Deck 4: Planning for Security

Question 1

You can create a single, comprehensive ISSP document covering all information security issues.

Answer 1

True

Question 2

In 2016, NIST published a new Federal Master Cybersecurity Framework to create a mandatory framework for managing cybersecurity risk for the delivery of critical infrastructure services at every organization in the United States, based on vendor-specific technologies.

Answer 2

False

Question 3

The ISSP is a plan which sets out the requirements that must be met by the information security blueprint or framework.

Answer 3

False

Question 4

Good security programs begin and end with policy.

Question 5

The security framework is a more detailed version of the security blueprint.

Question 6

NIST 800-14's Principles for Securing Information Technology Systems can be used to make sure the needed key elements of a successful effort are factored into the design of an information security program and to produce a blueprint for an effective security architecture.

Question 7

The global information security community has universally agreed with the justification for the code of practices as identified in the ISO/IEC 17799.

Question 8

ACLs are more specific to the operation of a system than rule-based policies and they may or may not deal with users directly.

Question 9

A policy should state that if employees violate a company policy or any law using company technologies, the company will protect them, and the company is liable for the employee's actions.

Question 10

The complete details of ISO/IEC 27002 are widely available to everyone.

Question 11

Failure to develop an information security system based on the organization's mission, vision, and culture guarantees the failure of the information security program.

Question 12

A managerial guidance SysSP document is created by the IT experts in a company to guide management in the implementation and configuration of technology.

Question 13

To achieve defense in depth, an organization must establish multiple layers of security controls and safeguards.

Question 14

NIST Special Publication 800-18 Rev. 1, The Guide for Developing Security Plans for Federal Information Systems, includes templates for major application security plans, and provides detailed methods for assessing, designing, and implementing controls and plans for applications of varying size.

Question 15

The policy administrator is responsible for the creation, revision, distribution, and storage of the policy.

Question 16

Managerial controls set the direction and scope of the security process and provide detailed instructions for its conduct.

Question 17

Each policy should contain procedures and a timetable for periodic review.

Question 18

The ISO/IEC 27000 series is derived from an earlier standard, BS7799.

Question 19

To remain viable, security policies must have a responsible individual, a schedule of reviews, a method for making recommendations for reviews, and policy issuance and planned revision dates.

Question 20

A standard is a written instruction provided by management that informs employees and others in the workplace about proper behavior.

Question 21

A(n) strategic ​information security policy is also known as a general security policy, and sets the strategic
direction, scope, and tone for all security efforts._________________________

Question 22

NIST responded to a mandate and created a voluntary Risk Management Framework that provides an effective approachto manage cybersecurity risks. _________________________

Question 23

The security model is the basis for the design, selection, and implementation of all security program elements, including policy implementation and ongoing policy and program management. _________________________

Question 24

Every member of the organization's InfoSec department must have a formal degree or certification in information security.

Question 25

A disaster recovery plan shows the organization's intended efforts to restore operations at the original site in the aftermath of a disaster.

Question 26

The key components of the security perimeter include firewalls, DMZs (demilitarized zones), Web servers, and IDPSs. _________________________

Question 27

A hard drive feature known as "hot swap" is a RAID implementation (typically referred to as RAID Level 1) in which the computer records all data to twin drives simultaneously, providing a backup if the primary drive fails.

Question 28

Systems-specific security policies are organizational policies that provide detailed, targeted guidance to instruct all members of the organization in the use of a resource, such as one of its processes or technologies. _________________________

Question 29

A(n) capability table specifies which subjects and objects users or groups can access. _________________________

Question 30

Security training provides detailed information and hands-on instruction to employees to prepare them to perform their duties securely.

Question 31

A cold site provides many of the same services and options of a hot site, but at a lower cost.

Question 32

Database shadowing duplicates data in real-time data storage, but does not back up the databases at the remote site.

