1 - Information Security Governance and Risk Management

Question 1

1. Which of the following is not an example of security control that ensures confidentiality?a. Data classificationb. Encryptionc. Restricting changes d. Network traffic padding

Answer 1

C: Restricting changes is an integrity protecting security mechanism.

Question 2

2. Who is ultimately responsible and liable if the security perimeter of an organization is violated by an intruder and asset losses occur?a. Senior managementb. Network or system administratorsc. Security guardsd. End users

Answer 2

A: Senior management is ultimately responsible and liable if the security perimeter of an organization is violated by an intruder and asset losses occur. Senior management is responsible for all aspects of security and is the primary decision maker. However, in most cases the implementation of security is delegated to lower levels of the authority hierarchy, such as the network or system administrators.

Question 3

3. Which of the following is not an example of a technical or logical security control?a. Encryptionb. Personnel screeningc. Identificationd. Access Control Lists

Answer 3

B: Personnel screening is an administrative security control. There are three types of security controls: administrative, physical, and logical or technical.

Question 4

4. Which of the following is an administrative security control?a. Personnel screeningb. Encryptionc. Authorizationd. Security guards

Answer 4

A: Personnel screening is an administrative security control

Question 5

5. Which of the following is a technical security control?a. Standardsb. Security devices c. Door locksd. Personnel screening

Answer 5

B: Security devices are technical security controls.

Question 6

6. Which of the following is a physical security control?a. Logical access controlsb. Security awareness trainingc. Identificationd. Environmental controls

Answer 6

D: Environmental controls are physical security controls.

Question 7

7. Which of the following is the best personnel arrangement for the design and management of security for an organization?a. A single security professional from within the organizationb. A team of security professionals from the organizationc. A team of employees representing every department within the organization d. An outside consultant

Answer 7

B: The best personnel arrangement for the design and management of security for an organization is a team of internal security professionals.

Question 8

8. Which of the following is not a role or responsibility of the Security Administration team or group within an organization?a. Monitoring the security of the entire organizationb. Integrating security into the business environmentc. Identifying, valuating, and classifying assetsd. Approving the security policy.

Answer 8

D: Approving the security policy is the responsibility of senior management, not that of the Security Administration team or group within an organization.

Question 9

9. Who is ultimately responsible for negligence in protecting the assets of an organization?a. Senior managementb. Security teamc. IT departmentd. Data custodian

Answer 9

A: Senior management is ultimately responsible for implementing prudent due care and is liable for negligence in protecting the assets of an organization.

Question 10

10. Which of the following is not one of the three security control types that a security administrator can employ to manage and impose security?a. Administrativeb. Technicalc. Strategicd. Physical

Answer 10

C: Administrative, technical, and physical are the three security control types that a security administrator can employ to manage and impose security.

Question 11

11. Which of the following is not an element in the CIA triad?a. Availabilityb. Integrityc. Privacyd. Confidentiality

Answer 11

C: Confidentiality, integrity, and availability are the elements of the CIA triad.

Question 12

12. Which of the following is a valid definition for confidentiality?a. Unauthorized disclosure is prevented.b. Unauthorized modification is preventedc. Resources are accessible at all times by authorized users.d. Disasters can be recovered from quickly.

Answer 12

A: Confidentiality can be defined by “Unauthorized disclosure is prevented.”

Question 13

13. Which of the following is not a task assigned to a data owner?a. Assign classifications to datab. Dictate how information is to be protectedc. Delegate security responsibilities to data custodiansd. Implement security controls

Answer 13

D: Implementing security controls is the responsibility of the security administration team or data custodians, not senior management.

Question 14

14. A security administrator may employ all but which of the following types of controls to implement a security solution?a. executiveb. administrativec. technicald. physical

Answer 14

A: Executive is not a valid type of security control. The three valid types of security control are administrative, technical (or logical), and physical.

Question 15

15. Which of the following is an example of an administrative security control?a. security guardsb. policiesc. locksd. intrusion detection systems

Answer 15

B: Policies are an example of an administrative security control.

Question 16

16. Which of the following is not an example of an administrative security control?a. Standardsb. Guidelinesc. Identificationd. Personnel screening

Answer 16

C: Identification is an example of a logical/technical security control.

Question 17

17. Which of the following is not one of the fundamental principles of security included in the CIA triad?a. Confidentialityb. Integrityc. Accountabilityd. Availability

Answer 17

C: While accountability is an important part of IT security, it is not one of the three fundamental principles of security included in the CIA triad, which includes Confidentiality, Integrity and Availability.

Question 18

18. The ability of a computer system to provide adequate capacity for predictable performance represents which of the fundamental security principles of the CIA triad?a. Confidentialityb. Integrityc. Accountabilityd. Availability

Answer 18

D: The ability of a computer system to provide adequate capacity for predictable performance is an example of Availability.

