NO.14 As well as being permitted to access, create, modify and delete information, what right does an Information Owner NORMALLY have in regard to their information?

NO.15 Which of the following is MOST LIKELY to be described as a consequential loss?

NO.16 In terms of security culture, what needs to be carried out as an integral part of security by all members of an organisation and is an essential component to any security regime?

NO.17 In order to better improve the security culture within an organisation with a top down approach, which of the following actions at board level is the MOST effective?

NO.18 Which of the following international standards deals with the retention of records?

NO.19 When calculating the risk associated with a vulnerability being exploited, how is this risk calculated?

NO.20 Which type of facility is enabled by a contract with an alternative data processing facility which will provide HVAC, power and communications infrastructure as well computing hardware and a duplication of organisations existing “live” data?

NO.21 Which standards framework offers a set of IT Service Management best practices to assist organisations in aligning IT service delivery with business goals – including security goals?

NO.22 Geoff wants to ensure the application of consistent security settings to devices used throughout his organisation whether as part of a mobile computing or a BYOD approach.
What technology would be MOST beneficial to his organisation?

NO.23 When undertaking disaster recovery planning, which of the following would NEVER be considered a “natural” disaster?

NO.24 Which of the following acronyms covers the real-time analysis of security alerts generated by applications and network hardware?

NO.25 What advantage does the delivery of online security training material have over the distribution of printed media?

NO.26 Why might the reporting of security incidents that involve personal data differ from other types of security incident?

NO.27 Which membership based organisation produces international standards, which cover good practice for information assurance?

NO.28 Which term describes a vulnerability that is unknown and therefore has no mitigating control which is immediately and generally available?

NO.29 What is the name of the method used to illicitly target a senior person in an organisation so as to try to coerce them Into taking an unwanted action such as a misdirected high-value payment?

NO.30 When seeking third party digital forensics services, what two attributes should one seek when making a choice of service provider?

NO.31 When considering the disposal of confidential data, equipment and storage devices, what social engineering technique SHOULD always be taken into consideration?

NO.32 What form of risk assessment is MOST LIKELY to provide objective support for a security Return on Investment case?

NO.33 Which standard deals with the implementation of business continuity?

NO.34 Which of the following is often the final stage in the information management lifecycle?

NO.35 When an organisation decides to operate on the public cloud, what does it lose?