Policies, Procedures, and Incident Response Flashcards
Which of the following controls requires two employees working together to complete an action? A. Two-man process B. Job rotation C. Principle of least privilege D. Dual control
D. Dual control requires two employees working together to complete a task.
As the security administrator for your organization, you have decided to restrict access to the Internet to only those who have an approved need. Which practice does this describe? A. Two-man process B. Job rotation C. Principle of least privilege D. Dual control
C. The principle of least privilege is the practice of limiting access to the minimum level that is needed for an employee or contractor to complete their work.
Your company started moving individuals in sensitive positions from one set of job tasks to another every six months. This type of control is known as which one of the following? A. Two-man process B. Job rotation C. Principle of least privilege D. Dual control
B. Job rotation is the practice of moving employees from one area to another. It provides cross-training and also makes it harder for an employee to hide their actions. In addition, it decreases the chance that an area of the company could be seriously and negatively affected if someone leaves.
A manager at your organization is interviewing potential employees and has asked you to find out some background information. Which of the following should you not research? A. Education B. References C. Marriage status D. Claimed certifications
C. Although some items are acceptable for questions, others such as race, marital status, and religious preference are not.
When is the best time to terminate an employee’s access?
A. At the time of dismissal
B. At the end of the day
C. One week after termination
D. At the beginning of the worker’s shift before dismissal
A. There are many theories about the best day of the week and time of day to terminate an employee, but whenever it is done, access needs to be restricted at the time of dismissal.
Which of the following documents is used to support an SLA? A. MOU B. OLA C. MBA D. NDA
B. OLAs work in conjunction with SLAs in that they support the SLA process. The OLA defines the responsibilities of each partner’s internal support group. So, whereas the SLA may promise no more than five minutes of downtime, the OLA defines what group and resources are used to meet the specified goal.
Your company recently changed firewalls and is now using another vendor’s product. Which document would see the most change? A. Policy B. Procedure C. Guideline D. Baseline
B. If your company changed from one firewall to another, the document that would change the most would be the procedure. Procedures offer step-by-step instructions.
Which of these documents is considered high-level and communicates the wishes of management? A. Policy B. Procedure C. Guideline D. Baseline
A. Policy is high level and communicates management’s wishes.
Which of the following groups is ultimately responsible for a security policy? A. Employees B. Managers C. CSO D. Senior management
D. Senior management is ultimately responsible. In cases of neglect, these individuals may potentially face criminal or civil charges.
In relation to the incident response process, what term best describes noticing the occurrence of a false positive trigger of an IDS? A. Trigger B. Incident C. Event D. Alarm
C. An event is described as a noticeable occurrence, whereas an incident is a violation of law, policy, or standard.
Which of the following is a forensic process best described as the actions taken to guard, control, and secure evidence? A. Locking B. Analysis C. Tracking D. Chain of custody
D. Chain of custody must be followed for evidence to be legally admissible in court. This phrase describes the documentation of the seizure, custody, control, transfer, analysis, and disposition of evidence.
Which of the following is the last step in the incident response process? A. Containment and mitigation B. Lessons learned C. Identification and evaluation D. Eradication and recovery
B. The last step of the incident response process is lessons learned. No one wants to repeat bad events, and as such, the lessons of the incident should be applied to attempt to prevent the incident from happening again.
You have been asked to work on a team responsible for a forensic analysis. Which of the following is the best order of analysis? A. RAM, hard drive, DVD B. Hard drive, thumb drive, RAM C. Hard drive, CD, DVD, RAM D. Hard drive, RAM, DVD, CD
A. During a forensic investigation, the process should always move from most volatile to least volatile. As such, the proper process would be RAM, hard drive, and DVD.
Which of the following documents best fits the description of a step-by-step guide? A. Baseline B. Policy C. Procedure D. Guideline
C. A procedure is best described as a step-by-step guide.
Which of the following audits is performed to verify the protection mechanisms provided by information systems and related systems? A. Operational audit B. Information system audit C. Security audit D. Forensic audit
B. An information security audit is performed to verify the protection mechanisms provided by information systems and related systems.
