Explanation/Reference:
Explanation:
A Trojan horse is code that is disguised as a useful application but contains code that has a malicious or harmful purpose imbedded in it. The Trojan horse can then set up a back door, install keystroke loggers, implement rootkits, upload files from the victim's system, install bot software, and perform many other types of malicious acts.
Incorrect Answers:
B: Network mobile code is usually called a worm, which is malicious software that infects adjacent hosts which are unpatched against the vulnerability the worm exploits.
C: A virus is a segment of code that attaches itself to a host program by embedding a copy of itself in that program. A virus would not open a port on Debbie's computer and install a site selling prescription drugs.
D: A logic bomb executes a set of instructions when specific conditions are met.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, pp. 1199-1201,
1202, 1206
http://en.wikipedia.org/wiki/Trojan_horse_(computing)

Policies are high-level statements, beliefs, goals and objectives and the general means for their attainment for a specific subject area. Standards are mandatory activities, action, rules or regulations designed to provide policies with the support structure and specific direction they require to be effective. Guidelines are more general statements of how to achieve the policies objectives by providing a framework within which to implement procedures. Procedures spell out the specific steps of how the policy and supporting standards and how guidelines will be implemented.
Source: HARE, Chris, Security management Practices CISSP Open Study Guide, version
1.0, april 1999.

Explanation/Reference:
Explanation:
The auditor is responsible for providing reports to the senior management on the effectiveness of the security controls.
The function of the auditor is to come around periodically and make sure you are doing what you are supposed to be doing. They ensure the correct controls are in place and are being maintained securely.
The goal of the auditor is to make sure the organization complies with its own policies and the applicable laws and regulations. Organizations can have internal auditors and/or external auditors. The external auditors commonly work on behalf of a regulatory body to make sure compliance is being met.
Incorrect Answers:
A: Information systems security professionals implement security controls. They do not report on their effectiveness.
B: The data owner (information owner) is usually a member of management who is in charge of a specific business unit, and who is ultimately responsible for the protection and use of a specific subset of information. The data owner does not report on the effectiveness of security controls.
C: The data custodian (information custodian) is responsible for maintaining and protecting the data. The data custodian does not report on the effectiveness of security controls.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, pp. 122-125