Deck 11: Security and Personnel

Question 1

Each CISSP concentration exam consists of 25 to 50 questions.

Answer 1

False

Question 2

The SSCP covers ten domains.

Answer 2

False

Question 3

Information security should be visible to the users.

Answer 3

False

Question 4

The organization should integrate the security awareness education into a new hire's ongoing job orientation and make it a part of every employee's on-the-job security training.

Question 5

The use of standard job descriptions can increase the degree of professionalism in the information security field.

Question 6

In many organizations,information security teams lacks established roles and responsibilities.

Question 7

Organizations are not required by law to protect employee information that is sensitive or personal.

Question 8

To maintain a secure facility,all contract employees should be escorted from room to room,as well as into and out of the facility.

Question 9

All of the existing certifications are fully understood by hiring organizations.

Question 10

The process of integrating information security perspectives into the hiring process begins with reviewing and updating all job descriptions.

Question 11

The position of security technician can be offered as an entry-level position.

Question 12

The general management community of interest must work with the information security professionals to integrate solid information security concepts into the personnel management practices of the organization.

Question 13

Builders operate and administrate the security tools and the security monitoring function and continuously improve the processes,performing all the day-to-day work.

Question 14

ISSEP was developed under a joint agreement between the FBI and the United States National Security Agency,Information Assurance Directorate.

Question 15

The security manager position is much more general than that of CISO.

Question 16

In most cases,organizations look for a technically qualified information security generalist who has a solid understanding of how an organization operates.

Question 17

The information security function cannot be placed within protective services.

Question 18

Security managers are accountable for the day-to-day operation of the information security program.

Question 19

The SCNA track focuses on firewalls and intrusion detection.

Question 20

In the business world,background checks determine the individual's level of security classification,a requirement for many positions.

Question 21

A study of information security positions,done by Schwartz,Erwin,Weafer,and Briney,found that positions can be classified into one of ____ areas.

A)two
B)three
C)four
D)five

Question 22

ISACA stands for Information Systems Automation and Control Association._________________________

Question 23

GIAC stands for Global Information Architecture Certification._________________________

Question 24

ISSAP stands for Information Systems Security Architecture Professional._________________________

Question 25

The information security function can be placed within the ____.

A)insurance and risk management function
B)administrative services function
C)legal department
D)All of the above

Question 26

The CISA certification is for information security management professionals._________________________

Question 27

Many information security professionals enter the field from traditional ____ assignments.

A)HR
B)BA
C)IT
D)All of the above

Question 28

____ are often involved in national security and cyber-security tasks and move from those environments into the more business-oriented world of information security.

A)Marketing managers
B)Military personnel
C)Business analysts
D)Lawyers

Question 29

Friendly departures include termination for cause,permanent downsizing,temporary lay-off,or some instances of quitting._________________________

Question 30

ISSMP stands for Information Systems Security Monitoring Professional._________________________

Question 31

The general management community of interest must plan for the proper staffing for the information security function._________________________

Question 32

Administrators provide the policies,guidelines and standards in the Schwartz,Erwin,Weafer,and Briney classification._________________________

Question 33

ISSEP stands for Information Systems Security Expert Professional._________________________

Question 34

Upper management should learn more about the budgetary needs of the information security function and the positions within it._________________________

Question 35

The model used often by large organizations places the information security department within the ____ department.

A)management
B)information technology
C)financial
D)production

Question 36

Many hiring managers in the information security field prefer to recruit a security professional who has already proven HR skills._________________________

Question 37

A mandatory furlough provides the organization with the ability to audit the work of an individual._________________________

Question 38

SCP stands for Security Certified Program._________________________

Question 39

Security managers accomplish objectives identified by the CISO and resolve issues identified by technicians._________________________

Question 40

The most common qualification for the CISO type of position is the SSCP accreditation._________________________

Question 41

The ____ examination is designed to provide CISSPs with a mechanism to demonstrate competence in the more in-depth and concentrated requirements of information security management.

A)ISSMP
B)ISSAP
C)CISSPM
D)CISSMP

Question 42

Many organizations use a(n)____ interview to remind the employee of contractual obligations,such as nondisclosure agreements,and to obtain feedback on the employee's tenure in the organization.

A)hostile
B)departure
C)exit
D)termination

Question 43

System Administration,Networking,and Security Organization is better known as ____.

A)SANO
B)SAN
C)SANS
D)SANSO

Question 44

The SSCP exam consists of ____ multiple-choice questions,and must be completed within three hours.

