Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

IAS > ais finals lesson 2 > Flashcards

ais finals lesson 2 Flashcards

1
Q

responsible for ensuring that the IAP is developed and
implemented in accordance with regulatory and business requirements

A

Chief executive officer(CEO)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

plays a crucial role in allocating resources and fostering commitment
to the IAP

A

Chief executive officer(CEO)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

what does IAP stands for?

A

information assurance program

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

AO stands for?

A

authorizing official

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

ISO stands for?

A

Information system owner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

is responsible for the execution of overall IT program and
delegate authority to the CISO for the management of the IAP.

A

Chief information officer (CIO)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

is the
focal point for IT management and governance of IT portfolios

A

CIO

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

carries out the CIO’s security and privacy responsibilities
under FISMA and is responsible for managing the IAP

A

Chief information security officer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q
A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q
A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

FISMA stands for?

A

Federal Information Security Management Act

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

responsible for:
* Ensuring information security management processes are integrated with
strategic and operational planning processes.
* Ensuring trained personnel sufficient to assist in complying with the
information assurance requirements in related legislation, policies, directives,
instructions, standards, and guidelines.
* Coordinating with senior management to report annually to the head of the
federal agency on the overall effectiveness of IAP, including progress of
remedial actions

A

CIO

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

is responsible for:
* Developing an organization-wide IAP that provides adequate security for
all information and information systems.
* Centralized reporting of information security-related activities.
* Developing and maintaining information security and privacy policies.
* Defining specific security requirements, tools, templates, and checklists to
support the IAP.
* Ensuring that personnel with significant system security responsibilities
are adequately trained.

A

CISO

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

s appointed by the CEO and is granted the authority to formally
assume responsibility for operating an information system at an acceptable level
of risk.

A

Authorizing official

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

has budgetary oversight for an information system and is
responsible for the mission/business operations supported by the system.

A

Authorizing official

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

approve systems security plans (SSPs), memorandums of agreement or
understanding (MOA/MOU), and plans of action and milestones (POA&Ms

A

Authorizing official

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

approve systems security plans (SSPs), memorandums of agreement or
understanding (MOA/MOU), and plans of action and milestones (POA&Ms

A

Authorizing official

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

is responsible for:
* Ensuring the security posture of the Agency’s information systems is
maintained.
* Reviewing security status reports and security documents and determining if
the risk to the Agency of operating the system remains acceptable.
* Reauthorizing information systems when required.
* Assisting in response to security incidents and privacy breaches.
* Appointing, when required, a designated representative to coordinate and
carry out system security responsibilities

A

Authorizing official

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

is appointed by the CEO and serves as the focal point for the information
system and is the central point of contact during the security authorization process.

A

Information system owner (ISO)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

is responsible for:
* Coordinating data protection requirements with Information Owners (IOs) that have
information stored and processed in the system.
* Deciding, in coordination with the IO and Information System Security Officer
(ISSO), who has access to the system. Determining access privileges and rights to
the system.
* Ensuring that system users and support personnel receive the required security
training
(e.g., instruction in the Rules of Behavior).
* Ensuring that the system is compliant with the required security controls.
* Appointing an ISSO for the information system to carry out the day-to-day
security responsibilities.
* Reviewing system security documents (e.g., SSP, POA&M, etc.).
* Ensuring that system-specific security training is provided to the users and
administrators of the systems.
* Ensuring that remediation activities for the system are performed as
needed to maintain the authorization status.
* Appointing an Information System Security Manager (ISSM) to coordinate
system security task and provide oversight responsibilities to ensure security
activities are performed.

A

ISO

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

is an official with regulatory, management, or operational authority
for specified information and is responsible for establishing the policies and
procedures governing its generation, collection, processing, dissemination,
and disposal.

A

Information owner (IO)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

responsible for:
* Providing input to ISOs regarding the security requirements and controls for
the systems where the information is processed, stored, or transmitted.
* Retaining information in accordance with the National Archives and
Records Administration (NARA) record schedule.
* Categorizing the sensitivity level5 of the information stored and
processed in the system.
* Establishing rules for appropriate use and protection of the information.
* Coordinating with the ISO when security requirements change.
* Assisting in the response to security incidents.
* Ensuring that the PII inventory is updated

A

IO

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

is appointed by the ISO and works closely with the ISO or ISSM to
ensure that the appropriate security posture is maintained for the information
system.

