Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Domain 1: Information Security Governance and Risk Management > Flashcards

Domain 1: Information Security Governance and Risk Management Flashcards

1
Q

What does the acronym ALE stand for ?

A

Annual Loss Expectancy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What does Annual Loss Expectancy (ALE) mean?

A

Allows security practitioners to determine the annual cost of a loss due to risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the Annual Loss Expectancy (ALE) Formula?

A

Single Loss Expectancy (SLE) X Annual Rate of Occurrence (ARO)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What does the Annual Rate of Occurrence (ARO) mean?

A

The number of losses you suffer per year

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What does the acronym ARO stand for?

A

Annual Rate of Occurrence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What does the phrase

Exposure Factor (EF)

mean in the Annual Loss Expectancy section?

A

The Percentage of value an Asset lost due to an incident.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What does Asset Value (AV) mean?

A

The value of an asset you are trying to protect.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What does ROI stand for?

A

Return on Investment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What does the acronym EF stand for in the Annual Loss Expectancy section?

A

Exposure Factor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What does the phrase

Single Loss Expectancy (SLE)

mean in the Annual Loss Expectancy (ALE) section?

A

The cost of a single Loss.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What does the acronym

SLE

stand for?

A

Single Loss Expectancy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the

Single LossExpectancy (SLE)

Formula?

A

SLE = AV * EF

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What does the phrase

Return on Investment (ROI)

mean?

A

The amount of money saved by implementing a safguard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What component can you add to the a

Risk Calculation

to give it more meaning?

A

Add Impact to the equation: Risk = Threat * Vulnerability * Impact

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What does AV stand for in the Annual Loss Expectancy framework?

A

Asset Value

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What does

Total Cost of Ownership (TCO)

mean?

A

The total cost of a mitigated safeguard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What does the acronym

TCO

stand for?

A

Total Cost of Ownership

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is the

Single Loss Expectancy (SLE)

Formula?

A

Single Loss Expectancy (SLE) = Asset Value (AV) * Exposure Factor (EF)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Can a certification be performed by a trusted third party?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Who accepts the risk in an Accreditation?

A

The Data Owner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is a certification?

A

A detailed inspection that verifies whether a system meets the documented security requirements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

When a certification is performed by a trusted third party, are the issues identified recommendations

or

mandatory

actions?

A

Recommendations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is an Accreditation?

A

The Data Owner’s acceptance of the risk represented by the system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What are NIST’s four steps to accreditation?

A

1: Initiation Phase (Research)
2: Security Certification Phase (Assessment)
3: Security Accreditation Phase (Decision to Accept Risk)
4: Continuous Monitoring Phase (Monitor)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is an example of System Alteration in the CIA model?

A

Malcode Install

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is an example of Destruction in the CIA model?

A

DDOS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is an example of an Availability Failure in the CIA model?

A

DDOS Attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What does Integrity mean in he CIA model?

A

Protections against unauthorized and undetected alteration of information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is an example of Disclosure in the CIA model?

A

Wikileaks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is an example of a Confidentiality Failure in the CIA model?

A

Wikileaks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What does Confidentiality mean in the CIA model?

A

Protections against unauthorized disclosure of information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What does CIA stand for?

A

Confidentiality

Integrity

Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What is the Opposite of Integrity in the CIA model?

A

Alteration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What is an example of Data Alteration in the CIA model?

A

Web Page Defacement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What is the Opposite of Confidentiality in the CIA model?

A

Disclosure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What is an example of a System Integrity Failure in the CIA model?

A

Malcode Infection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What does Availability mean in the CIA model?

A

Protections against denying authorized parties access to information when needed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What is the Opposite of Availability in the CIA model?

A

Destruction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What is an example of a Data Integrity Failure in the CIA model?

A

Web Page Alteration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What does

Least Privilege

meanin the Cornerstone Concept section?

A

A user should only have the bare minimum Authorization to do his job and no more.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What does the phrase

Need to Know

mean?

A

Even if the user has the privilege to do something, it doe not mean that he needs to know it because of his job.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What is more granular?

Need to Know

or

Least Privilege?

A

Need to Know

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What does Defense in Depth mean in the Cornerstone Concepst section?