Question 19

19. Which of the following is not an example of a physical security control?a. Dogsb. Fencingc. Biometric authenticationd. Badge IDs

Answer 19

C: Biometric authentication is an example of a technical/logical security control.

Question 20

20. Which of the following is not an example of a valid activity of security management?a. Evaluating the loss of productivity due to restrictions imposed by the security solutionb. Manage user complaints of access restrictions or resource unavailability, by fine tuning least privilege accessc. Proposing to senior management the alteration or rescinding of a security policyd. Deploy a new security control in a mission critical environment

Answer 20

D: It is not a good security management practice to implement new security controls, especially in mission critical environments, before that control has been thoroughly tested.

Question 21

21. Which of the following is an example of a technical security control?a. proceduresb. awareness trainingc. perimeter lightingd. encryption

Answer 21

D: Encryption is an example of a technical/logical security control.

Question 22

22. Which of the following is not an example of a technical security control?a. Fire detection and suppressionb. Access control matrixc. Authorizationd. Traffic filtering

Answer 22

A: Fire detection and suppression is an example of a physical security control.

Question 23

23. Which of the following is an example of a physical security control?a. Rules based access controlsb. CCTVc. Exit interviewsd. Traffic tunneling

Answer 23

B: CCTV is an example of a physical security control.

Question 24

24. Which of the following is an example of a security control that focuses on maintaining availability?a. Encrypted transport of datab. Quick recovery from faultsc. Fixed packet length transmissionsd. User awareness training

Answer 24

B: Quick recovery from faults is an example of a security control that focuses on maintaining availability.

Question 25

25. Which of the following is not an example of a security control that focuses on maintaining availability?a. clustered machinesb. avoiding single points of failurec. implementing need to know access controlsd. controlling the environmental characteristics

Answer 25

C: Implementing need to know access controls is an example of a security control that focuses on maintaining confidentiality.

Question 26

26. What is a vulnerability?a. The likelihood that a system will experience a security breachb. instance of being exposed to losses from a threat agentc. A potential danger to information or systemsd. The absence or weakness of a safeguard that could be exploited

Answer 26

D: A vulnerability is the absence or weakness of a safeguard that could be exploited.

Question 27

27. Which of the following is not an example of a security control that focuses on maintaining confidentialitya. Data encryptionb. access controlc. change restrictionsd. personnel training

Answer 27

C: Change restrictions is an example of a security control that focuses on maintaining integrity.

Question 28

28. Which of the following is an example of a security control that focuses on maintaining integrity?a. Network monitoringb. Denial of service attack protectionc. data classificationd. Encryption of data in transit

Answer 28

D: Encryption of data in transit is an example of a security control that focuses on maintaining integrity.

Question 29

29. Which of the following is not an example of a security control that focuses on maintaining integrity?a. Network monitoringb. Managing alterations to data in a databasec. Validating input datad. Message Digest

Answer 29

A: Network monitoring is an example of a security control that focuses on maintaining availability.

Question 30

30. For a security policy to be effective and comprehensive, it must thoroughly address the three fundamental principles of security, which are?a. Confidentiality, Integrity, Availabilityb. Confinement, Integrity, Accessibilityc. Corroboration, Interrogation, Authorizationd. Continuity, Intelligence, Authentication

Answer 30

A: The three fundamental principles of security are Confidentiality, Integrity, and Availability.

Question 31

31. Which of the following is an example of a security control that focuses on maintaining confidentiality?a. controlled interface to access datab. network traffic paddingc. input validity verificationd. backups

Answer 31

B: Network traffic padding is an example of a security control that focuses on maintaining confidentiality.

Question 32

32. Which of the following is not an example of a risk?a. Failing to review audit logsb. Failing to enforce password policyc. Not updating anti-virus softwared. Not filtering traffic on border communication links

Answer 32

A: Failing to review audit logs is not a risk, but it does show a lack of compliance with a realistic security policy. Audit logs will often reveal when a risk has become an actual intrusion or attack.

Question 33

33. Which of the following is not a method by which risk is reduced or eliminated?a. Applying a safeguardb. Waitingc. Removing the vulnerabilityd. Blocking the threat agent

Answer 33

B: Waiting is not a valid response to risk and waiting will not reduce risk.

Question 34

34. An instance of being exposed to losses from a threat is known as?a. Vulnerabilityb. Single loss expectancyc. Exposured. Breach

Answer 34

C: Exposure is an instance of being exposed to losses from a threat.

Question 35

35. Which of the following is not an example of a vulnerability?a. Assigning all users access based on job descriptionsb. Modems on clientsc. Open portsd. Access to the server room

Answer 35

A: Assigning all users access based on job descriptions is a valid form of security control, however it is not an example of a vulnerability.

