Deck 1 Flashcards
Which of the following should be the PRIMARY basis for a severity hierarchy for information security incident classification?
A. Legal and Regulatory requirements
B. Root cause analysis results
C. Availability of resources
D. Adverse effects on the business
D
An information security manager has become aware that a third-party provider is not in compliance with the statement of work (SOW). Which of the following is the BEST course of action?
A. Assess the extent of the issue
B. Report the issue to legal personnel
C. Notify senior management of the issue
D. Initiate contract renegotiation
A
Which of the following would be MOST useful to help senior management understand the status of information security compliance?
A. Key performance indicators (KPIs)
B. Risk assessment results
C. Industry benchmarks
D. Business impact analysis (BIA) results
A
An organization is concerned with the potential for exploitation of vulnerabilities in its server systems. Which of the following is the BEST control to mitigate the associated risk?
A. Enforcing standard System configurations based on secure configuration benchmarks
B. Implementing network and system-based anomaly monitoring software for server systems
C. Enforcing configurations for secure logging and audit trails on server systems
D. Implementing host-based intrusion detection systems (IDS) on server systems
A
An organization has identified a risk scenario that has low impact to the organization but is very costly to mitigate. Which risk treatment option is MOST appropriate in this situation?
A. Transfer
B. Acceptance
C. Mitigation
D. Avoidance
A
Which of the following should be the MAIN outcome from monitoring key performance indicators (KPIs) for a corporate security management program?
A. A balanced scorecard
B. An effective awareness program
C. Data for the organization to assess progress
D. Optimal level of value delivery
C
Which of the following defines the triggers within a business continuity plan (BCP)?
A. Disaster recovery plan (DRP)
B. Needs of the organization
C. Information security policy
D. Gap analysis
B
Which of the following should be the MOST important consideration of business continuity management?
A. Ensuring human safety
B. Securing critical information assets
C. Ensuring the reliability of backup data
D. Identifying critical business processes
A
Which of the following should be the PRIMARY driver for delaying the delivery of an information security awareness program?
A. Change in senior management
B. High employee turnover
C. Employee acceptance
D. Risk appetite
D
During the eradication process phase of an incident response, it is MOST important to:
A. Identify the root cause
B. Restore from the most recent backup
C. Notify affected users
D. Wipe the affected system
D
Which of the following is MOST important to ensuring information stored by an organization is protected appropriately?
A. Defining security asset categorization
B. Assigning information asset ownership
C. Developing a records retention schedule
D. Defining information stewardship roles
A
The GREATEST benefit resulting from well-documented information security procedures is that they
A. Facilitate security training of new staff
B. Ensure that security policies are consistently applied
C. Provide a basis for auditing security practices
D. Ensure processes can be followed by temporary staff
B
An information security team has discovered that users are sharing a login account to an application with sensitive information, in violation of the access policy. Business management indicates that the practice creates operational efficiencies. What is the information security manager’s BEST course of action?
A. Present the risk to senior management
B. Modify the policy
C. Create an exception for the deviation
D. Enforce the policy
A
Which of the following should be the PRIMARY consideration when developing an incident response plan?
A. Previously reported incidents
B. Management support
C. Compliance with regulations
D. The definition of an incident
D
Which of the following tasks should be performed once a disaster recovery plan (DRP) has been developed?
A. Identify recovery time objectives (RTOs)
B. Develop a test plan
C. Analyze the business impact
D. Define response team roles
B
An anomaly-based intrusion detection system (IDS) operates by gathering data on:
A. Normal network behavior and using it as a baseline for measuring abnormal activity
B. Abnormal network behavior and using it as a baseline for measuring normal activity
C. Abnormal network behavior and using it as a baseline for measuring normal activity
D. Attack pattern signatures from historical data
A
An organization that uses external cloud services extensively is concern with risk monitoring and timely response. The BEST way to address this concern is to ensure:
A. The availability of continuous technical support
B. Appropriate service level agreements (SLAs) are in place
C. a right-to-audit clause is included in contracts
D. Internal security standards are in place
C
The security baselines of an organization should be based on:
A. procedures
B. standards
C. policies
D. guidelines
B
An employee clicked on a link in a phishing email, triggering a ransomeware attack. Which of the following should be the information security manager’s FIRST step?