A

A Layered Defense that reduces the risk of a single point of failure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

When discussing policy, the exam will use words like Mandatory (compulsory) or Discretionary. Best Practices are usually

A

discretionary but if you decide not to follow them, you better have a good reason.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Do not confuse the Data Owner with a person who owns his own data.

A

The Data Owner is responsible for ensuring the data is protected. A user who owns his own data has read/write access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Memory Device: Quantitative –

A

Quantity – Hard Numbers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

When human life is at risk,

A

practitioners must weigh those consequences very high.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What are the three parts to teh ISC Code of Ethics?

A

Preamble: Introduction

Canons: Mandatory and Applied in order

Guidance: Advisory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Always choose the most ethical answer

A

in order of the canons.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What is Ethics?

A

Ethics is doing what is morally right

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

What are the ISC Code of Ethics Canons in order?

A

1: Protect society, the commonwealth, and the infrastructure.
2: Act honorably, honestly, justly, responsibly, and legally.
3: Provide diligent and competent service to principals.
4: Advance and Protect the profession.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

What does IAAA stand for?

A

Identity

Authentication

Authorization

Accountability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

What is an example of an Identity in the IAAA model?

A

Username

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

What is an example of Authorized Use in the IAAA model?

A

Regular users can see their own processes but cannot see the password file.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

What does Authorization mean in the IAAA model?

A

Permissions that the identity can perform an action on a system;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

What does Nonrepudiation mean?

A

Users cannot deny actions identified through Accountability procedures within the IAAA framework.

Identity is validated through Authentication transactions.

Integrity of the system is validated with Accountability (through logging and audit of transactions).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

“To Repudiate” means

A

to deny

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

What are three examples of Accountability in the IAAA model?

A

Logging

Audit

Sanctions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

What is meant by Authentication in the IAAA model?

A

The process of proving the identity claim; Ex - password

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

What is an example of an authentication (Identity Claim) response?

A

Password

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

What is Accountability in the IAAA model?

A

Ensuring that authorizations have not been violated by examining computer transactions.

60
Q

What is an Identity in the IAAA model?

A

Identitiy Is a claim of personhood or role (Rick or Admin)

61
Q

Name two things that

Standards

help with the business

A

1 - They lower the Total Cost of Ownership (TCO).

2 - They support disaster recovery.

62
Q

What is the name of the

informal rule

used to describe

**Due Care **

in the Information Security Governance section?

A

Prudent Man Rule

63
Q

In the Information Security Governance section, what are three sources for

Best Practices?

A

1: NIST
2: NSA
3: SANS

64
Q

What is a

Policy

fromt the Information Security Governance section?

A

High-level management directives.

65
Q

What is a Guideline in the Information Security Governance section?

A

A discretionary piece of useful advice; a recommendation; especially good for novice users.

65
Q

What does the word **Baselines **mean in the Information Security Governance section?

A

Discretionary but Uniform ways of implementing a safeguard.

66
Q

In the Information Security Governance section, is ignorance an acceptable excuse for non-compliance?

A

An organization must be in compliance with all laws and regulations that apply to it. Ignorance of any law is never a valid excuse for breaking it.

67
Q

What is Due Care in the Information Security Governance section?

A

Actions that a reasonable man would do.

68
Q

What does the phrase Information Security Governance mean?

A

The policies, processes and staffing approved by senior management that make up the organization’s

Information Security Program.

69
Q

What is a

Standard

in the Information Security Governance section?

A

Describes a specific and Mandatory use of a technology; usually hardware or software.

70
Q

In the Information Security Governance, If you lose some PII and

cannot demonstrate Due Care

you are

A

Grossly Negligent

71
Q

What does the phrase Gross Negligence mean in the Information Security Governance section?

A

It is the opposite of Due Care.

72
Q

What is an Issue-Specific Policy in the Information Security Governance section?

A

It is one of three policy types (Program - Issue - System) that govern security rules for a category of activity and not the overall program and not s system. Ex: Email Policy, Email Privacy Policy

73
Q

What is a

Program Policy

in the Information Security Governance section?

A

It is one of three types of policies (Program- Issue - System) that creates an organization’s computer security program.

74
Q

What are

Procedures

in the Information Security governance section?

