After assessing and mitigating the risks of a web application, who should decide on the acceptance of residual application risks?
Answer(s): C
The business owner of the application needs to understand and accept the residual application risks.
The purpose of a corrective control is to:
Corrective controls serve to reduce or mitigate impacts, such as providing recovery capabilities. Preventive controls reduce adverse events, such as firewalls. Compromise can be detected by detective controls, such as intrusion detection systems (IDSs). Compliance could be ensured by preventive controls, such as access controls.
Which of the following is the MOST important requirement for setting up an information security infrastructure for a new system?
Answer(s): D
The information security infrastructure should be based on risk. While considering personal information devices as part of the security policy may be a consideration, it is not the most important requirement. A BIA is typically carried out to prioritize business processes as part of a business continuity plan. Initiating IT security training may not be important for the purpose of the information security infrastructure.
Previously accepted risk should be:
Answer(s): A
Acceptance of risk should be regularly reviewed to ensure that the rationale for the initial risk acceptance is still valid within the current business context. The rationale for initial risk acceptance may no longer be valid due to change(s) and. hence, risk cannot be accepted permanently. Risk is an inherent part of business and it is impractical and costly to eliminate all risk. Even risks that have been accepted should be monitored for changing conditions that could alter the original decision.
An information security manager is advised by contacts in law enforcement that there is evidence that his/ her company is being targeted by a skilled gang of hackers known to use a variety of techniques, including social engineering and network penetration. The FIRST step that the security manager should take is to:
Information about possible significant new risks from credible sources should be provided to managementalong with advice on steps that need to be taken to counter the threat. The security manager should assess the risk, but senior management should be immediately advised. It may be prudent to initiate an awareness campaign subsequent to sounding the alarm if awareness training is not current. Monitoring activities should also be increased.
Share your comments for ISACA CISM exam with other users:
i need to pass exam
great, i appreciate it.
please could you upload (isc)2 certified in cybersecurity (cc) exam questions
good questions, wrong answers
im preparing for exams
question no: 42 isnt azure vm an iaas solution? so, shouldnt the answer be "no"?
im study azure
i need this now
i took the aws saa-c03 test and scored 935/1000. it has all the exam dumps and important info.
good questions
well explained
i got the full version and it helped me pass the exam. pdf version is very good.
provide the download link, please
please upload thank.
please can you share 1z0-1055-22 dump pls
i will wait impatiently. thank youu
is it possible to clear the exam if we focus on only these 156 questions instead of 623 questions? kindly help!
really helped with preparation of my scrum exam
very informative and through explanations
prep for exam
thanks for helping us
i prepared for the eccouncil 350-401 exam. i scored 92% on the test.
aba questions to practice
great content
how do i get the remaining questions?
well formatted pdf and the test engine software is free. well worth the money i sept.
looking for 1z0-116
in question 22, shouldnt be in the data (option a) layer?
the questions are incredibly close to real exam. you people are amazing.
q15. answer is b. simple
great practice
thanks to this exam dumps, i felt confident and passed my exam with ease.
need 1z0-1105-22 exam
this is a beautiful tool. passed after a week of studying.