Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

SECORG random > alla > Flashcards

alla Flashcards

1
Q

1) What is defined as ”a systematic approach for establishing, implementing, operating, monitoring, reviewing, maintaining and improving an organization’s information security to achieve business objectives”?

A

ISMS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

2) Which of the following is not one of the ”fundamental principles” that ”also contribute to the successful implementation of an ISMS”?

A

d) active prevention and detection of stakeholder deviations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

3) Information can be stored in many forms. Which forms are mentioned in ISO/IEC 27000?

A

digital, material and knowledge of the employee

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

4) Which term means ”informed decision to take a particular risk”?

A

risk acceptance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

5) The standard ISO/IEC 27003 is concerned with what?

A

It provides guidance on the requirements of ISO/IEC 27001

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

6) According to ISO/IEC 27001, the management review shall include consideration of feedback on the information security performance, including trends in what?

A

alla

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

7) Is there a requirement in ISO/IEC 27001 that the information security policy shall be available as documented information?

A

d) Yes, no matter what

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

8) What is false regarding information security controls according to ISO/IEC 27001?

A

c) It is mandatory to select at least all the controls listed in the Annex A

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

9) ISO/IEC 27001 mentions a document called a ”statement of applicability”. Why is it called that?

A

d) The document contains applicable security controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

10) Needs and expectations of interested parties may include for example:

A

legal, regularoty and contract

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

11) What is the relation between ISO/IEC 27001 and ISO/IEC 27002?

A

27001 refers to the controls in 27002

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

12) What is true regarding ”control objectives” according to ISO/IEC 27002?

A

They state what should be achieved by one or more controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

13) “Segregation of duties” is a method for reducing the risk of accidental or deliberate
misuse of an organization’s assets. What does it mean?

A

Segregated responsibilities to reduce opportunities to breach security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

14) Who is responsible for that information assets are appropriately inventoried, classified and protected?

A

asset owners

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

15) What is the point of “information classification”?

A

d) To ensure that information receives an appropriate level of protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

16) What is true in relation to “tribal governments” use of FIPS 199 security categorization scheme?

A

Tribal governments may use the scheme

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

17) FIPS 199 establishes security categories for both information and information systems. The security categories are based on the potential … ?

A

impact on an organization in case of security breach

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

18) Categorise historic public information about Swedish kings in a royal archive, in accordance with the security categorization scheme?

A

b) SC archive = {(confidentiality, NA), (integrity, HIGH), (availability, LOW)}

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

19) You have found both “contract” and “administrative” information in the same information system, categorised as SC contract information = {(confidentiality, MODERATE), (integrity, MODERATE), (availability, LOW)} and SC administrative information = {(confidentiality, LOW), (integrity, LOW), (availability, LOW)}. Categorise the information system where both information types reside to ensure proper protection?

A

a) {(confidentiality, MODERATE), (integrity, MODERATE), (availability, LOW)}.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

20) Is potential impact of a security breach on individuals considered in FIPS 199?

A

d) Yes, this is explicitly stated in the text

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

21) What is a low-impact information system according to FIPS 200?

A

CIA = alla low

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

22) In using FIPS 199 and FIPS 200, which should be done first – determination of information system impact levels or the selection of appropriate security controls?

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

23) How shall organisations meet the stated “minimum security requirements” according to FIPS 200?

A

) They shall select appropriate controls in another document

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

24) Which term in FIPS 200 means “The official management decision given by a senior agency official to authorize operation of an information system” and to explicitly accept the residual risk?

A

b) Accreditation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

25) What is a high-impact system in FIPS 200? It is an information system in which …

A

a) at least one security objective (i.e., confidentiality, integrity, or availability) is
assigned a FIPS 199 potential impact value of high

26
Q

26) According to SP 800-30, preparing for a risk assessment includes all of the following tasks, except which one?:

A

d) Identify the requirements and risks associated with the assessment

27
Q

27) SP 800-30 asks us to consider predisposing conditions. What does it mean?

A

a) Condition that contributes to the likelihood that a threat materialises

28
Q

28) “Tier 1”, “tier 2” and “tier 3” are used to signify what in SP 800-30?

