Chap 1 - information & Sec environment Flashcards
The purpose of a copyright is to protect
The expression of ideas
Ethical obligations to society include
Duty to principals
An organization is developing a new product using sound project management principles. These principles should ensure that:
All changes to the project are formally reviewed and approved
The purpose of a baseline is to:
Create a standard configuration for all equipment on the network
The difference between awareness and training is:
Awareness should be provided to all staff not just IT
To whom or what should a Chief Security Officer (CSO) report according to best practices?
As high up in the organization as possible to maintain visibility for Information security and limit the inaccurate translation of messages as they move through organizational management levels.
The Organization for Economic Cooperation and Development (OECD) has generated and published a set of 8 principles for personal privacy. Which of the following is NOT one of these 8 principles?
Right to be Forgotten Principle. –> therefore, GDPR
A CISSP candidate signs his or her agreement to the ISC2 Code of Ethics statement. Which of the following would violate this Code and could cause the candidate to lose his or her certification?
Retaining customer information from previous penetration tests
All but which of the following items requires awareness for all individuals affected?
The backup mechanism used to retain email messages
Which of the following is the most important and distinctive concept in relation to layered security?
Series
Which of the following is a primary purpose of an eit interview?
To review the nondisclosure agreement
Which of the following represents accidental or intentional exploitations of vulnerabilities?
Threat events
What is the term used to describe the responsibility of a firm’s officers and directors to ensure that adequate measures are in place to minimize the effect of a disaster on the organization’s continued viability?
Due diligence
Matthew recently authored an innovative algorithm for solving a mathematical problem, and he wants to share it with the world. However, prior to publishing the software code in a technical journal, he wants to obtain some sort of intellectual property protection. Which type of protection is best suited to his needs?
Copyright
FlyAway Travel has offices in both the European Union and the United States and transfers personal information between those offices regularly. Which of the seven requirements for processing personal information states that organizations must inform individuals about how the information they collect is used?
Notice
The Notice principle says that organizations must inform individuals of the information the organization collects about individuals and how the organization will use it.
In 1991, the federal sentencing guidelines formalized a rule that requires senior executives to take personal responsibility for information security matters. What is the name of this rule?
Prudent man rule
Which one of the following control categories does not accurately describe a fence around a facility?
A. Physical –> correct
B. Detective
C. Deterrent
D. Preventive
James is conducting a risk assessment for his organization and is attempting to assign an asset value to the servers in his data centre. The organization’s primary concern is ensuring that it has sufficient funds available to rebuild the data centre in the event it is damaged or destroyed. Which one of the following asset valuation methods would be most appropriate in this situation?
Replacement cost
what is data portability
the right of data subject to move personal data from one data controller to another
what agreement in 1996 governs the import & export of crypto technology
the wassenaar arrangement
what are the key security roles (people)
- senior mgmt
- security professionals
- asset owner
- custodian
- user
- auditors
what are the basic secure design principles
- least privilege
- defense in depth
- secure default
- fail securely
- separation of duties
- keep it simple
- trust, but verify
- zero trust
- privacy by design
- shared responsibilities
what are the 8 privacy principles
- collection limitation
- data quality
- purpose specification
- use limitation
- security safeguard
- openness principles
- individual participation
- accountability
(ISC)2 code of ethics
- protect society, the common good, necessary public trust and confidence and the infrastructure
- act honorably, honestly, justly, responsibly and legally
- provide diligent and competent service to principals
- advance and protect the profession
