Policies and best practices

Question 1

Which is one of the most commonly applied standards for information security?

Answer 1

ISO/IEC 27002

note - IEC = International Electrotechical Commission

Question 2

List the 4 types of networks that should be segmented

Answer 2

Industrial Control Systems (SCADA)
Medianets
Legacy Systems
Testing Labs

Question 3

What are 6 segmentation tactics?

Answer 3

Using NAT
Using ACLs on routers or firewalls
Using Honeynet/Honeypot
Using DMZ
Using VLANS
Virtualization (good for Testing labs)

Question 4

What do you implement for Layer 2 segmentation?

Answer 4

VLANs and port security

Question 5

What do you implement for Layer 3 segmentation

Answer 5

Access Control Lists on Routers or Firewalls

Question 6

Why is it a good idea to segment part of your network controlling payment card information?

Answer 6

If you don’t you have to ensure your whole network complies with PCI DSS

Question 7

BYOD initiatives can be successfully implemented by ensuring what type of security measure is used?

Answer 7

Network Access Control (Cisco) or Network Access Protection (Microsoft)

Question 8

What is the main goal of Network Access Control when someone wants to connect their personal device to the company WLAN?

Answer 8

The main goal is to allow people to connect their personal devices to the network that will not introduce a security threat by:

1) Examining the device for malware
2) Examining the device for missing security updates

Question 9

What security policies should be discussed with a new user during onboarding?

Answer 9

Password policy
BYOD policy
Acceptable Use Policy

Question 10

If a software license defines the name of the user what type of license is this?

Answer 10

Per User license aka concurrent license

Question 11

What is a per seat user license typically used for?

Answer 11

For shift working employees using the same seat and therefore not having to be in at the same time.

Question 12

To keep track of concurrent users of software, what service is employed?

Answer 12

Licensing service for centralized licensing.

Question 13

When would something be deemed an export control?

Answer 13

If it serves as a defense system, national security, foreign policy or interest of a company.

Question 14

an outbound email filter is a procedural example of what security policy?

Answer 14

Data Loss Prevention. It prevents loss of sensitive documents.

Question 15

regards to employees working remotely. defining who has access, why they have access as it pertains to their job function is an example of ‘soft’ controls for what facet of security policy?

Answer 15

Remote access policy

Question 16

What is a network policy server and what security policy does it support?

Answer 16

an NPS is the Microsoft equivalent of RADIUS and performs authentication and authorization for users connecting via VPN. It supports the remote access policy

Question 17

What software supports the BYOD policy?

Answer 17

Mobile Device Management software. For example, when employees leave, it allows a secure remote wipe of any company data on the device.

Question 18

What security policy should be developed by the organizations legal counsel, HR and IT department?

Answer 18

Acceptable Usage Policy

Question 19

What the two main goals of asset disposal?

Answer 19

1) preventing data loss

2) ethical/legal disposal of the equipment

Question 20

In what document can you find information about the safe handling of materials? Where should it be stored?

Answer 20

Materials Safety Data Sheet (MSDS).

They should be stored next to the first aid kit

Question 21

What is a Class C fire and what type of fire extinguisher is used to put them out?

Answer 21

Class C fire is electric. Class C fire extinguishers using dry chemicals like Halon

Question 22

At what temperature does damage start to occur to magnetic media?

Answer 22

100 degrees

Question 23

At what temperature does damage start occurring to computers and peripherals

Answer 23

175 degrees

Question 24

At what temperature does damage start occuring to paper products (surprising this one)

Answer 24

350 degrees

Question 25

What should you consider if you have a fail-lock door system?

Answer 25

The effect it may have during an evacuation.

Question 26

What type of fire suppressant do most companies today use?

Answer 26

Halon

Question 27

What are the two methods of content filtering?

Answer 27

1) content based filtering using heuristic rules

2) URL based

Question 28

What layer does content filtering occur at?

Answer 28

Layer 7