A. Notify internal legal
B. Isolate the impacted endpoints
C. Wipe the affected system
D. Notify senior management
B
which of the following is most important for an information security manager to communicate to stakeholders when approving exceptions to the information security policy?
A. impact of the risk profile
B. Need for compensating controls
C. Time period for a review
D. Requirements for senior management reporting
A
The main purpose of documenting information security guidelines for use within a large, international organization is to:
A. explain the organization’s preferred practices for security
B. ensure that all business units have the same strategic security goals
C. Ensure that all business units implement identical security postures
D. provide evidence for authors that security practices are adequate
A
A penetration test of a new system has identified a number of critical vulnerabilities, jeopardizing the go live date. Stop it the information security manager is asked by the system owner to approve an exception to allow the system to be implemented without fixing the vulnerabilities. Which of the following is the most appropriate course of action?
A. Implement a long monitoring process
B. perform a risk assessment
C. develop a set of compensating controls
D. approve and document the exception
B
Which of the following is the most important consideration when developing information security objectives?
A. They are regularly reassessed and reported to stakeholders
B. They are approved by the IT governance function
C. They are clear and can be understood by stakeholders
D. they are identified using global security frameworks and standards
C
Which of the following is most important to the successful implementation of an information security program?
A. Establishing key performance indicators (KPI’s)
B. Obtaining stakeholder input
C. understanding current and emerging technologies
D. conducting periodic risk assessments
B
An organization is in the process of adopting a hybrid data infrastructure, transferring all non core communications to cloud service providers, and maintaining all core business functions in-house. The information security manager has determined a defense in-depth strategy should be used. Which of the following best describes this strategy?
A. Separate security controls for applications, platforms, programs, and endpoints
B. multifactor login requirement for cloud service applications, timeouts, and complex passwords
C. deployment of nested firewalls within the infrastructure
D. strict enforcement of rule based access control (RBAC)
B
Which of the following has the greatest impact on the viability of an information security road map?
A. Regulatory requirements
B. management support
C. Threat landscape
D. resource availability
C
Regular vulnerability scanning on an organization’s internal network has identified that many user workstations have unpatched versions of software. What is the best way for the information security manager to help senior management understand the related risk?
A. Include the impact of the risk as part of regular metrics
B. send regular notifications directly to senior managers
C. recommend the security steering committee conduct a review
D. update the risk assessment at regular intervals
A
An organization that has outsourced its incident management capabilities just discovered a significant privacy breach by an unknown attacker. Which of the following is the most important action of the information security manager?
A. Follow the outsourcers response plan
B. refer to the organizations response plan
C. notify the outsourcer of the privacy breach
D. alert the appropriate law enforcement
C
Which of the following provides the best guidance when establishing a security program?
A. Risk assessment methodology
B. security audit report
C. information security budget
D. information security framework
B
During the response to a serious security breach, who is the best organizational staff member to communicate with external entities?
A. The resource designated by senior management
B. the incident response team leader
C. the resource specified in the incident response plan
D. a dedicated public relations spokesperson
A
Which of the following is most important to include in a report of an organization’s information security risk?
A. Control risk
B. mitigated risk
C. residual risk
D. inherent risk
C
When developing an incident escalation process, the best approach is to classify incidents based on:
A. their root causes
B. information assets affected
C. recovery point objective (RPOs)
D. estimated time to recover
B
Which of the following is a desired outcome of information security governance?
A. Penetration test
B. a maturity model
C. improved risk management
D. business agility right
B
An incident response team has been assembled from a group of experienced individuals. Which type of exercise would be most beneficial for the team at the first drill?
A. Tabletop exercise
B. red team exercise
C. disaster recovery exercise
D. black box penetration test
A
Which of the following is most helpful for aligning security operations with the IT governance framework?
A. Business impact analysis (BIA)
B. security operations program
C. information security policy
D. security risk assessment
C
Which of the following should be the primary outcome of an information security program?
A. Threat reduction
B. strategic alignment
C. risk elimination
D. cost reduction
B
An organization has just updated its backup capability to a new cloud based solution which of the following tests will most effectively verify this change is working as intended?
A. Simulation testing
B. tabletop testing
C. parallel testing
D. black box testing
C
An organization involved in e-commerce activities operating from its home country opened a new office in another country with stringent security laws. In this scenario, the overall security strategy should be based on:
A. risk assessment results
B. International Security standards
C. the most stringent requirements
D. the security organization structure
A
Which of the following is the best way to achieve compliance with new global regulations related to the protection of personal information?
