Which of the following is NOT one of the five basic outcomes of information security governance? [1]

A. Creating and promoting a culture that recognises the criticality of information and information security to the organisation.

B. Verifying that managements investment in information security is properly aligned with organisational strategies and the organisations risk environment.

C. Ensuring an increase in the share value for organisations.

D. Mandating and assuring that a comprehensive information security programme is developed and implemented.

9. The elements of a security programme include: [1]

A. Policy, programme management, risk management, personnel issues, hardware and software controls.

B. Policy, programme management, risk management, personnel issues, awareness and training and cryptography, which is the most important element.

C. Policy, programme management, risk management, awareness and training and cryptography, audit trails, identification and authentication, and personnel/user issues, the most important function.

D. Policy, programme management, risk management, awareness and training and cryptography, audit trails, identification and authentication, personnel/user issues, and security considerations in computer support and operations, the most important function.

10. Which of the following statements is false? [1]

A. Educational instruction tends to emphasise understanding of the what much more than the how of the concepts in information security.

B. An advantage of on-the-job training is that it is inexpensive and applicable to the task at hand.

C. The information security manager should develop information security policies, standards, guidelines and procedures and provide technical assistance to set up systems security.

D. An Information Security department can report to an Administrative Services department.

11. Identification of options; development of an action plan; approval of an action plan and identification of residual risk form part of:

A. risk assessment

B. risk acceptance

C. formulation of risk criteria

D. risk treatment

12. Which firewall is able to examine the application layer of network traffic and filter based on its header content rather than the traffic IP headers? [1]

A. application layer firewall

B. bastion host

C. dual-homed host

D. packet filtering firewall

13. A tool used by attackers and defenders to identify or fingerprint active computers on a network; the active ports and services on those computers; the functions and roles of machines and other useful information.

A. fingerprinting

B. footprinting

C. honey net

D. port scanner

14. Controls that remedy a circumstance or mitigate damage done during an incident are categorised as which of the following? [1]

A. preventative

D. deterrent

C. corrective

D. compensating

15. What are the two general approaches for controlling user authorisation for the use of a technology? [1]

A. profile lists and configuration tables

B. firewall rules and access filters

C. user profiles and filters

D. access control lists and capability tables