A

bio

29
Q

29) Adversarial, accidental and environmental are examples of what?

A

threat sources

30
Q

30) Risk is a ”measure of the extent to which an entity is threatened by a potential circumstance or event”, and is typically a function of …. (what)?:

A

likelihood and impact

31
Q

31) What is supposed to be able to “continuously deliver its intended outcome despite adverse cyber events”, in a cyber resilience context?

A

allt (land, info system och business process)

32
Q

32) What is an “adverse cyber event”?

A

All events that negatively impact the availability, integrity or confidentiality

33
Q

33) What is the general objective of cyber resilience?

A

ensuring business delivery

34
Q

34) It is said that resilient systems should be designed to be able to fail in a controlled way, rather than being designed to solely protect against failure. What is this design feature called?

A

safe to fail

35
Q

35) Which of the following is most likely an “unintentional act of man”?

A

webben down pga failed updated

36
Q

36) Which of these terms refers to “a set of interrelated or interacting elements of an organization to establish policies and objectives and processes to achieve those objectives” is?

A

mangment system

37
Q

37) Which document makes the ISMS visible?

A

a)Policy
b) Procedures
c) Guidelines

38
Q

38) In which industry sector is the new regulation GDPR applicable?

A

alla

39
Q

39) What is the main drawback with letting information classification for a given asset completely determine the selection of information security controls?

A

d) Important factors, e.g. risks, are overlooked

40
Q

40) What does APT stand for?

A

advanced persitent threath

41
Q

41) Which of the following may be an example of an adversarial threat source?

A

insider, hacking group, competitors

42
Q

42) How can we ensure that all potentially relevant risks are analysed in our risk
assessment?

A

we can not

43
Q

43) What is one major difference between the definitions of ”risk” in ISO/IEC 27001 and NIST SP 800-30?

A

nist = negative, iso = postiv and negative

44
Q

44) In ISO/IEC 27002, chapter 10 is on “Cryptography”. It contains only two controls, one is about “key management” and the other is about (what)?

A

policy

45
Q

45) Is network security management covered in ISO/IEC 27002?

A

yes some controls

46
Q

47) The different classes in the information classification model discussed in the lectures was mainly based on what?

A

impact

47
Q

48) What is the “gap” in a “GAP-analysis”?

A

where we are now vs where we want to be

48
Q

49) Which of the following is an example of a tool that can be used for technical vulnerability analysis?

A

a)Nessus
b) Qualys (QualysGuard)
c) OpenVAS

49
Q

50) Managing information security in organisations is difficult mainly because of (what)? a)

A

people

50
Q

51) Which of the following is a potential benefit of measuring information security?

A

a) To prove progress in the work
b) Evidence of meeting requirements
c) To prove to external actors that external requirements are met

51
Q

52) What is usually the meaning of “Asset Management” in information security?

A

b) It refers to identifying and protecting information- and IT-related assets

52
Q

53) When managing information security in organisations, people should be viewed as (what)?

A

a)Being assets
b) Being potential threat sources
c) Being part of the Security controls

53
Q

54) Is the ISMS described in ISO/IEC 27001 also intended to be useful in small organisations?

A

yes

54
Q

54) Which publication, used as reference literature in the course, provides a catalog of security and privacy controls for information systems and organizations to protect organizational operations and assets, individuals, other organizations, and the Nation from a diverse

A

NIST 800-53

55
Q

55) Which federal US act (law) requires each federal agency to develop, document, and implement an agency-wide program to provide information security for information and information systems?

A

fisma

56
Q

56) Why are we interested in business objectives and business strategy when managing information security?

A

Because information security efforts need to be aligned with business objectives and strategy to support it

57
Q

57) Which publication in the ISO/IEC 27000-series does specifically address the needs and responsibilities of governing bodies, such as board or directors?

A

d) 27014

58
Q

35) A Data Protection Impact Assessment (DPIA) assesses the impact on what?

A

freedom

59
Q

38) In which industry sector is HIPAA used?

A

healthcare

60
Q

40) Which of the following do you need to take into account when selecting appropriate technical and organisational measures to protect personal data in accordance with GDPR (EU General Data Protection Regulation)?

A

allt

SECORG random (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions