Deck 5: Planning for Security

Question 1

The security framework is a more detailed version of the security blueprint.

Answer 1

False

Question 2

Information security safeguards provide two levels of control: managerial and remedial.

Answer 2

False

Question 3

Quality security programs begin and end with policy.

Answer 3

True

Question 4

The Security Area Working Group endorses ISO/IEC 17799.

Question 5

The global information security community has universally agreed with the justification for the code of practices as identified in the ISO/IEC 17799.

Question 6

NIST 800-14,The Principles for Securing Information Technology Systems,provides detailed methods for assessing,designing,and implementing controls and plans for applications of varying size.

Question 7

Each policy should contain procedures and a timetable for periodic review.

Question 8

To remain viable,security policies must have a responsible individual,a schedule of reviews,a method for making recommendations for reviews,and a policy issuance and planned revision date.

Question 9

The policy administrator is responsible for the creation,revision,distribution,and storage of the policy.

Question 10

The ISSP sets out the requirements that must be met by the information security blueprint or framework.

Question 11

A standard is a plan or course of action that conveys instructions from an organization's senior management to those who make decisions,take actions,and perform other duties.

Question 12

Failure to develop an information security system based on the organization's mission,vision,and culture guarantees the failure of the information security program.

Question 13

A managerial guidance SysSP document is created by the IT experts in a company to guide management in the implementation and configuration of technology.

Question 14

A policy should state that if employees violate a company policy or any law using company technologies,the company will protect them,and the company is liable for the employee's actions.

Question 15

ISO/IEC 17799 is more useful than any other information security management approach.

Question 16

You can create a single comprehensive ISSP document covering all information security issues.

Question 17

Many industry observers claim that ISO/IEC 17799 is not as complete as other frameworks.

Question 18

NIST Special Publication 800-18 Rev.1,The Guide for Developing Security Plans for Federal Information Systems,includes templates for major application security plans.

Question 19

Management controls address the design and implementation of the security planning process and security program management.

Question 20

ACLs are more specific to the operation of a system than rule-based policies and they may or may not deal with users directly.

Question 21

A cold site provides many of the same services and options of a hot site.

Question 22

A disaster recovery plan addresses the preparation for and recovery from a disaster,whether natural or man-made.

Question 23

The gateway router can be used as the front-line defense against attacks,as it can be configured to allow only set types of protocols to enter.

Question 24

Informational controls guide the development of education,training,and awareness programs for users,administrators,and management.

Question 25

Security training provides detailed information and hands-on instruction to employees to prepare them to perform their duties securely.

Question 26

Systems-specific security policies are formalized as written documents readily identifiable as policy._________________________

Question 27

A(n)integrated information security policy is also known as a general security policy._________________________

Question 28

NIST documents can assist in the design of a security framework._________________________

Question 29

The security blueprint is the basis for the design,selection,and implementation of all security program elements including such things as policy implementation and ongoing policy management._________________________

Question 30

Disaster recovery personnel must know their roles without supporting documentation.

Question 31

The Federal Bureau of Investigation deals with many computer crimes that are categorized as felonies.

Question 32

Every member of the organization needs a formal degree or certificate in information security.

Question 33

Some policies may also need a(n)sunset clause indicating their expiration date._________________________

Question 34

The standard should begin with a clear statement of purpose._________________________

Question 35

A(n)capability table specifies which subjects and objects users or groups can access._________________________

Question 36

The vision of an organization is a written statement of an organization's purpose._________________________

Question 37

Database shadowing only processes a duplicate in real-time data storage but does not duplicate the databases at the remote site.

Question 38

Policies are living documents that must be managed._________________________

Question 39

Laws are more detailed statements of what must be done to comply with policy._________________________

Question 40

Additional redundancy to RAID can be provided by mirroring entire servers called redundant servers or server fault tolerance.

Question 41

A firewall can be a single device or a firewall extranet,which consists of multiple firewalls creating a buffer between the outside and inside networks._________________________

Question 42

Technical controls are the tactical and technical implementations of security in the organization._________________________

Question 43

____ often function as standards or procedures to be used when configuring or maintaining systems.

A)ESSPs
B)EISPs
C)ISSPs
D)SysSPs

Question 44

The ____ is based on and directly supports the mission,vision,and direction of the organization and sets the strategic direction,scope,and tone for all security efforts.

A)ISP
B)EISP
C)GSP
D)ISSP

Question 45

A security ____ is an outline of the overall information security strategy for the organization and a roadmap for planned changes to the information security environment of the organization.

A)plan
B)framework
C)mission
D)blanket

Question 46

A(n)sequential roster is activated as the first person calls a few people on the roster,who in turn call a few other people._________________________

Question 47

SP 800-18 Rev.1,The Guide for Developing Security Plans for Federal Information Systems,must be customized to fit the particular needs of a(n)organization._________________________

Question 48

Proxy servers can temporarily store a frequently visited Web page,and thus are sometimes called demilitarized servers._________________________

Question 49

A(n)contingency plan is prepared by the organization to anticipate,react to,and recover from events that threaten the security of information and information assets in the organization,and,subsequently,to restore the organization to normal modes of business operations._________________________

Question 50

A(n)full backup only archives the files that have been modified that day,and thus requires less space and time than the differential._________________________

Question 51

Evidence is the physical object or documented information that proves an action occurred or identifies the intent of a perpetrator._________________________

Question 52

The Federal Agency Security Practices (FASP)site is a popular place to look up best practices._________________________

Question 53

Strategic planning is the process of moving the organization towards its ____.

A)standard
B)policy
C)mission
D)vision

Question 54

A service bureau is an agency that provides a service for a fee._________________________

Question 55

Standards may be published,scrutinized,and ratified by a group,as in formal or ____ standards.

A)de formale
B)de public
C)de jure
D)de facto

Question 56

Within security perimeters the organization can establish security circles._________________________

Question 57

A(n)IR plan ensures that critical business functions continue if a catastrophic incident or disaster occurs._________________________

Question 58

A(n)honeynet is usually a computing device or a specially configured computer that allows or prevents access to a defined area based on a set of rules._________________________

Question 59

Host-based IDPSs are usually installed on the machines they protect to monitor the status of various files stored on those machines._________________________

Question 60

One of the basic tenets of security architectures is the layered implementation of security,which is called defense in layers._________________________

Question 61

____-based IDPSs look at patterns of network traffic and attempt to detect unusual activity based on previous baselines.

A)Firewall
B)Host
C)Network
D)Domain

Question 62

The transfer of large batches of data to an off-site facility is called ____.

A)security perimeter
B)remote journaling
C)electronic vaulting
D)database shadowing

Question 63

The Security Area Working Group acts as an advisory board for the protocols and areas developed and promoted by the Internet Society and the ____.

A)IETF
B)ISO/IEC
C)ISOC
D)IRTF

Question 64

The spheres of ____ are the foundation of the security framework and illustrate how information is under attack from a variety of sources.

A)defense
B)assessment
C)security
D)information

Question 65

An alert ____ is a document containing contact information for the people to be notified in the event of an incident.

A)message
B)roster
C)plan
D)list

Question 66

A ____ site provides only rudimentary services and facilities.

A)cool
B)warm
C)hot
D)cold

Question 67

Incident damage ____ is the rapid determination of the scope of the breach of the confidentiality,integrity,and availability of information and information assets during or just following an incident.

A)assessment
B)evaluation
C)recovery
D)plan

Question 68

What country adopted ISO/IEC 17799?

A)United States
B)Germany
C)Japan
D)None of the above

Question 69

A buffer against outside attacks is frequently referred to as a(n)____.

A)proxy server
B)no-man's land
C)DMZ
D)firewall

Question 70

The first phase in the development of the contingency planning process is the ____.

A)BIA
B)BRP
C)DP9
D)IRP

Question 71

Redundancy can be implemented at a number of points throughout the security architecture,such as in ____.

A)firewalls
B)proxy servers
C)access controls
D)All of the above

Question 72

A(n)____ plan deals with the identification,classification,response,and recovery from an incident.

A)CM
B)BC
C)DR
D)IR

Question 73

The stated purpose of ____ is to "give recommendations for information security management for use by those who are responsible for initiating,implementing,or maintaining security in their organization."

A)NIST SP800-18
B)RFC 2196
C)ISO/IEC 27002
D)BS7799 (Part 2)

Question 74

Security ____ are the areas of trust within which users can freely communicate.

A)perimeters
B)domains
C)rectangles
D)layers

Question 75

RAID ____ drives can be hot swapped.

A)2
B)3
C)4
D)5

Question 76

Effective management includes planning and ____.

A)organizing
B)leading
C)controlling
D)All of the above

Question 77

The SETA program is the responsibility of the ____ and is a control measure designed to reduce the incidences of accidental security breaches by employees.

A)CIO
B)CISCO
C)CISO
D)end users

Question 78

SP 800-14,Generally Accepted Principles and Practices for Securing Information Technology Systems,provides best practices and security principles that can direct the security team in the development of a security ____.

A)plan
B)standard
C)policy
D)blueprint

Question 79

____ controls address personnel security,physical security,and the protection of production inputs and outputs.

A)Informational
B)Operational
C)Technical
D)Managerial

Question 80

____ controls cover security processes that are designed by strategic planners and implemented by the security administration of the organization.

A)Managerial
B)Technical
C)Operational
D)Informational