A.Security policies are being reviewed infrequently.

B.Controls are not operating efficiently.

C.Vulnerabilities are not being mitigated

D.Aggregate risk is approaching the tolerance threshold

A.Short-term

B.Long-term

C.Discontinuous

D.Large impact

E.Explanation:
Natural disaster can be a long-term or short-term and can have large or small impact on the
company. However, as the natural disasters are unpredictable and infrequent, they are best
considered as discontinuous.

F.is incorrect. Natural disaster can be a short-term, but it is not the best answer.

G.is incorrect. Natural disaster can be a long-term, but it is not the best answer.

A.Login attempts are reconciled to a list of terminated employees.

B.The human resources (HR) system automatically revokes system access.

C.A list of terminated employees is generated for reconciliation against current IT access.

D.A process to remove employee access during the exit interview is implemented.

A.interview employees to compare actual with expected procedures.

B.inspect a selection of audit trails and backup logs.

C.conduct an audit of files stored offsite.

D.demonstrate a successful recovery from backup files.

A.A recommendation for internal audit validation

B.Plans for mitigating the associated risk

C.Suggestions for improving risk awareness training

D.The impact to the organization s risk profile