IS4550 CHAPTER 7

Question 1

The approach of using multiple layers of security to protect against a single point is called ___.

Answer 1

DEFENSE IN DEPTH

Question 2

A person with enthusiasm for a cause or project and often gains acceptance for a project from a wide audience is called ___.

Answer 2

EVANGELIST

Question 3

The practice and science of classification and hierarchical ___ is a tree structure of classifications for a given set of objects or documents is called ___.

Answer 3

TAXONOMY

Question 4

1. When writing policies and standards, you should address the six key questions who, what, where, when, why and how.
   TRUE OR FALSE

Answer 4

TRUE

Question 5

2. All policy and standards libraries follow a universal numbering scheme for consistency between organizations.
   TRUE OR FALSE

Answer 5

FALSE

Question 6

3. Guideline documents are often tied to a specific control standard.
   TRUE OR FALSE

Answer 6

TRUE

Question 7

4. Which of the following is not an administrative control?
5. Development of policies, standards, procedures, and guidelines
6. Screening of personnel
7. Change control procedures
8. Logical access control mechanisms

Answer 7

Logical access control mechanisms

Question 8

5. Which of the following are common steps taken in the development of documents such as security policies, standards, and procedures?
6. Design, development, publication, coding, and testing
7. Feasibility, development, approval, implementation and integration
8. Initiation, evaluation, development, approval, publication, implementation, and maintenance
9. Design, coding, evaluation, approval, publication, and implementation

Answer 8

Initiation, evaluation, development, approval, publication, implementation, and maintenance

Question 9

6. Which departments should review policies and standards before official approval? (Select four)
7. Technical
8. Legal
9. HR
10. Maintenance
11. Audit

Answer 9

Technical
Legal
HR
Audit

Question 10

7. Controls are implemented to do which of the following?
8. Create new standards
9. Protect systems from attacks on the confidentiality, integrity, and availability of the system
10. Eliminate all risk and eliminate the potential for loss
11. Support guidelines

Answer 10

Protect systems from attacks on the confidentiality, integrity, and availability of the system

Question 11

8. Which type of control is associated with responding to and fixing a security incident?
9. Deterrent
10. Compensating
11. Corrective
12. Detective

Answer 11

Corrective

Question 12

9. List examples of physical security control items.

Answer 12

Devices and processes used to control physical access
Fences
Security guards
Locked doors
Motion detectors
Alarms

Question 13

10. Security ___ are the technical implementations of the policies defined by the organization.

Answer 13

Procedures

Question 14

11. A(n) ___ is a plan or course of action used by an organization to convey instructions from its senior-most management to those who make decisions, take actions, and perform other duties on behalf of the organization.

Answer 14

Policy

Question 15

12. The principle that states security is improved when it is implemented as a series of overlapping controls is called ___.

Answer 15

Defense in depth

Question 16

13. Security principles are needed in the absence of complete information to make high-quality security decisions.
    TRUE OR FALSE

Answer 16

TRUE

Question 17

14. “Access to all Organization information resources connected to the network must be controlled by using user IDs and appropriate authentication” is a statement you might find in a procedure document.
    TRUE OR FALSE

Answer 17

FALSE

Question 18

15. Which of the following does a policy change control board do? (Select two).
16. Assess policies and standards and makes recommendations for change
17. Determines the policy and standards library numbering scheme
18. Implements technical controls as business conditions change
19. Review requested changes too the policy framework

Answer 18

Assess policies and standards and makes recommendations for change
Review requested changes too the policy framework