IS 4550 CHAPTER 14

Question 1

A gateway committee that approves standard technologies and architectures is called ___.

Answer 1

ARCHITECTURE REVEIW COMMITTEE

Question 2

Unauthorized sharing of sensitive company information, whether intentional or accidental is called ___.

Answer 2

DATA LEAKAGE

Question 3

A gateway committee that approves external data connections is called ___.

Answer 3

EXTERNAL CONNECTION COMMITTEE

Question 4

Committees that review technology activity and provide approvals before the project or activity can proceed to the next stage is called ___.

Answer 4

GATEWAY COMMITTEES

Question 5

The highest ranking lawyer in an organization, who usually reports to the present or CEO. He is asked to give legal opinions on various organization issues, participate in contract negotiations, and to act as a liaison with outside law firms retained by the organization is called ___.

Answer 5

GENERAL COUNSEL

Question 6

A network security device that acts as a decoy to analyze hacker activity is called ___.

Answer 6

HONEYPOT

Question 7

Any rules prescribed under the authority of a government entity; establishes legal thresholds is called ___.

Answer 7

LAWS

Question 8

A common control, such as the same ID and password, which is used across a significant population of systems, applications, and operations is called ___.

Answer 8

PERVASIVE CONTROL

Question 9

A gateway committee that approves project funding, phases, and base requirements is called ___.

Answer 9

PROJECT COMMITTEE

Question 10

Established rules of what an organization has to do to meet legal requirements is called ___.

Answer 10

REGULATIONS

Question 11

A gateway committee that approves uses of specific controls for compliance is called ___.

Answer 11

SECURITY COMPLIANCE COMMITTEE

Question 12

An individual who has extensive knowledge in a particular field is called ___.

Answer 12

SUBJECT MATTER EXPERT (SME)

Question 13

A gateway committee that approves new vendors and has oversight of existing vendors. They make sure new vendors meet minimum security policy requirements and adequate proof of security controls like a SAS 70 is called ___.

Answer 13

VENDOR GOVERNANCE COMMITTEE

Question 14

1. Which of the following is NOT an organizational gateway committee?
2. Architecture review committee
3. Internal connection committee
4. Vendor governance committee
5. Security compliance committee

Answer 14

Internal connection committee

Question 15

2. ___ often focuses on enterprise risk management across multiple lines of business to resolve strategic business issues.

Answer 15

Executive management

Question 16

3. The security compliance committee has one role, which is to identify when violations of policies occur.
   TRUE OR FALSE

Answer 16

FALSE

Question 17

4. Which of the following is NOT an access control?
5. Authentication
6. Authorization
7. Decryption
8. Logging

Answer 17

Decryption

Question 18

5. In which of the following areas might a company monitor its employers’ actions?
6. Internet
7. Email
8. Computers
9. 1 and 2
10. All the above

Answer 18

Internet
Email
Computers

Question 19

6. ___ establish how the organization achieves regulatory requirements.

Answer 19

Security policies

Question 20

7. Laws define the specific internal IT processes needed to be compliant.
   TRUE OR FALSE

Answer 20

FALSE

Question 21

8. What is NTO required in modern-day CISO positions?
9. Must rely on the organization to enforce policy
10. Needs to have strong law enforcement background
11. Needs to build relationships and consensus
12. Must influence behavior and change culture to enforce policy

Answer 21

Needs to have strong law enforcement background

Question 22

9. What is an example of a manual control?
10. Background checks
11. Authentication
12. Access rights reviews
13. 1 and 3
14. All the above

Answer 22

Background checks

Access rights reviews

Question 23

10. Which of the following is NOT a reason to monitor employee commuter activity?
11. Maintaining a productive workforce
12. Detecting when security policies are not being followed
13. Finding out whom the employee knows
14. Ensuring quality and protecting organization’s reputation

Answer 23

Finding out whom the employee knows

Question 24

11. Connecting a personal device to the company network can create legal implications.
    TRUE OR FALSE

Answer 24

TRUE

Question 25

12. Line management does which of the following to make policies operational?
13. Acts as go-to people for addressing questions
14. Applies policies consistently
15. Gathers metric on the policies’ effectiveness
16. 1 and 3
17. All the above

Answer 25

Acts as go-to people for addressing questions
Applies policies consistently
Gathers metric on the policies’ effectiveness

Question 26

13. The major challenge in implementing automated security controls is in the deployment of the control.
    TRUE OR FALSE

Answer 26

TRUE

Question 27

14. Which of the following is NOT reviewed when monitoring a user’s email and internet activity?
15. Data leakage
16. Viruses and malware
17. Unauthorized access to sites
18. Network performance

Answer 27

Network performance