Security monitoring is an important control measure to make sure that the required security level is maintained. In order to realize 24/7 availability of the service, this service is outsourced to a partner in the cloud.

What should be an important control in the contract?

A. The network communication channel is secured by using encryption.

B. The third party is certified against ISO/IEC 27001.

C. The third party is certified for adhering to privacy protection controls.

D. Your IT auditor has the right to audit the external party's service management processes.

What is a risk treatment strategy?

A. Mobile updates

B. Risk acceptance

C. Risk exclusion

D. Software installation

The information security manager is writing the Information Security Management System (ISMS) documentation. The controls that are to be implemented must be described in one of the phases of the Plan-Do-Check-Act (PDCA) cycle of the ISMS.

In which phase should these controls be described?

A. Plan

B. Do

C. Check

D. Act

A security manager just finished the final copy of a risk assessment. This assessment contains a list of identified risks and she has to determine how to treat these risks.

What is the best option for the treatment of risks?

A. Begin risk remediation immediately as the organization is currently at risk

B. Decide the criteria for determining if the risk can be accepted

C. Design appropriate controls to reduce the risk

D. Remediate the risk regardless of cost

When is revision of an employee's access rights mandatory?

A. After any position change

B. At hire

C. At least each year

D. At all moments stated in the information security policy