A

Mandatory, Step-by-Step Guides for accomplishing tasks.

They are low-level and specific.

75
Q

What is the difference between a

Data Owner

vs

a Person Who Owns His Own Data

in the Information Security Governance section?

A

The Data Owner is responsible for ensuring the data is protected.

A User Who Owns His Own Data has read/write access.

77
Q

What are the

three Policy Types

from the Information Securitiy Governance section?

A

1: Program Policy
2: Issue-Specific Policy
3: System Specific Policy

77
Q

What are the five tools you can use to govern Information Security?

A

1 - Policy: High Level Mgt Directives (Mandatory)

2 -Procedures: Instructions for completing a task (Mandatory)

3 - Standard: A specific use for a technology (Mandatory)

4 - Guideline: Advice (Discretionary)

5 - Baseline A Starting point (Discretionary)

79
Q

What is a Best Practice in the Information Security Governance section?

A

It is a consensus of the best way to protect CIA (Confidentiality, Integrity, and Availability).

80
Q

What does the phrase Due Diligence mean in the Information Security Governance section?

A

It is a formal process for the management of Due Care..

80
Q

What is a good way to demonstrate

Due Care and Due Diligence

in the Information Security Governance section?

A

Following Best Practices

81
Q

What is an example of a

System-Specific Policy

A

File Server Policy, Web Server Policy

82
Q

What does Outsourcing mean?

A

Using a third party to provide IT support services which were previously performed in-house.

83
Q

What does Offshoring mean?

A

Outsourcing to another country

84
Q

What does

Privacy

mean?

A

The protection of Personally Identifiable Information (PII).

The protection of this kind of information must be assured.

85
Q

Qualitative Risk Assessment vs Quantitative Risk Analysis

A

More subjective but easier to calculate

86
Q

In a Qualitative Risk Assessment, how is a

Risk Matrix

used?

A

Uses a quadrant grid to map the likelihood

(Rare – Unlikely – Possible – Likely – Certain)

of a Risk occurring against the Impact

(Insignificant – Minor – Moderate – Major – Catastrophic).

87
Q

Which is

easier to calculate?

Qualitative Risk Analysis

or

Quantitative Risk Analysis

A

Qualitative Risk Analysis

88
Q

What is the

formula

associated with

Quantitative Risk Analysis?

A

Annual Loss Expectancy (ALE) formula

89
Q

What does the phrase

Qualitative Risk Analysis

mean?

A

Uses approximate values to calculate Risk

90
Q

What are the four benefits of using a

Risk Matrix

for

Qualitative Analysis

A

1: Distinguish between High-Likelihood/Low-Consequences and High-Consequences/Low-Likelihood risks which have the same risk rating value.
2: Graphically display risks, thus makes them easier to analyse
3: Select risks for prioritising and further actions
4: Communicate risk

91
Q

What does

Quantitative Risk Analysis

mean?

A

Uses hard numbers to calculate Risk

92
Q

Which is more

objective?

Quantitative Risk Analysis

or

Qualitative Risk Analysis

A

**Quantitative Risk Analysis **

93
Q

What is a Threat?

A

A potential harmful occurrence like earthquakes, cyber espionage, etc.

93
Q

What is a Risk?

A

A connection between a Threat and a Vulnerability.

Threat X Vulnerability

Security practitioners have assigned arbitrary values to Threats and Vulnerabilities to assess risk. Use any scale as long as you stay consistent.

96
Q

What is a Vulnerability?

A

Weaknesses in the defenses that can cause harm.

98
Q

What is the Risk formula?

A

Threat X Vulnerability

99
Q

What does Impact mean when calculating Risk?

A

An evaluation of the consequences if the Threat is realized (Somebody or something leverages the Vulnerability).

100
Q

What is the

impact

when Human life is on the line in the Risk Analysis section?

A

Impact is always very high

100
Q

What does the acronym TCO stand for in the Risk Analysis section?

A

Total Cost of Ownership

102
Q

What is an **Asset **in Risk Analysis?

A

Valuable company resources like Data, systems, people, property, IP, etc.

103
Q

In calculating Risk, do security practioners use arbitrary values or precise valuses for Threats and Vulnerabilities?