A. Review contracts and statements of work (SOWs) with vendors
B. determine current and desired state of controls
C. execute a risk treatment plan
D. implement data regionalization controls
D
Which is the best method to evaluate the effectiveness of an alternate processing site when continuous uptime is required?
A. Full interruption test
B. Tabletop test
C. parallel test
D. simulation test
C
Which of the following is the most effective approach for determining whether an organization’s information security program supports the information security strategy?
A. Ensure resources meet information security program needs
B. Audit the information security program to identify deficiencies
C. identify gaps impacting information security strategy
D. develop key performance indicators (KPIs) of information security
D
Which of the following is the most effective way to prevent information security incidents?
A. Deploying intrusion detection tools in the network environment
B. deploying a consistent incident response approach
C. implementing a security information and event management (SIEM) tool
D. implementing a security awareness training program for employees
D
Which of the following should an information security manager do next after creating a road map to execute the strategy for an information security program?
A. Develop a project plan to implement the strategy
B. obtain consensus on this strategy from the executive board
C. define organizational risk tolerance
D. review alignment with business goals
A
An information security manager is recommending an investment in a new security initiative to address recently published threats. Which of the following is most important to include in the business case?
A. Alignment with the approved IT strategy
B. potential impact of threat realization
C. availability of resources to implement the initiative
D. peer group threat Intelligence Report
B
Which of the following is the first step in developing a business continuity plan (BCP)?
A. Identify critical business processes
B. determine the business recovery strategy
C. determine available resources
D. identify the applications with the shortest recovery time objectives (RTOs)
A
Which of the following incident response phases involves actions to help safeguard critical systems while maintaining business operations?
A. Containment
B. Identification
C. Preparation
D. Recovery
A
Which of the following has the most direct impact on the usability of an organization’s asset classification policy?
A. The granularity of classifications in the hierarchy
B. the support of IT management for the classification scheme
C. the frequency of updates to the organizations risk register
D. the business objectives of the organization
D
A penetration test was conducted by an accredited third party. Which of the following should be the information security managers first course of action?
A. Request funding needed to resolve the top vulnerabilities
B. ensure a risk assessment is performed to evaluate the findings
C. report findings to senior management
D. ensure vulnerabilities found are resolved within acceptable timeframes
B
When performing a business impact analysis, who should calculate the recovery time and cost estimates?
A. Business process owner
B. business continuity coordinator
C. information security manager
D. senior management
A
An information security manager is reporting on open items from the risk register to senior management. Which of the following is most important to communicate with regard to these risks?
A. Key risk indicators (KRIs)
B. responsible entities
C. compensating controls
D. potential business impact
D
The best way to identify the risk associated with a social engineering attack is to:
A. monitor the intrusion detection system (IDS)
B. reviews single sign-on (SSO) authentication logs
C. perform a business risk assessment of the e-mail filtering system
D. test user knowledge of information security practices
D
A desktop computer is being used to perpetrate a fraud, and data on the machine must be secured for evidence. Which of the following should be done first?
A. Encrypt the content of the hard drive using a strong algorithm
B. obtain a hash of the desktop computers internal hard drive
C. copy the data on the computer to an external hard drive
D. capture a forensic image of the computer
B
Who is accountable for ensuring proper controls are in place to address the confidentiality and availability of an information system?
A. Information owner
B. business manager
C. senior management
D. information security manager
A
An organization has fallen victim to a spearfishing attack that compromise the multifactor authentication code. What is the information security managers most important follow up action?
A. Communicate the threat to users
B. Install client anti malware solutions
C. implement firewall blocking of known attack signatures
D. implement an advanced e-mail filtering system
A
Which of the following is the most effective approach to ensure IT processes are performed in compliance with the information security policies?
A. Ensuring that key controls are embedded in the processes
B. providing information security policy training to the process owners
C. allocating sufficient resources
D. identifying risks in the processes and managing those risks
A
Which of the following should be the primary consideration when implementing a data loss prevention solution?
A. Data ownership
B. data storage capabilities
C. data classification
D. selection of tools
C
An organization is leveraging tablet to replace desktop computers shared by shift based staff. These tablets contain critical business data and are inherently at increased risk of theft. Which of the following will best help to mitigate this risk?