Question 36

36. Which of the following is an example of a vulnerability?a. Restricting access to authorized usersb. Failing to enforce the password policyc. Filtering traffic at all communication bordersd. Implementing physical access restrictions

Answer 36

B: Failing to enforce the password policy is an example of a vulnerability.

Question 37

37. Which of the following is not an example of a threat?a. Intruder access through a firewallb. Activities that violate the security policyc. A biometric device failing to authenticate a valid userd. A natural disaster that destroys the IT infrastructure

Answer 37

C: A biometric device failing to authenticate a valid user is a False Rejection (Type I) error, but it is not a threat.

Question 38

38. Which of the following is an example of a threat?a. Blocking all attachments at the e-mail gatewayb. Scanning for malicious codec. Performing vulnerability assessment without senior management approvald. A user destroying confidential data

Answer 38

D: A user destroying confidential data is an example of a threat.

Question 39

39. Which of the following is not true regarding an operational security plan?a. includes an approved software listb. integrates the elements of other plansc. defines short term tasks necessary to the accomplishing of objectivesd. prescribes a logical sequence of initiatives

Answer 39

A: A system specific plan includes an approved software list.

Question 40

40. The purpose of a safeguard is to?a. Remove a threat agentb. Enhance an exposurec. Update a security policyd. Reduce or remove a vulnerability

Answer 40

D: A safeguard’s purpose is to reduce or remove a vulnerability.

Question 41

41. Which of the following is not an example of a safeguard?a. Relaxing the filters on a firewallb. Imposing strong password managementc. Deploying security guardsd. Enable BIOS passwords

Answer 41

A: Relaxing the filters on a firewall is the removal of a safeguard.

Question 42

42. The top down approach to security management provides for all but which of the following?a. provides for policy initiation, support, and directionb. provides for assignment of responsibility to down-level administratorsc. provides for development and implementation of standards, guidelines, and proceduresd. provides for development of security control configurations

Answer 42

B: The top down approach to security management does not provide for the assignment of responsibility to down-level administrators. Senior management is always ultimately responsible for the success or failure of the security policy and resulting security solution.

Question 43

43. Which of the following is not an example of a risk?a. Human errorb. Equipment malfunctionc. Replacing human security guards with dogsd. Disgruntled insider

Answer 43

C: Replacing human security guards with dogs is a change in a security access control, it is not an example of a risk.

Question 44

44. Risk is the ______________ of something happening that will damage assetsa. certaintyb. evaluationc. preventiond. possibility

Answer 44

D: Risk is the possibility of something happening that will damage assets.

Question 45

45. When will risk be totally eliminated?a. When the organization ceases to existb. When the security policy is properly implementedc. When all systems are powered downd. When all users have completed security awareness training

Answer 45

A: Risk will be totally eliminated only when the organization ceases to exist.

Question 46

46. Which of the following represent the primary security factors that a private sector organization is concerned about?a. data confidentiality and integrityb. data availability and integrityc. data non-repudiation and encryptiond. data availability and confidentiality

Answer 46

B: Private sector organizations are primarily concerned about data availability and integrity.

Question 47

47. The most important aspect of security to military organizations is?a. integrityb. non-repudiationc. confidentialityd. availability

Answer 47

C: Confidentiality is the most important aspect of security to military organizations.

Question 48

48. What is the primary goal of risk management?a. Remove all riskb. Perform a qualitative analysis of riskc. Remove liability from senior managementd. Reduce risk to an acceptable level

Answer 48

D: The primary goal of risk management is to reduce risk to an acceptable level.

Question 49

49. An effective safeguard, when evaluated via risk analysis, should?a. cost less than the loss possible via the riskb. offer a complete solution for an individual specified riskc. be invisible to the userd. allow itself to be removed easily

Answer 49

A: An effective safeguard from a risk analysis perspective is that the safeguard should cost less than the cost of the loss due to the risk.

Question 50

50. All but which of the following apply to senior management in relation to risk analysis?a. Directs and supports risk analysisb. Is a member of the Risk Assessment teamc. Acts appropriately upon the resultsd. Reviews the outcome of the analysis

Answer 50

B: The Risk Assessment Team should be comprised of a representative from most or all departments, not necessarily senior management.

Question 51

51. The first step in risk analysis is?a. countermeasure Selectionb. cost/benefit analysisc. asset valuationd. qualitative analysis of risk

Answer 51

C: Asset valuation is the first step in risk analysis. If assets have no value, there is no need to protect them.

Question 52

52. Risk management attempts to reduce risk to an acceptable level by performing all but which of the following activities?a. Track down intruders for prosecutionb. Analyze the probability of attack occurrencec. Predict the impact of a breachd. Evaluate safeguards

Answer 52

A: Tracking down intruders for prosecution is not function or element of risk management, it is possibly a factor in intrusion detection.