A

information system security officer(ISSO)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

serves as a principal advisor on all the security related issues
of an information system.

A

ISSO

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

must have the detailed knowledge and
expertise required to manage the security aspects of an information system and
is responsible for the day-to-day security operations of a system

A

ISSO

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

responsible for:
* Ensuring system compliance with security policies and procedures.
* Managing and controlling changes to the system.
* Assessing the security impact of any changes.
* Monitoring the system and its environment.
* Developing and updating the SSP.
* Coordinating with and supporting the ISO with security responsibilities.
* Preparing or overseeing the preparation of system security documents7 and
security activities.
* Developing security policies and procedures that are consistent with IA policies.
* Performing or overseeing remediation activities to maintain the authorization status.
* Assisting the ISO assemble the security authorization package for submission to
the AO.
* Assisting in the investigation of security incidents.

A

ISSO

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

responsible for:
* Monitoring compliance with Federal requirement and IA policies.
* Providing guidance on the implementation of IA policies.
* Providing security and privacy training.
* Investigating system security and privacy incidents.
* Providing support for audits and reviews.
* Managing the vulnerability management program.

A

IAM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

serves as the primary liaison for the CISO to individuals with
security and privacy responsibilities and supports activities at the IAP level.

A

Information assurance manager(IAM)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

coordinates system security task and provide
oversight responsibilities to ensure security activities are performed and serves
as the liaison between the Information System Security Officer (ISSO) and the
Information System Owner (ISO)

A

information system security manager (ISSM)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

responsible for:
* Providing oversight of system security activities performed by the ISSO.
* Acting as the liaison between the IAM and the ISSO.
* Monitoring system compliance with Information Assurance policies and federal
guidance

A

ISSM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

is nominated by the Agency and assists the Contracting Officer (CO)

A

Contacting officer’s repesentative

32
Q

responsible for:
Acting as a technical liaison between the CO and the contractor.
* Providing technical assistance.
* Performing onboarding and off boarding activities for the contractors assigned to the
contract.
* Ensuring that contractors have the proper background investigations before
accessing information or systems.
* Ensuring that contractors properly maintain information and information systems in
accordance with the IAP.

A

COR

33
Q

conducts assessments of the security controls employed within
or inherited by an information system to determine the overall effectiveness
of the controls

A

security assessment team (SAT)

34
Q

responsible for:
* Developing a security assessment plan for each subset of security controls
that will be assessed.
* Submitting the security assessment plan for approval prior to conducting the
assessment.
* Conducting the assessment of security controls as defined in the
security assessment plan.
* Providing an assessment of the severity of weaknesses or deficiencies
discovered in the information system.
* Recommending corrective actions to address identified vulnerabilities.
* Preparing the final security assessment report containing the results
and findings from the assessment

A

SAT

35
Q

It is standard on boarding policy for new employees.

A

AUP

35
Q

stipulates the constraints and practices that an employee using
organizational IT assets must agree to in order to access to the corporate
network or the internet

A

acceptable use policy (AUP)

36
Q

outlines the access available to employees in regards to an
organization’s data and information systems.

A

Access control policy (ACP)

37
Q

items covered in this policy are
standards for user access, network access controls, operating system software
controls and the complexity of corporate passwords.

A

ACP

38
Q

Additional supplementary
items often outlined include methods for monitoring how corporate systems are
accessed and used; how unattended workstations should be secured; and how
access is removed when an employee leaves the organization.

A

ACP

39
Q

example that is available for fair use
can be found at this policy is?

A

SANS

40
Q

An excellent
example of this policy is available at IAPP

A

ACP

41
Q

refers to a formal process for making
changes to IT, software development and security services/operations.

A

change management policy

42
Q

The
goal of this program is to increase the awareness and
understanding of proposed changes across an organization, and to ensure
that all changes are conducted methodically to minimize any adverse impact
on services and customers

A

Change management policy

43
Q

typically high-level
policies that can cover a large number of security controls.

A

information security policy

44
Q

It is issued by the company to ensure that all employees who use information technology assets within the breadth of the organization, or its networks, comply with its stated rules and guidelines.

