Section: Volume D

Section: Volume B
Explanation:
A control or countermeasure which does not overlap in its performance with another control or countermeasure is considered as distinct. Hence the separation of controls in the production environment rather than the separation in the design and implementation of the risk refers to distinct.
Incorrect Answers:
A: Trusted source refers to the commitment of the people designing, implementing, and maintenance of the control towards the security policy.
B: Secure controls refers to the activities ability to protect from exploitation or attack.
D: The separation in design, implementation, and maintenance of controls or countermeasures are refer to as independent. Hence this answer is not valid.

Explanation/Reference:
Explanation:
A risk analysis involves identifying the most probable threats to an organization and analyzing the related vulnerabilities of the organization to these threats. A risk from an organizational perspective consists of:
Threats to various processes of organization.

Threats to physical and information assets.

Likelihood and frequency of occurrence from threat.

Impact on assets from threat and vulnerability.

Risk analysis allows the auditor to do the following tasks :

Threats to various processes of organization.

Threats to physical and information assets.

Likelihood and frequency of occurrence from threat.

Impact on assets from threat and vulnerability.

Risk analysis allows the auditor to do the following tasks :

Identify threats and vulnerabilities to the enterprise and its information system.

Provide information for evaluation of controls in audit planning.

Aids in determining audit objectives.

Supporting decision based on risks.

Incorrect Answers:
B: Auditors identify threats and vulnerability not only in the IT but the whole enterprise as well.

Section: Volume D

Section: Volume D