Q13. A security manager just finished the final copy of a risk assessment. This assessment contains a list of identified risks and she has to determine how to treat these risks.
What is the best option for the treatment of risks?

Q14. An information security officer is asked to write a retention policy for a financial system. She is aware of the fact that some data must be kept for a long time and other data must be deleted.
Where should she look for guidelines first?

Q15. Which security item is designed to take collections of data from multiple computers?

Q16. Who should be asked to check compliance with the information security policy throughout the company?

Q17. What needs to be decided prior to considering the treatment of risks?

Q18. The information security architect of a large service provider advocates an open design of the security architecture, as opposed to a secret design.
What is her main argument for this choice?

Q19. A security manager for a large company has the task to achieve physical protection for corporate data stores.
Through which control can physical protection be achieved?

Q20. When should information security controls be considered?

Q21. An experienced security manager is well aware of the risks related to communication over the internet. She also knows that Public Key Infrastructure (PKI) can be used to keep e-mails between employees confidential.
Which is the main risk of PKI?

Q22. When is revision of an employee’s access rights mandatory?

Q23. The ambition of the security manager is to certify the organization against ISO/IEC 27001.
What is an activity in the certification program?

Q24. In a company a personalized smart card is used for both physical and logical access control.
What is the main purpose of the person’s picture on the smart card?