The security manager of a global company has decided that a risk assessment needs to be completed across the company.

What is the primary objective of the risk assessment?

A. Identify, quantify and prioritize each of the business-critical assets residing on the corporate infrastructure

B. Identify, quantify and prioritize risks against criteria for risk acceptance

C. Identify, quantify and prioritize the scope of this risk assessment

D. Identify, quantify and prioritize which controls are going to be used to mitigate risk

What is a risk treatment strategy?

A. Mobile updates

B. Risk acceptance

C. Risk exclusion

D. Software installation

The information security manager is writing the Information Security Management System (ISMS) documentation. The controls that are to be implemented must be described in one of the phases of the Plan-Do-Check-Act (PDCA) cycle of the ISMS.

In which phase should these controls be described?

A. Plan

B. Do

C. Check

D. Act

A security manager just finished the final copy of a risk assessment. This assessment contains a list of identified risks and she has to determine how to treat these risks.

What is the best option for the treatment of risks?

A. Begin risk remediation immediately as the organization is currently at risk

B. Decide the criteria for determining if the risk can be accepted

C. Design appropriate controls to reduce the risk

D. Remediate the risk regardless of cost

When is revision of an employee's access rights mandatory?

A. After any position change

B. At hire

C. At least each year

D. At all moments stated in the information security policy