Question 53

53. Which of the following is not an example of a risk?a. physical damageb. blocking portsc. misuse of data d. buffer overflow

Answer 53

B: Blocking ports is a safeguard, not a risk.

Question 54

54. The value of an asset helps to determine?a. length of time committed to performing qualitative analysisb. whether or not to perform a quantitative analysisc. whether a logical or a technical control is evaluatedd. the relative strength and cost of the safeguard

Answer 54

D: The value of an asset helps to determine the relative strength and cost of the safeguard selected to protect it.

Question 55

55. Which of the following is not considered an element in determining the cost of an asset?a. cost to train personnel to employb. cost to developc. cost to acquired. cost to maintain

Answer 55

A: The cost to train personnel to employ is not as relevant as the costs to develop, acquire, and maintain an asset when determining the cost of an asset. Training costs are often difficult to quantify since training on any specific asset is typically grouped in training regarding overall IT interaction. While this answer is technically correct, it is the least correct answer of those offered.

Question 56

56. Which of the following is not considered an element in determining the cost of an asset?a. cost to protectb. cost in MB in hard drive storage requirementsc. value to owners and usersd. value to competitors

Answer 56

B: The cost in actual MB size is not as relevant as the cost for overall storage and maintenance in the determination of the cost of an asset. While this answer is technically correct, it is the least correct answer of those offered.

Question 57

57. The purpose of risk management is?a. safeguard evaluationb. risk mitigationc. loss estimationd. remove all risk

Answer 57

B: The purpose of risk management is risk mitigation. However, even in the most successful implementation, there is always some level of risk.

Question 58

58. Risk analysis is used to determine whether safeguards are all but which of the following?a. cost effectiveb. relevantc. exhaustived. timely

Answer 58

C: No safeguard is exhaustive of all risks.

Question 59

59. The objectives of risk analysis include all but which of the following?a. identify riskb. quantify the impact of each riskc. evaluate the cost effectiveness of safeguardsd. select countermeasures to implement

Answer 59

D: Risk analysis is used to compare safeguards, but it does not select the countermeasure to implement. Countermeasure Selection is left to the decision makers, i.e. senior management or their delegated administrators.

Question 60

60. An exposure factor is?a. the amount of loss that would be incurred due to the compromise of an assetb. the instance of being exposed to losses from a threat agent.c. percentage of loss that a realized threat event would cause against a specific assetd. the likelihood that a system will experience a security breach

Answer 60

C: An exposure factor is the percentage of loss that a realized threat event would cause against a specific asset.

Question 61

61. The annualized loss expectancy can be calculated using which of the following equations?a. exposure factor x annualized rate of occurrenceb. asset value x exposure factorc. asset value x risk probability x safeguard benefitd. asset value x exposure factor x annualized rate of occurrence

Answer 61

D: The annualized loss expectancy can be calculated using asset value x exposure factor x annualized rate of occurrence. It can also be calculated using single loss expectancy x annualized rate of occurrence.

Question 62

62. Which of the following is not considered an element in determining the cost of an asset?a. cost to replaceb. cost in productivity if asset is unavailablec. the file formats used by the assetd. liability if asset is compromised

Answer 62

C: The file formats used by the asset are typically not an element in determining the cost of an asset.

Question 63

63. Determining the value of an asset can be useful in all but which of the following requirements or activities?a. cost/benefit analysis of safeguardsb. determining the exposure to a threatc. insurance inventoryd. assigning classifications

Answer 63

B: Asset valuation is useful in assigning classifications. Cost/Benefit analysis can determine which safeguards to select. How much insurance to get to cover a particular asset. Exposure to a threat would not be determined by asset value.

Question 64

64. A quantitative risk analysis approach employs which of the following?a. A specific dollar value is assigned to each riskb. Opinions about risks are collected from various departmentsc. Scenarios are used to evaluate safeguardsd. Guesswork

Answer 64

A: A quantitative risk analysis approach employs specific dollar values assigned to each risk.

Question 65

65. Which of the following is not true?a. Quantitative analysis assigns real numbers and concrete probability percentages.b. A purely quantitative risk analysis is possible.c. Quantitative analysis can be automated.d. Qualitative analysis involves significantly less time and effort than a quantitative approach.

Answer 65

B: A purely quantitative risk analysis is not possible, since it is not possible to quantify all qualitative items.

Question 66

66. What form of qualitative risk analysis employs a group of people who reach a consensus through an anonymous means of voting and exchanging ideas?a. Delphi techniqueb. brainstormingc. storyboardingd. surveys

Answer 66

A: The Delphi technique is a form of qualitative risk analysis that employs a group of people who reach a consensus through an anonymous means of voting and exchanging ideas.

Question 67

67. Which of the following is not a method used in qualitative risk analysis?a. focus groupb. automated softwarec. one-on-one meetingd. checklist

Answer 67

B: Quantitative, not qualitative, risk analysis can be automated with software.

