IS4550 CHAPTER 5

Question 1

A STATE OF INDIFFERENCE, OR THE SUPPRESSION OF EMOTIONS SUCH AS CONCERN, EXCITEMENT, MOTIVATION AND PASSION is called ___.

Answer 1

APATHY

Question 2

An individual accountable for assess ing the design and effectiveness of security policies and may be internal or external to an organization is called ___.

Answer 2

AUDITOR

Question 3

An individual accountable for monitoring adherence to laws and regulations is called ___.

Answer 3

COMPLIANCE OFFICER

Question 4

An individual responsible for the day-to-day maintenance of data and the quality of that data. May perform backups and recover data as needed. Also grants access based on approval from the data owner is called ___.

Answer 4

DATA CUSTODIAN

Question 5

An individual who establishes procedures on how data should be handled is called ___.

Answer 5

DATA MANAGER

Question 6

An individual who approves user access rights to information that is needed to perform day-to-day operations is called ___.

Answer 6

DATA OWNER

Question 7

The end user of an application. Is accountable for handling data appropriately by understanding security policies and following approved processes and procedures is called ___.

Answer 7

DATA USER

Question 8

How various tasks are grouped into specialties to enhance the depth and quality of work product is called ___.

Answer 8

DIVISION OF LABOR

Question 9

A senior business leader accountable for approving security policy implementation, driving the security message within an organization, and ensuring that policies are given appropriate priority is called ___.

Answer 9

EXECUTIVE

Question 10

An organization with few layers separating the leaders from the bottom ranks of workers is called ___.

Answer 10

FLAT ORGANIZATIONAL STRUCTURE

Question 11

An organization with multiple layers of reporting, which separates leaders from the bottom ranks of workers is called ___.

Answer 11

HIERARCHICAL ORGANIZATIONAL STRUCTURE

Question 12

An individual accountable for identifying, developing, and implementing security policies and corresponding security controls is called ___.

Answer 12

INFORMATION SECURITY OFFICER (ISO)

Question 13

Relates to the number of areas of control achieved through the number of direct reports found in an organization is called ___.

Answer 13

SPAN OF CONTROL

Question 14

1. Which of the following is a basic element of motivation?
2. Pride
3. Self-interest
4. Success
5. 2 and 3
6. All the above

Answer 14

ALL THE ABOVE
Pride
Self-interest
Success

Question 15

2. Which personality type often breaks through barriers that previously prevent success?
3. Attackers
4. Commanders
5. Analyticals
6. Pleasers

Answer 15

Commanders

Question 16

3. Avoiders like to ___ and will do ___ but not much more.

Answer 16

Be in the background; precisely what is asked of them

Question 17

4. As the number of specialties increases so does ___.

Answer 17

The cost of business

Question 18

5. In hierarchical organizations, the leaders are close to the workers that deliver products and services.
   TRUE OR FALSE

Answer 18

FALSE

Question 19

6. User apathy often results in an employee just going through the motions.
   TRUE OR FALSE

Answer 19

TRUE

Question 20

7. Which of the following is a method for overcoming apathy?
8. Avoiding redundancy
9. Issuing company directives
10. Engaging in communication
11. Requiring obedience to policies

Answer 20

Engaging in communication

Question 21

8. Why is HR policy language often intentionally vague?

Answer 21

Vague avoids language that could be interpreted as an employment contract or unintended promise.
Vague allows managers and lawyers the flexibility to interpret and apply policies broadly.

Question 22

9. In the case of policies, it is important to demonstrate to business how policies will reduce risk and will be derived in a way that keeps costs low.
   TRUE OR FALSE

Answer 22

TRUE

Question 23

10. Interpreting security policies against new business situations and new technologies ensures the business gets the maximum benefit from the policies over time.
    TRUE OR FALSE

Answer 23

TRUE

Question 24

11. Kotter’s EightStep Change Jodel can help an organization gain support for ___ changes.

Answer 24

Security policy

Question 25

12. When a catastrophic security breach occurs, who is ultimately held accountable by regulators and the public?
13. Company officers
14. The CIO
15. The ISO
16. The data owner

Answer 25

Company officers

Question 26

13. Which of the following are attributes of entrepreneurs?
14. Innovators
15. Well educated in business management
16. More likely to take risks
17. 1 and 3
18. 2 and 3

Answer 26

1 & 3
Innovators
More likely to take risks

Question 27

14. A company can have two sets of enterprise security policies, if necessary, to address the needs of individual business units.
    TRUE OR FALSE

Answer 27

FALSE

Question 28

15. Which of the following is the best measure of success for a security policy?
16. Number of security controls developed as a result
17. The number of people aware of the policy
18. Reduction in risk
19. The rank of the highest executive who approved it

Answer 28

Reduction in risk