Chapter 16 – Managing Security Operations

Question 1

1. An organization ensures that users are granted access to only the data they need to perform specific work task. What principle are they following?
   Need-to-know

Answer 1

Need-to-know

Question 2

2. An administrator is granting permissions to database. What is the default level of access the administrator should grant to new users in the organization?
   No access

Answer 2

No access

Question 3

3. Which of the following statements best statements best describes why separation of duties is important for security purposes?
   It prevents any single IT security person from making major security changes without involving other individuals

Answer 3

It prevents any single IT security person from making major security changes without involving other individuals

Question 4

4. What is a primary benefit of job rotation and separation of duties policies?
   Preventing fraud

Answer 4

Preventing fraud

Question 5

5. A financial organization commonly has employees switch duty responsibilities every six months. What security principle are they employing?
   Job rotation

Answer 5

Job rotation

Question 6

6. Which of the following is one of the primary reasons an organization enforces a mandatory vacation policy?
   To detect fraud

Answer 6

To detect fraud

Question 7

7. An organization wants to reduce vulnerabilities against fraud from malicious employees. Of the following choices, what would help with this goal? (Choose all that apply.)
   Job rotation, Separation of duties, Mandatory vacations

Answer 7

Job rotation, Separation of duties, Mandatory vacations

Question 8

8. Of the following choices, what is not a valid security practice related to special privileges?
   Grant access equally to administrators and operators.

Answer 8

Grant access equally to administrators and operators.

Question 9

9. Which of the following identifies vendor responsibilities and can include monetary penalties if the vendor doesn’t meet the stated responsibilities?
   Service-level agreement (SLA)

Answer 9

Service-level agreement (SLA)

Question 10

10. What should be done with equipment that is at the end of its lifecycle and is being donated to a charity?
    Sanitize it.

Answer 10

Sanitize it.