Question 68

68. The value of a safeguard to an organization can be calculated using a formula which includes all but which of the following factors?a. Annual loss expectancy before safeguardb. Annual loss expectancy after implementing the safeguardc. Residual riskd. Annual cost of safeguard

Answer 68

C: Residual risk is not used in the formula for calculating the value of a safeguard, instead it is the calculation of risk remaining after safeguards are implemented.

Question 69

69. What element in a formalized security infrastructure consists of documents that are compulsory in nature?a. Recommendationsb. Guidelinesc. Standardsd. Policies

Answer 69

C: Standards are primarily compulsory in nature.

Question 70

70. Which of the following describes the practice of a formalized security infrastructure?a. Defines recommended actionsb. Used when specific standards do not applyc. Serves as operational guides for IT staffd. Details step-by-step activities

Answer 70

D: Procedures detail step-by-step activities, not guidelines.

Question 71

71. If _____________________________________, managers can be held liable for negligence and held accountable for asset losses.a. a company does not practice due care and due diligenceb. a company properly implements a security policyc. a senior manager does not sign off on a change to the security policyd. an analysis team does not update the business continuity plan

Answer 71

A: If a company does not practice due care and due diligence, managers can be held liable for negligence and held accountable for asset losses.

Question 72

72. Which of the following is not an accepted response to the results of risk analysis?a. Reduceb. Rejectc. Assignd. Accept

Answer 72

B: Rejecting risk is not an accepted response to the results of risk analysis.

Question 73

73. Which response to risk can be implemented by purchasing insurance against loss?a. Reduceb. Rejectc. Assignd. Accept

Answer 73

C: Assigning risk can be implemented by purchasing insurance against loss

Question 74

74. Which of the following is not a valid example of assigning risk?a. purchasing insuranceb. implementing a service level agreement with a vendorc. crafting a disaster recovery pland. delegating responsibility for security policy implementation

Answer 74

D: Delegating security policy implementation responsibilities is not a valid example of assigning risk. Risk remains the responsibility of senior management, it cannot be delegated.

Question 75

75. What security mechanism is primarily responsible for implementing security controls that protect data in the most cost-effective manner?a. need to knowb. data classificationc. traffic filteringd. intrusion detection

Answer 75

B: Data classification is the security mechanism that is primarily responsible for implementing security controls that protect data in the most cost-effective manner.

Question 76

76. Which of the following is not one of the five standard data classifications used by the military?a. Confidentialb. Secretc. Privated. Sensitive

Answer 76

C: Private is a data classification used by the private sector (i.e. corporate business), not the military.

Question 77

77. What level of private sector data classification represents assets that if disclosed will not cause an adverse impact?a. Confidentialb. Privatec. Sensitived. Public

Answer 77

D: The public data classification represents assets that if disclosed will not cause an adverse impact.

Question 78

78. What is the difference between total risk and residual risk?a. one can be completely eliminatedb. neither one can be managed with safeguardsc. neither is directly quantifiable d. one is calculated by knowing the controls gap

Answer 78

D: Residual risk is what remains after selected safeguards are applied (i.e. controls gap). Residual risk = total risk - controls gap.

Question 79

79. Acceptable risk is?a. The amount of risk an organization is willing to shoulderb. Residual riskc. Any risk that cannot be addressed by safeguardsd. All risks that have an exposure factor of less than 10%

Answer 79

A: Acceptable risk is the amount of risk an organization is willing to shoulder.

Question 80

80. What form of security policy outlines the laws and industry restrictions placed upon an organization?a. Advisoryb. Regulatoryc. Informatived. Organizational

Answer 80

B: Regulatory security policies outline the laws and industry restrictions placed upon an organization.

Question 81

81. A vulnerability is?a. A potential danger to a systemb. The likelihood of an attackc. The absence of a safeguard d. An instance of being exposed to loss

Answer 81

C: The absence of a safeguard is a vulnerability.

Question 82

82. Which of the following is not a vulnerability?a. Unrestricted dial-in modemsb. Open portsc. Absence of a password policyd. Human error

Answer 82

D: Human error is a threat not a vulnerability

Question 83

83. Which of the following is not a threat?a. An intruder gaining access through a firewallb. Not inspecting the fire suppression systemc. An activity that violates the security policy.d. Destruction of a data center by a natural disaster.

Answer 83

B: Not inspecting the fire suppression system is an exposure.

Question 84

84. Which of the following is a valid definition for integrity?a. Unauthorized disclosure is prevented.b. Unauthorized modification is preventedc. Resources are accessible at all times by authorized users.d. Disasters can be recovered from quickly.

Answer 84

B: Integrity can be defined by “Unauthorized modification is prevented.”

