Explanation/Reference:
Explanation:
Conducting security awareness and technical training to ensure that end users and system users are aware of the rules of behavior and their responsibilities in protecting the organization's mission is an example of a preventive management control, therefore not an operational control.
Incorrect Answers:
A: Protecting laptops, personal computers and workstations is an example of a preventive operational control.
B: Controlling software viruses is an example of a preventive operational control.
C: Controlling data media access and disposal is an example of a preventive operational control.

The requirement that must be met during internal security audits to ensure that all information provided is expressed as an objective assessment without risk of retaliation is that the auditor must be independent and report directly to the management. An internal security audit is a process that involves the examination or evaluation of the security policies, procedures, or practices of an organization, by an internal auditor or a team of internal auditors, to identify or detect any security gaps, weaknesses, or issues, as well as to provide or recommend any security improvements, enhancements, or solutions. An internal security audit can help to ensure the security, compliance, or performance of the organization, as well as to protect the organization from various security threats or risks, such as unauthorized access, data leakage, or malware infection. However, an internal security audit can also face various challenges, difficulties, or biases, such as conflicts of interest, lack of cooperation, or resistance to change, that may affect the quality, accuracy, or reliability of the audit results or findings, as well as the implementation, acceptance, or effectiveness of the audit recommendations or suggestions. Therefore, an internal security audit should be conducted with integrity, objectivity, or professionalism, by following various security standards, guidelines, or best practices. The requirement that must be met during internal security audits to ensure that all information provided is expressed as an objective assessment without risk of retaliation is that the auditor must be independent and report directly to the management. The auditor must be independent, which means that the auditor must not have any personal, professional, or financial relationship or interest with the auditee or the subject of the audit, that may compromise or influence the auditor's judgment, opinion, or decision. The auditor must also report directly to the management, which means that the auditor must communicate or deliver the audit results or findings to the highest level of authority or responsibility in the organization, such as the board of directors, the executive committee, or the senior management, without any interference, manipulation, or censorship from any other party or stakeholder. The auditor must be independent and report directly to the management, to ensure that all information provided is expressed as an objective assessment, which means that the information is based on facts, evidence, or data, rather than on opinions, assumptions, or emotions, and without risk of retaliation, which means that the information is provided without fear, pressure, or intimidation from any party or stakeholder, that may harm, punish, or discourage the auditor for providing the information. The auditor must utilize automated tools to back their findings, the auditor must work closely with both the information technology (IT) and security sections of an organization, or the auditor must perform manual reviews of systems and processes are not the requirements that must be met during internal security audits to ensure that all information provided is expressed as an objective assessment without risk of retaliation, as they are either more related to the methods, techniques, or tools that are used or applied by the auditor during the audit process, rather than the principles, standards, or practices that are followed or adhered by the auditor during the audit process, or to the relationships, interactions, or collaborations that are established or maintained by the auditor with the other parties or stakeholders during the audit process, rather than the independence, objectivity, or professionalism that are demonstrated or exhibited by the auditor during the audit process.
References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 7: Security Operations, page 484; CISSP Official (ISC)2 Practice Tests, Third Edition, Domain 7: Security Operations, Question 7.13, page 276.

Inappropriate disclosure is a confidentiality, not an integrity goal.
All of the other choices above are integrity goals addressed by the Clark-Wilson integrity model.
The Clark-Wilson model is an integrity model that addresses all three integrity goals:
1. prevent unauthorized users from making modifications,
2. prevent authorized users from making improper modifications, and
3. maintain internal and external consistency through auditing.
NOTE: Biba address only the first goal of integrity above
Reference(s) used for this question:
Harris, Shon (2012-10-18). CISSP All-in-One Exam Guide, 6th Edition (p. 1384). McGraw-
Hill. Kindle Edition.

The primary security concern for an organization that publishes and periodically updates its employee policies in a file on their intranet is integrity. Integrity is the property that ensures that the data or the information is accurate, complete, consistent, and authentic, and that it has not been modified, altered, or corrupted by unauthorized or malicious parties. Integrity is a primary security concern for the employee policies file on the intranet, as it can affect the compliance, trust, and reputation of the organization, and the rights and responsibilities of the employees. The employee policies file must reflect the current and valid policies of the organization, and must not be changed or tampered with by anyone who is not authorized or qualified to do so.
Availability, confidentiality, and ownership are not the primary security concerns for the employee policies file on the intranet, as they are related to the accessibility, protection, or attribution of the data or the information, not the accuracy or the authenticity of the data or the information. References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 1, Security and Risk Management, page 20. Official (ISC)2 CISSP CBK Reference, Fifth Edition, Chapter 1, Security and Risk Management, page 33.