A)75
B)100
C)125
D)225

Question 45

In recent years,the ____ certification program has added a set of concentration exams.

A)ISSEP
B)ISSMP
C)ISSAP
D)CISSP

Question 46

____ are the technically qualified individuals tasked to configure firewalls,deploy IDSs,implement security software,diagnose and troubleshoot problems,and coordinate with systems and network administrators to ensure that an organization's security technology is properly implemented.

A)CSOs
B)CISOs
C)Security managers
D)Security technicians

Question 47

The ____ program focuses more on building trusted networks,including biometrics and PKI.

A)NFC
B)SCNP
C)PKI
D)SCNA

Question 48

CISOs are ____________________ managers first.

Question 49

The __________________________________________________ acts as the spokesperson for the information security team.

Question 50

It is important to gather employee ____________________ early about the information security program and respond to it quickly.

Question 51

Once an information security function's organizational position has been determined,the challenge is to design a(n)____________________ structure for the information security function that balances the competing needs of each of the communities of interest.

Question 52

The applicant for the CISA must provide evidence of ____ years of professional work experience in the field of information security,with a waiver or substitution of up to two years for education or previous certification.

A)five
B)eight
C)ten
D)twelve

Question 53

____ is a cornerstone in the protection of information assets and in the prevention of financial loss.

A)Fire protection
B)Business separation
C)Separation of duties
D)Collusion

Question 54

____ is the requirement that every employee be able to perform the work of another employee.

A)Two-man control
B)Collusion
C)Duty exchange
D)Task rotation

Question 55

____ are hired by the organization to serve in a temporary position or to supplement the existing workforce.

A)Temporary employees
B)Consultants
C)Contractors
D)Self-employees

Question 56

The breadth and depth covered in each of the domains makes the ____ one of the most difficult-to-attain certifications on the market.

A)NSA
B)CISO
C)CISSP
D)ISEP

Question 57

The organization should conduct a behavioral feasibility study before the ____________________ phase.

Question 58

____ are the real techies who create and install security solutions.

A)Builders
B)Administrators
C)Senior managers
D)Definers

Question 59

The ____ position is typically considered the top information security officer in the organization.

A)CISO
B)CFO
C)CTO
D)CEO

Question 60

____ was designed to recognize mastery of an international standard for information security and a common body of knowledge (sometimes called the CBK).

A)CISSP
B)ISSMP
C)SSCP
D)All of the above

Question 61

Separation of ____________________ is used to reduce the chance of an individual violating information security and breaching the confidentiality,integrity,or availability of information.

Question 62

What tasks must be performed when an employee prepares to leave an organization?

Question 63

What functions does the CISO perform?

Question 64

Job ____________________ can greatly increase the chance that an employee's misuse of the system or abuse of the information will be detected by another.

Question 65

Related to the concept of separation of duties is that of ____________________,the requirement that two individuals review and approve each other's work before the task is categorized as finished.

Question 66

The SCP certification provides three tracks: the SCNS (Security Certified Network Specialist);the SCNP (Security Certified Network Professional);and the SCNA (Security Certified Network ____________________).

Question 67

____________________ departures include resignation,retirement,promotion,or relocation.

Question 68

Employees should be provided access to the minimal amount of information for the minimal amount of time necessary for them to perform their duties.This is referred to as the principle of ____________________.

Question 69

The ____________________________________________________________ certification requires both the successful completion of the examination and an endorsement by a qualified third party,typically another CISSP-certified professional,the candidate's employer,or a licensed,certified,or commissioned professional.

Question 70

SANS developed a series of technical security certifications in 1999 that are known as the Global Information ____________________ Certification or GIAC family of certifications.

Question 71

Describe the concept of separation of duties.

Question 72

Sometimes onsite contracted employees are self-employed or are employees of an organization hired for a specific,one-time purpose.These people are typically referred to as ____________________.

Question 73

Security ____________________ are accountable for the day-to-day operation of the information security program.

Question 74

The ____________________ of (ISC)² program is geared toward those who want to take the CISSP or SSCP exams before obtaining the requisite experience for certification.

Question 75

Once a candidate has accepted a job offer,the ____________________ becomes an important security instrument.

Question 76

The Information Systems ____________________ and Control Association offers the CISA certification for auditing,networking,and security professionals.

Question 77

A(n)"____________________ agency" is an agency that provides specifically qualified individuals at the paid request of another company.

Question 78

When new employees are introduced into the organization's culture and workflow,they should receive as part of their ____________________ an extensive information security briefing.