Explanation/Reference:
Explanation:
Automated password synchronization reduces the overall administrative workload of resetting passwords.
It does not increase security between multi-tier systems, allow passwords to be changed less frequently or reduce the need for two-factor authentication.

Section: INFORMATION RISK MANAGEMENT
Explanation:
The recovery point objective (RPO) is the point in the processing flow at which system recovery should occur.
This is the predetermined state of the application processing and data used to restore the system and to continue the processing flow. Disaster declaration is independent of this processing checkpoint. Restoration of the system can occur at a later date, as does the return to normal, after-image processing.

Explanation/Reference:
Explanation:
A permanent decline in customer confidence does not lend itself well to measurement by quantitative techniques. Qualitative techniques are more effective in evaluating things such as customer loyalty and goodwill. Theft of software, power outages and temporary loss of e-mail can be quantified into monetary amounts easier than can be assessed with quantitative techniques.

The value of an information system should be based on the cost incurred if the system were to become unavailable. The cost to design or recreate the system is not as relevant since a business impact analysis measures the impact that would occur if an information system were to become unavailable. Similarly, the cost of emergency operations is not as relevant.

Section: INFORMATION RISK MANAGEMENT
Explanation:
The aim of risk management is to reduce impacts to an acceptable level. "Acceptable" or "reasonable" are relative terms that can vary based on environment and circumstances. A minimum level that is consistent with regulatory requirements may not be consistent with business objectives, and regulators typically do not assign risk levels. The minimum level possible may not be aligned with business requirements.