Information Security Guidelines and Risk Managerment Flashcards
When seeking to hire new employees, what is the first step? A) Create a job description. B) Set position classification. C) Screen candidates. D) Request resumes.
Create a job description.
The first step in hiring new employees is to create a job description. Without a job description, there is no consensus on what type of individual needs to be found and hired.
Which of the following describes the freedom from being observed, monitored, or examined without consent or knowledge? A) Integrity B) Privacy C) Authentication D) Accountability
Privacy
One definition of privacy is freedom from being observed, monitored, or examined without consent or knowledge.
Which of the following is typically not a characteristic considered when classifying data? A) Value B) Size of object C) Useful lifetime D) National security implications
Size of object
Size is not a criterion for establishing data classification. When classifying an object, you should take value, lifetime, and security implications into consideration.
Which of the following would generally not be considered an asset in a risk analysis? A) A development process B) An IT infrastructure C) A proprietary system resource D) Users' personal files
Users’ personal files
The personal files of users are not usually considered assets of the organization and thus are not considered in a risk analysis.
You've performed a basic quantitative risk analysis on a specific threat/vulnerability/risk relation. You select a possible countermeasure. When performing the calculations again, which of the following factors will change? A) Exposure factor B) Single loss expectancy C) Asset value D) Annualized rate of occurrence
Annualized rate of occurrence
A countermeasure directly affects the annualized rate of occurrence, primarily because the countermeasure is designed to prevent the occurrence of the risk, thus reducing its frequency per year.
What ensures that the subject of an activity or event cannot deny that the event occurred? A) CIA Triad B) Abstraction C) Nonrepudiation D) Hash totals
Nonrepudiation
Nonrepudiation ensures that the subject of an activity or event cannot deny that the event occurred.
What are the two common data classification schemes?
A) Military and private sector
B) Personal and government
C) Private sector and unrestricted sector
D) Classified and unclassified
Military and private sector
Military (or government) and private sector (or commercial business) are the two common data classification schemes.
A data custodian is responsible for securing resources after \_\_\_\_\_\_\_\_\_\_\_ has assigned the resource a security label. A) Senior management B) Data owner C) Auditor D) Security staff
Data owner
The data owner must first assign a security label to a resource before the data custodian can secure the resource appropriately.
Which of the following is not specifically or directly related to managing the security function of an organization? A) Worker job satisfaction B) Metrics C) Information security strategies D) Budget
Worker job satisfaction
Managing the security function often includes assessment of budget, metrics, resources, information security strategies, and assessing the completeness and effectiveness of the security program.
The CIA Triad comprises what elements?
A) Contiguousness, interoperable, arranged
B) Authentication, authorization, accountability
C) Capable, available, integral
D) Availability, confidentiality, integrity
Availability, confidentiality, integrity
The components of the CIA Triad are confidentiality, availability, and integrity.
Which of the following is a primary purpose of an exit interview?
A) To return the exiting employee’s personal belongings
B) To review the nondisclosure agreement
C) To evaluate the exiting employee’s performance
D) To cancel the exiting employee’s network access accounts
To review the nondisclosure agreement
The primary purpose of an exit interview is to review the nondisclosure agreement (NDA) and other liabilities and restrictions placed on the former employee based on the employment agreement and any other security-related documentation.
Which of the following is not a valid definition for risk?
A) An assessment of probability, possibility, or chance
B) Anything that removes a vulnerability or protects against one or more specific threats
C) Risk = threat * vulnerability
D) Every instance of exposure
Anything that removes a vulnerability or protects against one or more specific threats
Anything that removes a vulnerability or protects against one or more specific threats is considered a safeguard or a countermeasure, not a risk.
When a safeguard or a countermeasure is not present or is not sufficient, what remains? A) Vulnerability B) Exposure C) Risk D) Penetration
Vulnerability
A vulnerability is the absence or weakness of a safeguard or countermeasure.
What security control is directly focused on preventing collusion? A) Principle of least privilege B) Job descriptions C) Separation of duties D) Qualitative risk analysis
Separation of duties
The likelihood that a co-worker will be willing to collaborate on an illegal or abusive scheme is reduced because of the higher risk of detection created by the combination of separation of duties, restricted job responsibilities, and job rotation.
Data classifications are used to focus security controls over all but which of the following? A) Storage B) Processing C) Layering D) Transfer
Layering
Layering is a core aspect of security mechanisms, but it is not a focus of data classifications.
When an employee is to be terminated, which of the following should be done?
A) Inform the employee a few hours before they are officially terminated.
B) Disable the employee’s network access just as they are informed of the termination.
C) Send out a broadcast email informing everyone that a specific employee is to be terminated.
D) Wait until you and the employee are the only people remaining in the building before announcing the termination.
Disable the employee’s network access just as they are informed of the termination.
You should remove or disable the employee’s network user account immediately before or at the same time they are informed of their termination.
Which of the following represents accidental or intentional exploitations of vulnerabilities? A) Threat events B) Risks C) Threat agents D) Breaches
Threat events
Threat events are accidental or intentional exploitations of vulnerabilities.
