Explanation/Reference:
Explanation:
The needs of the organization should always take precedence. Best practices and local regulations are important, but they do not take into account the total needs of an organization.

Section: INFORMATION RISK MANAGEMENT
Explanation:
The goal of a risk management program is to ensure that residual risk remains within manageable levels.
Management of risk does not always require the removal of inherent risk nor is this always possible. A possible benefit of good risk management is to reduce insurance premiums, but this is not its primary intention. Effective controls are naturally a clear objective of a risk management program, but with the choices given, choice C is an incomplete answer.

Explanation/Reference:
Explanation:
An application server should normally be placed within a demilitarized zone (DMZ) to shield the internal network. Data warehouse and departmental servers may contain confidential or valuable data and should always be placed on the internal network, never on a DMZ that is subject to compromise. A proxy server forms the inner boundary of the DMZ but is not placed within it.