A. Implement remote wipe capability
B. create an acceptable use policy
C. conduct a mobile device risk assessment
D. deploy mobile device management (MDM)
D
Which of the following should be the greatest consideration when determining the recovery time objective (RTO) for an in house critical application, database, or server?
A. Direction from senior management
B. results of recovery testing
C. determination of recovery point objective (RPO)
D. impact of service interruption
C
Which of the following would be impacted the most by a business decision to move from traditional computing to cloud computing?
A. Security awareness
B. security standards
C. security policies
D. security strategy
D
The best way to avoid session hijacking is to use:
A. strong password controls
B. a firewall
C. a reverse lookup
D. a secure protocol
D
Which of the following is most helpful for determining which information security policies should be implemented by an organization?
A. Business impact analysis
B. risk assessment
C. vulnerability assessment
D. industry best practices
B
An organization’s information security manager reads on social media that a recently purchased vendor product has been compromised and customer data has been posted online. What should the information security manager do first?
A. Activate the incident response program
B. validate the risk to the organization
C. perform a business impact analysis (BIA)
D. notify local law enforcement agencies of a breach
B
Which of the following is the most effective way to mitigate the risk of confidential data leakage to unauthorized stakeholders?
A. Create a data classification policy
B. implement role based access controls
C. require the use of login credentials and passwords
D. conduct information security awareness training
B
An information security manager is implementing a bring your own device (BYOD) program. Which of the following would best ensure that users adhere to the security standards?
A. Publish the standards on the intranet landing page
B. deploy a device management solution
C. establish an acceptable use policy
D. monitor user activities on the network
C
The primary objective of a risk response strategy should be:
A. Threat reduction
B. Senior management buy in
C. appropriate control selection
D. regulatory compliance
C
The most effective tools for responding to new and advanced attacks are those that detect attacks based on:
A. behavior analysis
B. penetration testing
C. signature analysis
D. data packet analysis
A
A multinational organization is required to follow governmental regulations with different security requirements at each of its operating locations. The chief information security officer (CISO) should be most concerned with:
A. developing a security program that meets global and regional requirements
B. ensuring effective communication with local regulatory bodies
C. monitoring compliance with defined security policies and standards
D. using industry best practices to meet local legal regulatory requirements
A
Which of the following desired outcomes best supports a decision to invest in a new security initiative?
A. Enhanced security monitoring and reporting
B. reduction of organizational risk
C. reduced control complexity
D. enhanced threat detection capability
B
Which of the following is most likely to be included in an enterprise security policy?
A. Definitions of responsibilities
B. retention schedules
C. system access specifications
D. organizational risk
A
Which of the following roles is best able to influence the security culture within an organization?
A. Chief information security officer (CISO)
B. Chief information officer (CIO)
C. chief operating officer (COO)
D. chief executive officer (CEO)
D
To help ensure that an information security training program is most effective, its contents should be:
A. aligned to business processes
B. based on employees roles
C. based on recent incidents
D. focused on information security policy
B
Which of the following best demonstrates return on investment (ROI) for an information security initiative?
A. Risk heat map
B. business impact analysis (BIA)
C. business case
D. information security program road map
C
A financial company executive is concerned about recently increasing cyber attacks and needs to take action to reduce risk. The organization would best respond by:
A. increasing budget and staffing levels for the incident response team
B. revalidating and mitigating risks to an acceptable level
C. Implementing an intrusion detection system (IDS)
D. testing the business continuity plan (BCP)
B
An information security manager is concerned with continued security policy violations in a particular business unit despite recent efforts to rectify the situation. What is the BEST course of action?
A. Review the business unit’s function against the policy
B. Revise the policy to accommodate the business unit
C. Report the business unit for policy noncompliance
D. Enforce sanctions on the business unit
A
Which of the following is most important to consider when determining the criticality and sensitivity of an information asset?
A. Results of business continuity testing
B. Number of threats that can impact the asset
C. Investment required to protect the asset
D. Business functions supported by the asset
D
Which of the following is the best method for determining whether a firewall has been configured to provide a comprehensive perimeter defense?
A. A port scan of the firewall from an internal source
B. a simulated denial of service attack (DoS) against the firewall
C. a validation of the current firewall rule set
D. a ping test from an external source
C
What is the primary objective of implementing standard security configurations?
