The COSO framework is built on five interrelated components. Which of the following is NOT one of them?

	a.	Control environment
	b.	Control activities
	c.	Risk assessment
	d.	InfoSec Governance

Which type of access controls can be role-based or task-based?

	a.	content-dependent
	b.	nondiscretionary
	c.	discretionary
	d.	constrained

Which of the following is NOT a category of access control?

	a.	mitigating
	b.	compensating
	c.	preventative
	d.	deterrent

Which of the following is the primary purpose of ISO/IEC 27001:2005?

	a.	Use within an organization to formulate security requirements and objectives
	b.	Use within an organization to ensure compliance with laws and regulations
	c.	Implementation of business-enabling information security
	d.	To enable organizations that adopt it to obtain certification

Which of the following is NOT a change control principle of the Clark-Wilson model?

	a.	No unauthorized changes by authorized subjects
	b.	No changes by unauthorized subjects
	c.	No changes by authorized subjects without external validation
	d.	The maintenance of internal and external consistency