2022 Easily pass ISMP Exam with our Dumps & PDF Test Engine [Q14-Q30]

NO.14 What is a risk treatment strategy?

NO.15 Recovery Time Objective (RTO) and Recovery Point Objective (RPO) are key terms in business continuity management (BCM). Reducing loss of data is one of the focus areas of a BCM policy.
What requirement is in the data recovery policy to realize minimal data loss?

NO.16 Which security item is designed to take collections of data from multiple computers?

NO.17 What is the best way to start setting the information security controls?

NO.18 A security manager for a large company has the task to achieve physical protection for corporate data stores.
Through which control can physical protection be achieved?

NO.19 What needs to be decided prior to considering the treatment of risks?

NO.20 An experienced security manager is well aware of the risks related to communication over the internet. She also knows that Public Key Infrastructure (PKI) can be used to keep e-mails between employees confidential.
Which is the main risk of PKI?

NO.21 An information security officer is asked to write a retention policy for a financial system. She is aware of the fact that some data must be kept for a long time and other data must be deleted.
Where should she look for guidelines first?

NO.22 Security monitoring is an important control measure to make sure that the required security level is maintained. In order to realize 24/7 availability of the service, this service is outsourced to a partner in the cloud.
What should be an important control in the contract?

NO.23 The Board of Directors of an organization is accountable for obtaining adequate assurance.
Who should be responsible for coordinating the information security awareness campaigns?

NO.24 An employee has worked on the organizational risk assessment. The goal of the assessment is not to bring residual risks to zero, but to bring the residual risks in line with an organization’s risk appetite.
When has the risk assessment program accomplished its primary goal?

NO.25 The information security architect of a large service provider advocates an open design of the security architecture, as opposed to a secret design.
What is her main argument for this choice?