Question 85

85. Which of the following is a valid definition for availability?a. Unauthorized disclosure is prevented.b. Unauthorized modification is preventedc. Resources are accessible at all times by authorized users.d. Mistakes made by authorized personnel are prevented.

Answer 85

C: Availability can be defined by “Resources are accessible at all times by authorized users.”

Question 86

86. How can risk be reduced?a. Removing the vulnerability or removing the threat agentb. Adjusting proceduresc. Installing fake security camerasd. Logging system activity

Answer 86

A: Removing the vulnerability or removing the threat agent will reduce risk

Question 87

87. Which of the following is not used to mitigate a potential risk?a. Countermeasureb. Safeguardc. Activity loggingd. Software update or patch

Answer 87

C: Activity logging is not used to mitigate potential risk, as least not directly.

Question 88

88. Which of the following is the best definition for countermeasures and safeguards?a. Eliminates exposure through configuration changesb. Blocks intrusion attemptsc. Blocks damage by malicious coded. Reduces the risk of a threat taking advantage of a vulnerability

Answer 88

D: Reduces the risk of a threat taking advantage of a vulnerability is the best definition offered in this question for countermeasures and safeguards.

Question 89

89. Which of the following is a security control that ensures availability?a. Encrypting data.b. Blocking DoS attacksc. Checking for valid input.d. Training personnel

Answer 89

B: Blocking DoS attacks ensures availability.

Question 90

90. Which of the following is typically not considered a countermeasure or safeguard?a. A night watchmanb. Punching through a firewall for VPN connectionsc. BIOS passwordsd. OS based access controls

Answer 90

B: Punching through a firewall for VPN connections is not a safeguard or countermeasure and may introduce new vulnerabilities.

Question 91

91. Who within an organization is responsible for establishment of the foundations of security as well as ongoing support and direction?a. Security support staffb. IT departmentc. Upper or senior managementd. System administrations

Answer 91

C: Upper or senior management is responsible for establishment of the foundations of security as well as ongoing support and direction.

Question 92

92. Who within an organization is responsible for the development and management of standards, guidelines, and procedures?a. Senior managementb. Middle managementc. IT departmentd. System administrators

Answer 92

B: Middle management is responsible for the development and management of standards, guidelines, and procedures.

Question 93

93. What aspect of an asset determines whether it should be protected and to what extent that protection should extend?a. accessibility b. data typec. Valued. Accuracy

Answer 93

C: The value of asset determines its need for security.

Question 94

94. Which of the following is typically not included in the valuation of an asset?a. Cost to acquire or developb. Value to owners and usersc. Intellectual propertyd. Cost to store and serve to authorized users

Answer 94

D: The cost to store and serve an asset is not included in the value evaluation of an asset, that is considered a cost of the infrastructure.

Question 95

95. What is the primary security purpose for mandatory week long minimum yearly vacations?a. Prevent buildup of excessive vacation timeb. To prevent burnoutc. To simplify job rotationsd. To allow for auditing

Answer 95

D: Mandatory vacations are used to perform auditing.

Question 96

96. Who is responsible for assigning data classifications?a. Data custodianb. Data ownerc. Data creatord. End user

Answer 96

B: The data owner is responsible for assigning data classification.

Question 97

97. Which of the following is not a goal of risk analysis?a. Expand security awareness training.b. Identify all possible risks to an environmentc. Quantify the impact or cost of potential threatsd. Provide a cost/benefit analysis of countermeasures and safeguards

Answer 97

A: Expanding security awareness training is not a goal of risk analysis.

Question 98

98. Guidelines serve all but which of the following purposes within an organization’s formalized security structure?a. A step-by-step implementation manualb. Introduce methodologies for handling various security issuesc. Provide recommended courses of action for security problemsd. Operational guides for the IT staff

Answer 98

A: Guidelines do not serve as step-by-step implementation manuals.

Question 99

99. A ________________ is a document that includes general statements about the overall state of security for an organization. Senior management creates this document.a. Procedureb. Guideline c. Standard d. Policy

Answer 99

D: A policy is a document that includes general statements about the overall state of security for an organization. Senior management creates this document.

Question 100

100. All but which of the following are characteristics of an effective security plan?a. Achievableb. Specificc. Inexpensived. Clearly stated

Answer 100

C: Implementing cost effective safeguards is an aspect of a security plan, but not all safeguards or security mechanisms are inexpensive. The cost is not a characteristic of an efficient security plan.

Question 101

101. What is the formula used to derive annualized loss expectancy?a. Asset value x Exposure Factor x Annualized Rate of Occurrenceb. Asset Value x Annualized Rate of Occurrencec. Asset Value x Exposure Factord. Exposure Factor x Annualized Rate of Occurrence

Answer 101

A: Asset value x Exposure Factor x Annualized Rate of Occurrence or Single Loss Expectancy x Annualized Rate of Occurrence is the formula for the Annualized Loss Expectancy.

