals. It helps an organization to stay competitive and adapt to changes in the market and industry. Tactical and operational planning are more focused on the short-term execution of specific tasks or projects within the overall framework of the strategic plan. Managerial planning is a broader term that encompasses all types of planning done by managers at different levels of the organization.

Question 19

Which type of planning is used to organize the ongoing,day-to-day performance of tasks?

Accepted Answer

Operational planning is used to organize the ongoing, day-to-day performance of tasks. Strategic planning is focused on long-term goals and overall direction, while tactical planning involves developing specific actions and strategies to achieve those goals. Organizational planning involves designing the structure and hierarchy of an organization.

Question 20

Which level of planning breaks down each applicable strategic goal into a series of incremental objectives?

Accepted Answer

Tactical planning breaks down each applicable strategic goal into a series of incremental objectives. Operational planning focuses on specific processes and procedures required to implement the strategic plan, while organizational planning involves assessing and improving the overall structure and design of the organization. Strategic planning involves determining long-term goals and objectives for the organization as a whole.

Quiz 3: Governance and Strategic Planning for Security

Enterprise risk management is a valuable approach that can better align security functions with the business mission while offering opportunities to lower costs.

According to the Corporate Governance Task Force (CGTF) ,during which phase in the IDEAL model and framework does the organization plan the specifics of how it will reach its destination?

According to the Corporate Governance Task Force (CGTF) ,which phase in the IDEAL model and framework lays the groundwork for a successful improvement effort?

Which of the following is true about planning?

A person or organization that has a vested interest in a particular aspect of the planning or operation of the organization is a stockbroker.

Because it sets out general business intentions,a mission statement does not need to be concise.

The ISA 27014:2013 standard promotes five risk management processes,which should be adopted by the organization's executive management and its governing board.

Which of the following explicitly declares the business of the organization and its intended areas of operations?

Internal and external stakeholders such as customers,suppliers,or employees who interact with the information in support of their organization's planning and operations are known as ____________.

A clearly directed strategy flows from top to bottom rather than from bottom to top.

The primary goal of external monitoring is to maintain an informed awareness of the state of all of the organization's networks,information systems,and information security defenses.

Values statements should therefore be ambitous; after all,they are meant to express the aspirations of the organization.

The basic outcomes of InfoSec governance should include all but which of the following?

Penetration testing is often conducted by penetration testers-consultants or outsourced contractors who might be referred to as red teams.

Which of the following should be included in an InfoSec governance program?

A top-down approach to information security usually begins with a systems administrator's attempt to improve the security of their systems.

The National Association of Corporate Directors (NACD) recommends four essential practices for boards of directors.Which of the following is NOT one of these recommended practices?

Which type of planning is the primary tool in determining the long-term direction taken by an organization?

Which type of planning is used to organize the ongoing,day-to-day performance of tasks?

Which level of planning breaks down each applicable strategic goal into a series of incremental objectives?

Quiz 3: Governance and Strategic Planning for Security

Enterprise risk management is a valuable approach that can better align security functions with the business mission while offering opportunities to lower costs.

According to the Corporate Governance Task Force (CGTF) ,during which phase in the IDEAL model and framework does the organization plan the specifics of how it will reach its destination?

According to the Corporate Governance Task Force (CGTF) ,which phase in the IDEAL model and framework lays the groundwork for a successful improvement effort?

Which of the following is true about planning?

​A person or organization that has a vested interest in a particular aspect of the planning or operation of the organization is a stockbroker.

Because it sets out general business intentions,a mission statement does not need to be concise.

​The ISA 27014:2013 standard promotes five risk management processes,which should be adopted by the organization's executive ​management and its governing board.

Which of the following explicitly declares the business of the organization and its intended areas of operations?

Internal and external stakeholders such as customers,suppliers,or employees who interact with the information in support of their organization's planning and operations are known as ____________.

A clearly directed strategy flows from top to bottom rather than from bottom to top.

The primary goal of external monitoring is to maintain an informed awareness of the state of all of the organization's networks,information systems,and information security defenses.

​Values statements should therefore be ambitous; after all,they are meant to express the aspirations of the organization.

The basic outcomes of InfoSec governance should include all but which of the following?

Penetration testing is often conducted by penetration testers-consultants or outsourced contractors who might be referred to as red teams.

Which of the following should be included in an InfoSec governance program?

A top-down approach to information security usually begins with a systems administrator's attempt to improve the security of their systems.

The National Association of Corporate Directors (NACD) recommends four essential practices for boards of directors.Which of the following is NOT one of these recommended practices?

Which type of planning is the primary tool in determining the long-term direction taken by an organization?

Which type of planning is used to organize the ongoing,day-to-day performance of tasks?

Which level of planning breaks down each applicable strategic goal into a series of incremental objectives?

A person or organization that has a vested interest in a particular aspect of the planning or operation of the organization is a stockbroker.

The ISA 27014:2013 standard promotes five risk management processes,which should be adopted by the organization's executive management and its governing board.

Values statements should therefore be ambitous; after all,they are meant to express the aspirations of the organization.