A. Maintain a flexible approach to mitigate potential risk to unsupported systems
B. minimize the operational burden of managing and monitoring unsupported systems
C. compare configurations between supported and unsupported systems
D. control vulnerabilities and reduce threats from changed configurations
D
An information security manager note that security incident are not being appropriately escalated by the help desk after tickets are logged. Which of the following is the best automated control to resolve this issue?
A. Integrating automated service level agreement (SLA) reporting into the helpdesk ticketing system
B. changing the default setting for all security incidents to the highest priority
C. integrating incident response workflow into the helpdesk ticketing system
D. implementing automated vulnerability scanning in the help desk workflow
C
Which of the following has the greatest positive impact on the ability to execute a disaster recovery plan?
A. Updating the plan periodically
B. conducting a walkthrough of the plan
C. storing the plan at an off-site location
D. communicating the plan to all stakeholders
D
Which of the following is the most effective way to protect the authenticity of data in transit?
A. hash value
B. Digital signature
C. private key
D. public key
B
Which of the following components of an information security risk assessment is most valuable to senior management?
A. Residual risk
B. return on investment (ROI)
C. mitigation actions
D. threat profile
A
Who should determine data access requirements for an application hosted at an organizations data center?
A. Information security manager
B. business owner
C. data custodian
D. systems administrator
B
An organization recently purchased data loss prevention software but soon discovered the software fails to detect or prevent data loss.
Which of the following should the information security manager do first?
A. Revise the data classification policy
B. review the contract
C. review the configuration
D. implement stricter data loss controls
C
Which risk is introduced when using only sanitized data for the testing of applications?
A. Unexpected outcomes may arise in production
B. data disclosure may occur during the mitigation event
C. breaches of compliance obligations will occur
D. data loss may occur during the testing phase
A
Which of the following should be the primary goal of information security?
A. Business alignment
B. regulatory compliance
C. data governance
D. information management
D
what is the primary benefit to an organization when information security program requirements are aligned with employment and staffing processes?
A. Access is granted based on task requirements
B. information assets are classified appropriately
C. security staff turnover is reduced
D. security incident reporting procedures are followed
C
Which of the following would be most helpful to identify worst case disruption scenarios?
A. Cost benefit analysis
B. SWOT analysis
C. business process analysis
D. business impact analysis (BIA)
D
If civil litigation is a goal for an organizational response to a security incident, the primary steps should be to:
A. capture evidence using standard server backup utilities
B. document the chain of custody
C. reboot affected machines in a secure area to search for evidence
D. contact law enforcement
B
Which of the following is most important to the successful implementation of information security program?
A. Key performance indicators (KPIs) are defined
B. adequate security resources are allocated to the program
C. a balanced scorecard is approved by the steering committee
D. the program is developed using global security standards
B
Which of the following is the best way to determine the gap between the present and desired state of an information security program?
A. Determine whether critical Success Factors (CSFs) have been defined
B. Review and update current operational procedures
C. perform a risk analysis for critical applications
D. conduct a capability maturity model evaluation
D
During the initiation phase of the system development life cycle (SDLC) for a software project, information security activities should address:
A. baseline security controls
B. security objectives
C. cost benefit analyses
D. benchmarking security metrics
B
Reverse lookups can be used to prevent successful:
A. denial of service (DoS) attacks
B. phishing attacks
C. Session hacking
D. Internet Protocol (IP) spoofing
C
A legacy application does not comply with new regulatory requirements to encrypt sensitive data at rest, and remediating this issue would require significant investment. What should the information security manager do first?
A. Assess the business impact to the organization
B. present the non compliance risk to senior management
C. investigate alternative options to remediate the noncompliance
D. determine the cost to remediate the noncompliance
A
A large organization is in the process of developing its information security program that involves working with several complex organizational functions. Which of the following will best enable the successful implementation of this program?
A. Security governance
B. security policy
C. security metrics
D. security guidelines
A
Which of the following is most important for an information security manager to verify before conducting full-functional continuity testing?
A. Incident response and recovery plans are documented in simple language
B. copies of recovery and incident response plans are kept off-site
C. teams and individuals responsible for recovery have been identified
D. risk acceptance by the business has been documented
D
Which of the following external entities would provide the best guidance to an organization facing advanced attacks?