A

Arbitrary

Use any scale as long as you stay consistent.

104
Q

According to NIST, what are the

9 Steps

in the process to asses

Risk

in an organization?

A

1: System Characterization
2: Threat identification
3: Vulnerability Identification
4: Control Analysis
5: Likelihood Determination
6: Impact Analysis
7: Risk Determination
8: Control recommendations
9: Results Documentation

105
Q

What are two ways to measure Impact in the Risk Analysis section?

A

Sometimes those consequences are in terms of money lost (Cost).

Sometimes those consequences are more moral (human lives lost).

109
Q

In the Risk Analysis Framework section, What does PCI stand for?

A

Payment Card Industry.

110
Q

Who does the Payment Card Industry (PCI) framework protect?

A

Vendors who use credit cards.

111
Q

What does the acronym OCTAVE stand for in the Risk Analysis Framework section?

A

Operationally

Critical

Threat

Asset and

Vulnerability

Evaluation

112
Q

Who built OCTAVE in the Risk Analysis Frameworks section?

A

Carnegie Mellon

112
Q

What are the 11 areas that ISO 17799 focuses on in the Risk Analysis Frameworks section?

A

1: Policy
2: Organization of Information Security
3: Asset Management
4: Human Resource Security
5: Physical and Environmental Security
6: Communications and Operational Management
7: Access Control
8: Information Systems Acquisition, development and maintenance
9: Information Security Incident Management
10: Business Continuity Management
11: Compliance

113
Q

What is ISO in the Risk Analysis Frameworks

A

An International Organization for Standardization

113
Q

Why did ISO renumber ISO 17799 to **ISO 27002 **in the Risk Analysis Frameworks section?

A

Consistency

114
Q

What does ISO 27001 describe in the Risk Analysis Frameworks section?

A

a process for auditing (requirements) those best practices

115
Q

What does teh acronym COBIT stand for in the Risk Analysis Frameworks section?

A

Control

Objectives for

Information and related

Technologies

116
Q

What are the three phases in OCTAVE from the Risk Analysis Frameworks

A

1: Identify Staff knowledge, assets and Threats.
2: Identify vulnerabilities and evaluate safeguards.
3: Conduct Risk Analysis and develop risk mitigation strategy.

116
Q

What was ISO 17799 renumbered to in the Risk Analysis Frameworks section?

A

**ISO 27002 **

116
Q

What does ISO 27002 describe in the Risk Analysis Frameworks section?

A

Information Security Best Practices (techniques)

116
Q

Who built COBIT in the Risk Analysis Frameworks section?

A

The Information Systems Audit and Control Association (ISACA)

118
Q

How many phases in OCTAVE from the Risk Analysis Frameworks section?

A

3

119
Q

Who sponsors the Information Technology Infrastrucre Libray (ITIL) in the Risk Analysis Frameworks section?

A

The UK Government

120
Q

What does the acronym ITIL stand for in the Risk Analysis Frameworks section?

A

Information Technology Infrastructure Library

120
Q

What are the five service management practices in the

Information Technology Infrastructure Library (ITIL)

from the Risk Analysis Frameworks section?

A

1: Service Strategy
2: Service Design
3: Service Transition
4: Service Operations
5: Continual Service Improvement

121
Q

What are the Four Phases in the COBIT Risk Analysis Framework?

A

1: Plan and Organize
2: Acquire and Implement
3: Deliver & Support
4: Monitor& Evaluate

122
Q

How many areas does ISO 17799 focus on in the Risk Analysis Frameworks section?

A

11

125
Q

What does

Mitigate

mean in the Risk Choices section?

A

Lower the risk to an acceptable level

126
Q

What does

Transfer

mean in the Risk Choices section?

A

Insurance Model - Have somebody else assume the risk

127
Q

What are the five Risk Analysis choices?

A

Acceptance

Mitigation

Eliminate

Transfer

Avoid

128
Q

What are three examples where you cannot

Accept

the Risk in the Risk Choices section?

A

Human safety

Laws

Regulations

129
Q

What does

Acceptance

mean in the Risk Choices section?

A

The cost of doing anything else would be more expensive then the cost associated with the risk itself.

