Q). Who should decide how a company should approach security and what security measures should be implemented?

a) Senior management
b) The information security specialist
c) Auditor
d) Data owner

Answer: The correct answer is "A". The senior management in an organization should decide on the security approach and security measures. Even though the information security specialist may have the technical knowledge of security approach, the decision about security approach and measures should be left with the senior management. All the other choices are incorrect.