Question 33

The stated purpose of ISO/IEC 27002 is to offer guidelines and voluntary directions for information security management.  _________________________

Question 34

A security policy should begin with a clear statement of purpose. _________________________

Question 35

Guidelines are detailed statements of what must be done to comply with policy. _________________________

Question 36

To remain viable, security policies must have a responsible manager, a schedule of reviews, amethod for making recommendations for reviews, and a policy issuance and revision date. _________________________

Question 37

Within security perimeters the organization can establish security redundancies, each with differing levels of security, between which traffic must be screened. _________________________

Question 38

Disaster recovery personnel must know their roles without supporting documentation, which is a function of preparation, training, and rehearsal.

Question 39

The operational plan documents the organization's intended long-term direction and efforts for the next several years. _________________________

Question 40

Some policies may also need a(n) sunset clause indicating their expiration date. _________________________

Question 41

​The goals of information security governance include all but which of the following  

A) Regulatory compliance by using information security knowledge and infrastructure to support minimum standards of due care 
B) ​Strategic alignment of information security with business strategy to support organizational objectives 
C) ​Risk management by executing appropriate measures to manage and mitigate threats to information resources 
D) ​Performance measurement by measuring, monitoring, and reporting information security governance metrics to ensure that organizational objectives are achieved

Question 42

One of the basic tenets of security architectures is the layered implementation of security, which is called defense in redundancy. _________________________

Question 43

The ________is the high-level information security policy that sets the strategic direction, scope, and tone for all of an organization's security efforts.

A) SysSP
B) EISP 
C) GSP
D) ISSP

Question 44

Evidence is the physical object or documented information that proves an action occurred or identifies the intent of a perpetrator. _________________________

Question 45

A(n) disaster is any adverse event that could result in loss of an information asset or assets, but does not currently threaten the viability of the entire organization. _________________________

Question 46

A(n) differential backup only archives the files that have been modified that day, and thus requires less space and time than a full backup. _________________________

Question 47

A service bureau is an agency that provides a service for a fee. _________________________

Question 48

The recovery point objective (RPO) is the point in time prior to a disruption or system outage to which mission/business process data can be recovered after an outage. _________________________

Question 49

The stated purpose of ISO/IEC 27002 is to "offer guidelines and voluntary directions for information security __________." 

A) implementation
B) certification 
C) management
D) accreditation

Question 50

A(n) ________ plan is a plan for the organization's intended strategic efforts over the next several years.

A) standard
B) operational 
C) tactical
D) strategic

Question 51

A(n) DR plan ensures that critical business functions continue if a catastrophic incident or disaster occurs. _________________________

Question 52

An information security ________ is a specification of a model to be followed during the design, selection, and initial and ongoing implementation of all subsequent security controls, including information security policies, security education, and training.

A) plan
B) framework 
C) model
D) policy

Question 53

The process of examining an incident candidate and determining whether it constitutes an actual incident is called incident classification. _________________________

Question 54

A(n) sequential roster is activated as the first person calls a few people on the roster, who in turn call a few other people. _________________________

Question 55

When BS 7799 first came out, several countries, including the United States, Germany, and Japan, refused to adopt it, claiming that it had fundamental problems. Which of the following is NOT one of those problems  

A) The standard lacked the measurement precision associated with a technical standard. 
B) It was not as complete as other frameworks. 
C) The standard was hurriedly prepared, given the tremendous impact its adoption could have on industry information security controls. 
D) The global information security community had already defined a justification for a code of practice, such as the one identified in ISO/IEC 17799.

Question 56

A(n) alarming event is an event with negative consequences that could threaten the organization's information assets or operations.__________________

Question 57

The Computer Security Resource Center at NIST provides several useful documents free of charge in its special publications area. _________________________

Question 58

________often function as standards or procedures to be used when configuring or maintaining systems.

A) ESSPs
B) EISPs 
C) ISSPs
D) SysSPs

Question 59

Standards may be published, scrutinized, and ratified by a group, as in formal or ________ standards.