Question 102

102. The security model employed by an organization depends upon their primary needs. What is the primary need of a government or military organization?a. Risk avoidanceb. Integrityc. Availability d. Confidentiality

Answer 102

D: Confidentiality is the primary need of government and military organizations.

Question 103

103. Baselines are used for all but which of the following within an organization’s formalized security structure.a. Establish a minimal level of security throughout the organizationb. Establish the basis for standardsc. As a starting point for security auditsd. As an operational guide for users

Answer 103

D: Baselines are not used as operational guides.

Question 104

104. Which element of a formalized security structure is positioned just above actual implementation and which defines the steps or actions required to deploy security in an organization?a. Guidelineb. Procedurec. Policyd. Standard

Answer 104

B: A procedure is positioned just above actual implementation and which defines the steps or actions required to deploy security in an organization.

Question 105

105. Which of the following statements is true?a. A purely quantitative risk analysis can be performed by the risk assessment team.b. A quantitative analysis requires the subjective input from users.c. A purely quantitative risk analysis cannot be performed since qualitative aspects cannot be quantified.d. Qualitative analysis requires specific dollar valuations of assets to be successful.

Answer 105

C: A purely quantitative risk analysis cannot be performed since qualitative aspects cannot be quantified.

Question 106

106. The greatest number of threats to the assets of an organization come from where?a. Inside the organizationb. Malicious codec. The Internetd. Hardware failures

Answer 106

A: The greatest number of threats to the assets of an organization come from inside the organization (over 85%).

Question 107

107. Which of the following is not a task that should be performed by the risk assessment/risk analysis team?a. Perform a threat analysisb. Estimate the potential for each risk to be realizedc. To implement an appropriate countermeasured. Assign values to assets

Answer 107

C: To implement an appropriate countermeasure is not a task of the risk assessment team. They are only to provide cost/analysis of countermeasures. It is the responsibility of management to select an appropriate countermeasure based on the analysis and assign the implementation procedure to the security management/administration team.

Question 108

108. Who is held liable for an organization’s failure to perform due care and due diligence?a. End usersb. IT staffc. Senior managementd. Security team

Answer 108

C: The senior management is held liable for the failure to perform due care and due diligence.

Question 109

109. What is the cardinal rule of risk analysis?a. All safeguards must be properly budgeted. b. Only safeguards with the highest rate of risk mitigation should be employed.c. Only safeguards with a high ratio of risk mitigation to cost should be implemented.d. The annual cost of safeguards should not exceed the possible annual cost of the loss of an asset.

Answer 109

D: The annual cost of safeguards should not exceed the possible annual cost of the loss of an asset is the cardinal rule of risk analysis.

Question 110

110. Which of the following risk analysis approaches assigns real numbers to the costs of asset loss and countermeasure implementation?a. Operational analysisb. Quantitative analysisc. Procedural analysisd. Qualitative analysis.

Answer 110

B: Quantitative analysis assigns real numbers to the costs of asset loss and countermeasure implementation.

Question 111

111. Which of the following military data classification levels is used to label assets that may cause serious damage to national security if that asset was disclosed?a. Top Secretb. Secretc. Unclassifiedd. Classified

Answer 111

B: Secret assets may cause serious damage to national security if that asset was disclosed.

Question 112

112. What security mechanism is often employed as the primary defense against collusion?a. Job rotationb. Separation of dutiesc. Activity loggingd. Forced vacations

Answer 112

A: Job rotation is the primary defense against collusion.

Question 113

113. In the formula for calculating residual risk, what does the controls gap element represent?a. Vulnerabilityb. Potential of risk realizationc. Countermeasures and safeguardsd. Cost of risk analysis

Answer 113

C: The controls gap represents countermeasures and safeguards.

Question 114

114. Which of the following commercial business data classification levels represents the most sensitive collection of assets?a. Confidentialb. Privatec. Sensitived. Public

Answer 114

A: The confidential classification represents the most sensitive collection of assets.

Question 115

115. Standards are used for what purpose in a formalized security structure?a. To implement industry regulationsb. To detail the overall scope and vision of security for an organizationc. To establish uniformity across an organizationd. To define the actual processes used to implement security

Answer 115

C: Standards are used to establish uniformity across an organization.

Question 116

116. Which qualitative analysis method is a group decision method that seeks a consensus while retaining the anonymity of the participants? a. Delphi techniqueb. Brainstormingc. Storyboardingd. Surveys

Answer 116

A: Delphi Technique

Question 117

117. All but which of the following statements are true in regards to security awareness training?a. Employees gain a basic understanding of the organization’s security policyb. Often helps employees obtain certificationsc. Helps reduce fraud and circumvention of security mechanisms. d. Can be performed in lectures, through newsletters, via posters, or with mouse pads.

Answer 117

B: Obtaining certifications is not a function of Security Awareness Training.