A

information security policy

45
Q

This
policy is designed for employees to recognize that there are rules that they will
be held accountable to with regard to the sensitivity of the corporate
information and IT assets

A

information security policy

46
Q

is an organized approach to how the company will manage an
incident and remediate the impact to operations

A

incident response policy

47
Q

It’s the one policy CISOs hope to never have to
use.

A

Incident response policy

48
Q

the goal of this policy is to describe the process of handling an incident with
respect to limiting the damage to business operations, customers and reducing recovery time and
costs.

A

incident response policy

49
Q

a document which outlines and defines acceptable methods of
remotely connecting to an organization’s internal networks.

A

remote access policy

50
Q

This policy is a requirement for organizations
that have dispersed networks with the ability to extend into insecure network locations, such as
the local coffee house or unmanaged home networks

A

remote access policy

51
Q

a document that is used to formally outline how
employees can use the business’ chosen electronic communication medium.

A

email/communication policy

52
Q

The primary
goal of this policy is to provide guidelines to employees on what is considered the
acceptable and unacceptable use of any corporate communication technology

A

email/communication policy

53
Q

generally include both cybersecurity
and IT teams’ input and will be developed as part of the larger business continuity plan

A

disaster recovery plan

54
Q

will coordinate efforts across the organization and will
use the disaster recovery plan to restore hardware, applications and data
deemed essential for business continuity

A

business continuity plan (BCP)

55
Q

are unique to each
business because they describe how the organization will operate in an
emergency

A

BCP

56
Q

it can be as broad as you want it to be from everything related to IT
security and the security of related physical assets, but enforceable in its full scope.

A

information assurance policy

57
Q

the purpose of this policy is to Create an overall approach to information security.

A

information assurance policy

58
Q

the purpose of this policy is to detect and preempt information security breaches such as misuse of networks, data,
applications, and computer systems

A

information assurance policy

59
Q

the purpose of this policy is to maintain the reputation of the organization, and uphold ethical and legal responsibilities.

A

information assurance policy

60
Q

the purpose of this policy is to respect customer rights, including how to react to inquiries and complaints about noncompliance.

A

information assurance policy

61
Q

what are the three main objective of information security?

A

confidentiality
integrity
availability

62
Q

only individuals with authorization can should access data and
information assets

A

confidentiality

63
Q

data should be intact, accurate and complete, and IT systems must be kept
operational

A

integrity

64
Q

users should be able to access information or systems when needed

A

availability

65
Q

—a senior manager may have the authority to decide
what data can be shared and with whom.

A

hierarchical pattern

66
Q

users are only able to access company networks and servers via unique logins that demand authentication, including
passwords, biometrics, ID cards, or tokens. You should monitor all systems and record all login attempts

A

network security policy

67
Q

The policy should classify data into categories, which may include “top
secret”, “secret”, “confidential” and “public”. Your objective in classifying
data is:
* To ensure that sensitive data cannot be accessed by individuals with
lower clearance levels.
* To protect highly important data, and avoid needless security
measures for unimportant data.

A

read

68
Q

systems that store personal data, or other sensitive data, must be protected according to organizational standards, best practices, industry compliance standards and relevant regulations. Most security standards require, at a minimum, encryption, a firewall, and antimalware protection

A

data protection regulations

69
Q

encrypt data backup according to industry best practices. Securely store backup media, or move backup to secure cloud storage.

A

Data back up

70
Q

only transfer data via secure protocols. Encrypt any information copied to portable devices or transmitted across a public network.

A

movement of data

71
Q

place a special emphasis on the dangers of social engineering
attacks (such as phishing emails). Make employees responsible for noticing, preventing
and reporting such attacks.

A

Social engineering

72
Q

—secure laptops with a cable lock. Shred documents that are no
longer needed. Keep printer areas clean so documents do not fall into the wrong hands.

A

clean desk policy

73
Q

9 Best Practices for Drafting Information Security Policies

A

. Information and data classification
. IT operations and administration
. Security incident response plan
SaaS and cloud policy
Acceptable use policies (AUPs)
Identity and access management (IAM) regulations
Data security policy—
Privacy regulations—
Personal and mobile devices—

74
Q
A

IAS (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions