Quiz

Question 1

A chief information security officer (CISO) at a large organization documented a policy that establishes the acceptable use of cloud environments for all staff. This is an example of a:

Answer 1

Management/Administrative control

Question 2

Is it possible to avoid risk?

Answer 2

Yes

Question 3

What is meant by non-repudiation?

Answer 3

If a user does something, they can’t later claim that they didn’t do it.

Question 4

Which of the following is NOT one of the four typical ways of managing risk?

Answer 4

Conflate

Question 5

Siobhan is deciding whether to make a purchase online; the vendor wants Siobhan to create a new user account, and is requesting Siobhan’s full name, home address, credit card number, phone number, email address, the ability to send marketing messages to Siobhan, and permission to share this data with other vendors. Siobhan decides that the item for sale is not worth the value of Siobhan’s personal information, and decides to not make the purchase.  

What kind of risk management approach did Siobhan make?

Answer 5

Avoidance

Question 6

Guillermo is the system administrator for a midsized retail organization. Guillermo has been tasked with writing a document that describes, step-by-step, how to securely install the operating system on a new laptop. This document is an example of a ________. 

Answer 6

Procedure

Question 7

Lankesh is the security administrator for a small food-distribution company. A new law is published by the country in which Lankesh’s company operates; the law conflicts with the company’s policies. Which governance element should Lankesh’s company follow? 

Answer 7

The law

Question 8

Kristal is the security administrator for a large online service provider. Kristal learns that the company is harvesting personal data of its customers and sharing the data with local governments where the company operates, without the knowledge of the users, to allow the governments to persecute users on the basis of their political and philosophical beliefs. The published user agreement states that the company will not share personal user data with any entities without the users’ explicit permission. 

According to the (ISC)2 Code of Ethics, to whom does Kristal ultimately owe a duty in this situation?

Answer 8

The governments of the countries where the company operates 

Question 9

While taking the certification exam for this certification, you notice another candidate for the certification cheating. What should you do?

Question 10

The concept of “secrecy” is most related to which foundational aspect of security? 

Answer 10

Confidentiality