A) de formale
B) de public 
C) de jure
D) de facto

Question 60

Technical controls are the tactical and technical implementations of security in the organization. _________________________

Question 61

Redundancy can be implemented at a number of points throughout the security architecture, such as in ________.

A) firewalls
B) proxy servers 
C) access controls
D) All of the above

Question 62

_________ is the rapid determination of the scope of the breach in the confidentiality, integrity, and availability of information and information assets during or just following an incident.

A) Damage assessment
B) Containment development 
C) Incident response
D) Disaster assessment

Question 63

A fundamental difference between a BIA and risk management is that risk management focuses on identifying threats, vulnerabilities, and attacks to determine which controls can protect information, while the BIA assumes __________.

A) controls have been bypassed
B) controls have proven ineffective 
C) controls have failed
D) All of the above

Question 64

The spheres of security are the foundation of the security framework and illustrate how information is under attack from a variety of sources, with far fewer protection layers between the information and potential attackers on the __________ side of the organization.

A) technology
B) Internet 
C) people
D) operational

Question 65

The transfer of large batches of data to an off-site facility, usually through leased lines or services, is called ____.

A) off-site storage
B) remote journaling 
C) electronic vaulting
D) database shadowing

Question 66

A(n) _________ is a document containing contact information for the people to be notified in the event of an incident.

A) emergency notification system
B) alert roster 
C) phone list
D) call register

Question 67

A ____ site provides only rudimentary services and facilities.

A) commercial
B) warm 
C) hot
D) cold

Question 68

In early 2014, in response to Executive Order 13636, NIST published the Cybersecurity Framework, which intends to allow organizations to __________.

A) identify and prioritize opportunities for improvement within the context of a continuous and repeatable process 
B) assess progress toward a recommended target state 
C) communicate among local, state, and national agencies about cybersecurity risk 
D) None of these

Question 69

__________ is a strategy of using multiple types of technology that prevent the failure of one system from compromising the security of information.

A) Firewalling
B) Hosting 
C) Redundancy
D) Domaining

Question 70

The transfer of transaction data in real time to an off-site facility is called ____.

A) off-site storage
B) remote journaling 
C) electronic vaulting
D) database shadowing

Question 71

________ controls cover security processes that are designed by strategic planners and implemented by the security administration of the organization.

A) Managerial
B) Technical 
C) Operational
D) Informational

Question 72

​Security __________ are the areas of trust within which users can freely communicate.

A) ​perimeters
B) ​domains 
C) ​rectangles
D) ​layers

Question 73

_________ controls address personnel security, physical security, and the protection of production inputs and outputs.

A) ​Informational
B) Operational 
C) ​Technical
D) ​Managerial

Question 74

SP 800-14, Generally Accepted Principles and Practices for Securing Information Technology Systems, provides best practices and security principles that can direct the security team in the development of a security ________.

A) plan
B) standard 
C) policy
D) blueprint

Question 75

The ____________________ of an organization are the intermediate states obtained to achieve progress toward a goal or goals.

Question 76

The SETA program is a control measure designed to reduce the instances of __________ security breaches by employees.

A) intentional
B) external 
C) accidental
D) physical

Question 77

The CPMT conducts the BIA in three stages.  Which of the following is NOT one of those stages  

A) Determine mission/business processes and recovery criticality 
B) Identify recovery priorities for system resources 
C) Identify resource requirements 
D) All of these are BIA stages

Question 78

According to NIST SP 800-14's security principles, security should ________.

A) support the mission of the organization
B) require a comprehensive and integrated approach 
C) be cost-effective
D) All of the above

Question 79

RAID is an acronym for a __________ array of independent disk drives that stores information across multiple units to spread out data and minimize the impact of a single drive failure.

A) replicated
B) resistant 
C) random
D) redundant

Question 80

__________ is a strategy for the protection of information assets that uses multiple layers and different types of controls (managerial, operational, and technical) to provide optimal protection.

A) Networking
B) Proxy 
C) Defense in depth
D) Best-effort