IS4550 CHAPTER 6

Question 1

The ability to reasonably ensure conformity and adherence to organization policies, standards, procedures to laws and regulations is called ___.

Answer 1

COMPLIANCE

Question 2

A deviation from a centrally supported and approved IT security standard and can come about because of a lack of preparedness by the organization to comply with a standard or due to the use of a technology that has not been sanctioned by the standards is called ___.

Answer 2

EXCEPTION

Question 3

A capstone document that establishes the reporting lines and delegation of responsibilities for Information Security to management below the organization’s chief information officer (CIO) or other executive leader is called ___.

Answer 3

INFORMATION SECURITY PROGRAM CHARTER

Question 4

Information security standards published by the ISO and by the International Electrotecnical Commission (IEC)

Answer 4

ISO/IEC 27000 SERIES

Question 5

A standard that focuses on areas of current relevance and concern to an organization. This is used to express security control requirement, typically for non-technical processes and are used to guide human behavior is called ___.

Answer 5

ISSUE-SPECIFIC STANDARD

Question 6

A logical structure that is established to organize policy documentation into groupings and categories that make it easier for employees to find and understand the contents of various policy documents is called ___.

Answer 6

IT POLICY FRAMEWORK

Question 7

A publication for the US National Institute of standards and Technology (NIST) and is titled “Recommended Security controls for Federal Information Systems and Organizations is called ___.

Answer 7

NIST SP 800-53

Question 8

A standard that focusses on specific technology or systems being used within an organization. These are used to express the security control implementation requirements for some specific technology is called ___.

Answer 8

SYSTEM-SPECIFIC STANDARD

Question 9

1. An IT policy framework charter includes which of the following?
2. The program’s purpose and mission
3. The program’s scope within the organization
4. Assignment of responsibilities for program implementation
5. Compliance management
6. 1, 2, and 3 only
7. 1, 2, 3, and 4

Answer 9

1. The program’s purpose and mission
2. The program’s scope within the organization
3. Assignment of responsibilities for program implementation
4. Compliance management

ALL ANSWERS

Question 10

2. Which of the following is the first step in establishing an information security program?
3. Adoption of an information security policy framework or charter
4. Development and implementation of an information security standards manual
5. Development of a security awareness-training program for employees
6. Purchase of security access control software

Answer 10

Adoption of an information security policy framework or charter

Question 11

3. Which of the following are generally accepted and widely used policy frameworks? Select three
4. COBIT
5. ISO/IEC 27002
6. NIST SP 800-53
7. NIPP

Answer 11

COBIT
ISO/IEC 27002
NIST SP 800-53

Question 12

4. Security policies provide the “what” and “why” of security measures.
   TRUE OR FALSE

Answer 12

TRUE

Question 13

5. ___ are best defined as high-level statements, beliefs, goals, and objectives.

Answer 13

Policies

Question 14

6. which of the following is not mandatory?
7. Standard
8. Guideline
9. Procedure
10. Baseline

Answer 14

Guideline

Question 15

7. Which of the following includes all of the detailed actions and tasks that personnel are required to follow?
8. Standard
9. Guideline
10. Procedure
11. Baseline

Answer 15

Procedure

Question 16

8. Risk management is the process of reducing risk to an acceptable level.
   TRUE OR FALSE

Answer 16

TRUE

Question 17

9. List the five tenets of information assurance that you should consider when building an IT policy framework.

Answer 17

1. Confidentiality
2. Integrity
3. Availability
4. Authorization
5. Nonrepudiation

Question 18

10. Preservation of confidentiality in information systems requires that the information not be disclosed to ___.

Answer 18

Unauthorized persons or processes

Question 19

11. When building a policy framework, which of the following information systems factors should be considered?
12. Unauthorized access to and use of the system
13. Unauthorized disclosure of information
14. Disruption of the system
15. Modification of information
16. Destruction of information resources
17. 1, 2, and 5 only
18. 1, 2,, 3, 4, and 5

Answer 19

Unauthorized access to and use of the system
Unauthorized disclosure of information 
Disruption of the system
Modification of information
Destruction of information resources