Question 118

118. What is the most important aspect of the exit interview for terminated employees?a. Reviewing non-disclosure agreementsb. Updating the job descriptionc. Returning personal propertyd. Escorted removal from the property.

Answer 118

A: The most important aspect of the exit interview is to review non-disclosure agreements.

Question 119

119. Which of the following is not a reason, benefit, or requirement to perform asset valuation?a. Reduces hosting costsb. Useful in countermeasure selectionc. Insurance coverage identificationd. Prevent due care negligence

Answer 119

A: Asset valuation does not typically improve asset hosting costs.

Question 120

120. The risk assessment team should be comprised …a. Of only managementb. Of members from every department or divisionc. Of only IT staffd. Of only volunteers

Answer 120

B: The risk assessment team should include members from every department or division. This often requires assigning or appointing team membership rather than relying on volunteers.

Question 121

121. Risk analysis is used to ensure all but which of the following?a. That security is cost effective.b. That security is relevant to the organization.c. That security completely protects an environment.d. That security is responsive to threats.

Answer 121

C: No system is 100% risk free.

Question 122

122. What is the weakest element in an organization’s security?a. Security policyb. Data classification schemesc. Security control mechanismsd. People

Answer 122

D: People are the weakest element in an organization’s security.

Question 123

123. Which of the following is true?a. All risks can be eliminated.b. All security configurations reduce risk.c. Risk reduction requires IDSd. No system can be 100% risk free.

Answer 123

D: No system can be 100% risk free.

Question 124

124. The security model employed by an organization depends upon their primary needs. What are the primary needs of a private sector business?a. Confidentiality and Integrityb. Confidentiality and Availabilityc. Integrity and Availabilityd. Access Control and Risk avoidance

Answer 124

C: The primary needs of a private sector business are integrity and availability.

Question 125

125. Which of the four possible responses to the identification and cost/benefit analysis of risk is considered an invalid response?a. Acceptb. Rejectc. Reduced. Assign

Answer 125

B: Reject is considered an invalid response.

Question 126

126. Who is responsible for protecting the confidentiality, integrity, and availability of data?a. Senior managementb. Data ownerc. Data custodiand. End user

Answer 126

C: The data custodian is responsible for protecting the confidentiality, integrity, and availability of data.

Question 127

127. What type of policy is not enforceable?a. Informativeb. Regulatoryc. Administratived. Organizational

Answer 127

A: Informative policies cannot be enforced.

Question 128

128. Identification establishes ____________.a. Authenticationb. Authorization c. None of the choicesd. Accountability

Answer 128

D: Accountability. Identification is a means to verify who you are. It enables systems to trace activities to individual users that may be held responsible for their actions.

Question 129

129. Which of the following is not a type of risk?a. Equipment failureb. Backup media verificationc. Human errord. Intrusion attempt

Answer 129

B: Backup media verification is not a type of risk, rather it is a safeguard to ensure the viability of backup restorations.

Question 130

130. How is the value of a safeguard determined?a. Its implementation costs are calculatedb. Annual Loss Expectancy before the safeguard - Annual Loss Expectancy after the safeguard - cost of implementing safeguardc. Subjective analysis by end-usersd. Risk reduction caused by the safeguard

Answer 130

B: Annual Loss Expectancy before the safeguard - Annual Loss Expectancy after the safeguard - cost of implementing safeguard is the method used to calculate the value of a safeguard.

Question 131

131. The percentage of loss of the value of an asset, which an organization would incur if a threat event was realized, is known as?a. Annualized loss expectancyb. Annualized rate of occurrencec. Single loss expectancyd. Exposure factor

Answer 131

D: The exposure factor is the percentage of loss of the value of an asset, which an organization would incur if a threat event was realized.

Question 132

132. In the realm of risk analysis, senior management is responsible for all but which of the following?a. Performing the cost/benefit analysisb. Defines the scope of the risk analysis processc. Appoints the risk assessment teamd. Acts on the results of the analysis

Answer 132

A: The risk assessment team, not senior management, is responsible for performing the cost/benefit analysis.

Question 133

133. Job rotation as a security mechanism has shown itself effective against which of the following?a. Fraudb. Data modificationc. Collusiond. Misuse of information

Answer 133

C: Job rotation is directly affective against collusion.

Question 134

134. The likelihood of a threat taking advantage of a vulnerability is known as?a. Riskb. Exposurec. Mitigationd. Attack

Answer 134

A: Risk is the likelihood of a threat taking advantage of a vulnerability.

Question 135

135. The security administration team should be responsible for all but which of the following?a. creation of a clear and efficient reporting processb. monitoring the security of an organizationc. approve the security policyd. identify the strengths and weaknesses of a security solution

Answer 135

C: Approving the security policy is the responsibility of senior management, not the security administration team.