There are some cases (Human safety, Laws, Regulations) where it is not possible to accept the risk.

129
Q

What does

Eliminate

mean in the Risk Choices section?

A

Remove the risk entirely; do not allow

130
Q

What does

Avoidance

mean in the Risk Choices section?

A

If the project is too risky, don’t do it.

Compare the Annual Loss Expectancy (ALE) to the ROI after Risk Mitigation. If the ALE is higher, avoid the project.

132
Q

What is a

Data Owner

in the ROLES AND RESPONSIBILITIES section?

A

Employee responsible for ensuring that specific data is protected;

determines the sensitivity label and the frequency of backup.

He is not the custodian.

132
Q

What does the

User

in the ROLES AND RESPONSIBILITIES section?

A

They are the people that must follow the policy, procedures, and standards set by the Information Security Program in their day-to-day jobs.

133
Q

What does

Senior Management

do in the ROLES AND RESPONSIBILITIES section?

A

Creates the information security program

134
Q

What does

Security Awareness

mean?

A

Changes user behavior;

users already know how to do something and awareness might make them change how they are doing it.

134
Q

What is a

Custodian

in the ROLES AND RESPONSIBILITIES section?

A

Perform hands-on asset protection:

Backups, restoration, patching, A/V Configuration, etc.

They follow orders, they do not make policy.

136
Q

What does

Security Training

mean?

A

Provides a skill set; teaches a user how to do something.

137
Q

14: What was ISO 17799 renamed as??

A: BS 7799-0-1.
B: ISO 27000.
C: ISO 27001.
D: ISO 27002.

A

D: ISO 27002.

140
Q

10: Which of the following describes the duty of the Data Owner?

A: Patch systems.
B: Report suspicious activity.
C: Ensure their files are backed up.
D: Ensure data has proper security labels.

A

D: Ensure data has proper security labels.

141
Q

1: Which of the following would be an example of a Policy Statement?

A: Protect PII by hardening servers.
B: Harden Windows 7 by first installing the pre-hardened OS image.
C: You may create a strong password by choosing the first letter of each word in a sentence and mixing in numbers and symbols.
D: Download the CISecurity Windows benchmark and apply it.

A

A: Protect PII by hardening servers.

142
Q

11: Which control framework has 34 processes across four domains?

A: COSO.
B: COBIT.
C: ITIL.
D: OCTAVE.

A

B: COBIT.

143
Q

12: What is the difference between a standard and a guideline?

A: Standards are compulsory and guidelines are mandatory.
B: Standards are recommendations and guidelines are requirements.
C: Standards are requirements and guidelines are recommendations.
D: Standards are recommendations and guidelines are optional.

A

C: Standards are requirements and guidelines are recommendations.

144
Q

2: Which of the following describes the money saved by implementing a security control?

A: Total Cost of Ownership (TCO).
B: Asset Value (AV).
C: Return on Investment (ROI).
D: Control Savings.

A

C: Return on Investment (ROI).

145
Q

13: Which phase of OCTAVE identifies vulnerabilities and safeguards?

A: Phase 1.
B: Phase 2.
C: Phase 3.
D: Phase 4.

A

B: Phase 2.

146
Q

9: Which of the following steps would be taken while conducting a Qualitative Risk Assessment?

A: Calculate the Asset Value.
B: Calculate the return on Investment.
C: Complete the Risk Analysis Matrix.
D: Complete the ALE.

A

C: Complete the Risk Analysis Matrix.

147
Q

15: Which of the following ethical actions is the most important?

A: Act legally.
B: Protect Society.
C: Advance and Protect the profession.
D: Provide diligent service.

A

B: Protect Society.

148
Q

4: Which of the following proves an identity claim?

A: Authentication.
B: Authorization.
C: Accountability.
D: Auditing.

A

A: Authentication.

149
Q

3: Which of the following is an example of a program policy?

A: Establish the Information Security Program.
B: Email Policy.
C: Application Development Policy.
D: Server Policy.

A

A: Establish the Information Security Program.

150
Q

5: Which of the following protects against unauthorized changes to data?

A: Confidentiality.
B: Integrity.
C: Availability.
D: Alteration.

A

B: Integrity.

CISSP (6 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions