Deck 14: Risk Mitigation

Question 1

A policy that addresses security as it relates to human resources is known as a(n) ____ policy.

A) VPN
B) acceptable use
C) security-related human resource
D) technical

Answer 1

C

Question 2

____ are generally considered to be the most important information security policies.

A) Acceptable use policies
B) Encryption policies
C) Data loss policies
D) VPN policies

Answer 2

A

Question 3

At the heart of information security is the concept of ____.

A) threat
B) mitigation
C) risk
D) management

Answer 3

C

Question 4

____ are a person's fundamental beliefs and principles used to define what is good, right, and just.

A) Morals
B) Values
C) Ethics
D) Standards

Question 5

Most organizations follow a three-phase cycle in the development and maintenance of a security policy.

Question 6

____ can be defined as the study of what a group of people understand to be good and right behavior and how people make those judgments.

A) Values
B) Morals
C) Ethics
D) Standards

Question 7

The objective of incident response is to restore normal operations as quickly as possible with the least possible impact on either the business or the users.

Question 8

____ is the planning, coordination, communications, and planning functions that are needed in order to resolve an incident in an efficient manner.

A) Incident reporting
B) Incident management
C) Incident planning
D) Incident handling

Question 9

A(n) ____ policy is designed to produce a standardized framework for classifying information assets.

A) VPN
B) acceptable use
C) privacy
D) classification of information

Question 10

Audits serve to verify that the security protections enacted by an organization are being followed and that corrective actions can be swiftly implemented before an attacker exploits a vulnerability.

Question 11

____ may be defined as the components required to identify, analyze, and contain that incident.

A) Vulnerability response
B) Incident response
C) Risk response
D) Threat response

Question 12

Education in an enterprise is limited to the average employee.

Question 13

____ can be defined as the "framework" and functions required to enable incident response and incident handling within an organization.

A) Incident reporting
B) Incident management
C) Incident handling
D) Incident planning

Question 14

Because the impact of changes can potentially affect all users, and uncoordinated changes can result in security vulnerabilities, many organizations create a(n) ____ to oversee the changes.

A) change management team
B) incident response team
C) security control team
D) compliance team

Question 15

A ____ is a written document that states how an organization plans to protect the company's information technology assets.

A) security policy
B) guideline
C) security procedure
D) standard

Question 16

____ are values that are attributed to a system of beliefs that help the individual distinguish right from wrong.

A) Morals
B) Ethics
C) Standards
D) Morays

Question 17

A ____ is a collection of suggestions that should be implemented.

A) security policy
B) baseline
C) guideline
D) security procedure

Question 18

A(n) ____ policy outlines how the organization uses personal information it collects.

A) VPN
B) network
C) encryption
D) privacy

Question 19

A ____ is a document that outlines specific requirements or rules that must be met.

A) procedure
B) standard
C) guideline
D) policy

Question 20

A due process policy is a policy that defines the actions users may perform while accessing systems and networking equipment.

Question 21

What are the duties of the CMT?

Question 22

The Web sites that facilitate linking individuals with common interests like hobbies, religion, politics, or school contacts are called ____ sites.

A) social networking
B) social engineering
C) social management
D) social control

Question 23

Which roles should be represented on the security policy development team?

Question 24

What are the typical classification designations of government documents?

Question 25

____ learners learn through a lab environment or other hands-on approaches.

A) Visual
B) Auditory
C) Kinesthetic
D) Spatial

Question 26

____ learners tend to sit in the middle of the class and learn best through lectures and discussions.

A) Visual
B) Auditory
C) Kinesthetic
D) Spatial

Question 27

What is a general security tip for using a social networking site?

Question 28

List two characteristics of a policy.

Question 29

A(n) ____ approach is the art of helping an adult learn.

A) andragogical
B) pedagogical
C) deontological
D) metagogical

Question 30

When designing a security policy, many organizations follow a standard set of ____________________.

Question 31

____ networks are typically used for connecting devices on an ad hoc basis for file sharing of audio, video, and data, or real-time data transmission such as telephony traffic.

A) Peer
B) Client-server
C) P2P
D) Share

Question 32

List one reason why social networking sites are popular with attackers.

Question 33

List and describe two risk categories.

Question 34

A(n) ____________________ is a methodical examination and review that produces a detailed report of its findings.

Question 35

____ learners learn through taking notes, being at the front of the class, and watching presentations.

A) Kinesthetic
B) Auditory
C) Spatial
D) Visual

Question 36

____________________ seeks to approach changes systematically and provide the necessary documentation of the changes.

Question 37

A(n) ____________________ is a collection of requirements specific to the system or procedure that must be met by everyone.

Question 38

List four attributes that should be compiled for new equipment in the change management documentation.

Question 39

Most people are taught using a(n) ____________________ approach.

Question 40

Identify two opportunities for security education and training.

Question 41

Contrast the difference between a pedagogical approach versus an andragogical approach to subject matter.