A. Incident response experts from highly regarded peer organizations
B. open source reconnaissance
C. recognize threat intelligence communities
D. disaster recovery consultants widely endorsed in industry forums
C
Which of the following would best provide stakeholders with information to determine the appropriate response to a disaster?
A. Vulnerability assessment
B. SWOT analysis
C. business impact analysis (BIA)
D. risk assessment
D
The best way to report to the board on the effectiveness of the information security program is to present:
A. a summary of the most recent audit findings
B. a report of cost savings from process improvements
C. peer- group industry benchmarks
D. a dashboard illustrating key performance metrics
D
An organization security policy is to disable access to USB storage devices on laptops and desktops. Which of the following is the strongest justification for granting an exception to the policy?
A. Users accept the risk of noncompliance
B. the benefit is greater than the potential risk
C. USB storage devices are enabled based on user roles
D. access is restricted to read only
B
Which of the following will result in the MOST accurate controls assessment?
A. Mature change management processes
B. Unannounced testing
C. Well-defined security policies
D. Senior management support
B
Which of the following should be done FIRST when establishing a new data protection program that must comply with applicable data privacy regulations?
A. Encrypt all personal data stored on systems and networks
B. Evaluate privacy technologies required for data protection
C. Create an inventory of systems when personal data is stored
D. Update disciplinary processes to address privacy violations
C
An organization faces severe fines and penalties if not in compliance with local regulatory requirements by an established deadline. Senior management has asked the information security manager to prepare an action plan to achieve compliance. Which of the following would provide the MOST useful information for planning purposes?
A. Results from a business impact analysis (BIA)
B. Results from a gap analysis
C. An inventory of security controls in place
D. Deadlines and penalties for noncompliance
B
Management decisions concerning information security investments will be MOST effective when they are based on:
A. a process for identifying and analyzing threats and vulnerabilities
B. the formalized acceptance of risk analysis by management
C. the reporting of consistent and periodic assessments of risks
D. an annual loss expectancy (ALE) determined from the history of security events
C
Which of the following will have the MOST negative impact to the effectiveness of incident response processes?
A. High organizational risk tolerance
B. Decentralized incident monitoring
C. Ambiguous severity criteria
D. Manual incident reporting processes
C
Which of the following is the MOST effective way to help ensure web developers understand the growing severity of web application security risks?
A. Standardize secure web development practices
B. Integrate security into the early phases of the development life cycle
C. Incorporate security requirements into job descriptions
D. Implement a tailored security awareness training program
D
Which of the following is a PRIMARY objective of an information security governance framework?
A. To provide the basis for action plans to achieve information security objectives organization-wide
B. To achieve the desired information security state as defined by business unit management
C. To align the relationships of stakeholders involved in developing and executing an information security strategy
D. To provide assurance that information assets are provided a level of protection proportionate to their inherent risk
D
Internal audit has reported a number of information security issues that are not in compliance with regulatory requirements. What should the information security manager do FIRST?
A. Create a security exception
B. Assess the risk to business operations
C. Perform a vulnerability assessment
D. Perform a gap analysis to determine needed resources
B
Due to changes in an organization’s environment, security controls may no longer be adequate. What is the information security manager’s BEST course of action?
A. Perform a new risk assessment
B. Review the previous risk assessment and countermeasures
C. Transfer the new risk to a third party
D. Evaluate countermeasures to mitigate new risks
A
Which of the following BEST enables the design of an effective incident escalation process?
A. A well-defined organizational hierarchy
B. Enforceable control baselines
C. A comprehensive risk register
D. Controls designed for defense in depth
A
Which of the following is an example of risk mitigation?
A. Improving security controls
B. Discontinuing the activity associated with the risk
C. Performing a cost-benefit analysis
D. Purchasing insurance
A
A security policy exception is leading to an unexpected increase in the number of alerts about suspicious internet traffic on an organization’s network. Which of the following is the BEST course of action?
A. Remove the rules that trigger the increased number of alerts
B. Present a risk analysis with recommendations to senior management
C. Update the risk register so that senior management is kept informed
D. Evaluate and update the enterprise network security architecture
D
Which of the following is the GREATEST benefit of information asset classification?
A. Supporting segregation of duties
B. Defining resource ownership
C. Providing a basis for implementing a need-to-know policy
D. Helping to determine the recovery point objective (RPO)
C
