Deck 11: Personnel and Security

Question 1

Which of the following is NOT a typical task performed by the security technician? 

A) Configure firewalls and IDPSs
B) Decvelop security policy 
C) Coordinate with systems and network administrators
D) Implement advanced security appliances

Answer 1

B

Question 2

Most hiring organizations are aware of the precise value of information security certifications because these programs have been in existence for a long time.

Answer 2

 False

Question 3

ISACA offers the CGEIT certification that is targeted at upper-level executives such as CISOs and CIOs,directors,and consultants with knowledge and experience in IT operations..____________

Answer 3

 False
governance

Question 4

A(n)credit check can uncover past criminal behavior or other information that suggests a potential for future misconduct or a vulnerability that might render a candidate susceptible to coercion or blackmail..____________

Question 5

According to Schwartz et al.,employees who create and install security solutions fall under which classification of InfoSec positions? 

A) Definers
B) Administers 
C) Builders
D) Architects

Question 6

Integrating InfoSec into the hiring process begins with reviewing and updating job descriptions to include InfoSec responsibilities.____________

Question 7

To move the InfoSec discipline forward,organizations should take all but which of the following steps? 

A) Learn more about the requirements and qualifications for InfoSec and IT positions
B) Learn more about InfoSec budgetary and personnel needs 
C) Insist all mid-level and upper-level management take introductory InfoSec courses
D) Grant the InfoSec function an appropriate level of influence and prestige

Question 8

A conspiracy or cooperation between two or more individuals or groups to commit illegal or unethical actions is known as racketeering.____________

Question 9

The SSCP certification is more applicable to the security manager than the security technician.

Question 10

InfoSec is a profession with little personnel turnover - most InfoSec professionals stay in their positions for a very long time.

Question 11

Which of the following is typically true about the CISO position? 

A) Business managers first and technologists second
B) Accountable for the day-to-day operation of all or part of the InfoSec program 
C) Frequently reports directly to the Chief Executive Officer
D) Technically qualified individual whomay configure firewalls and IDPSs

Question 12

Maintaining a secure environment requires that the information security (InfoSec)department be carefully structured and staffed with appropriately skilled and screened personnel..____________

Question 13

A technically qualified individual who may configure firewalls and IDPSs, implement security software,diagnose and troubleshoot problems,and coordinate with systems and network administrators to ensure that security technical controls are properly implemented is known as a security architect.____________

Question 14

The most common qualification for a CISO includes the CISSP and CISM certifications.

Question 15

A requirement that all employees take time off from work,which allows the organization to audit the individual's areas of responsibility is known as a mandatory vacation policy.____________

Question 16

​Temporary workers-often called temps-may not be subject to the contractual obligations or general policies that govern other employees.

Question 17

A security manager is accountable for the day-to-day operation of all or part of the InfoSec program..____________

Question 18

Which of the following InfoSec positions is responsible for the day-to-day operation of the InfoSec program? 

A) CISO
B) Security manager 
C) Security officer
D) Security technician

Question 19

CISO's should follow six key principles to shape their careers. Which of the following is NOT among those six principles? 

A) Practice business engagement
B) Deliver services 
C) Manage relationships
D) Demonstrate technical competence

Question 20

Ideally,a candidate for the CISO position should have experience in what other InfoSec position? 

A) Security officer
B) Security consultant 
C) Security technician
D) Security manager

Question 21

Which of the following is NOT among the areas covered as part of the Certified Computer Examiner (CCE)certification process? 

A) Server hardware construction and theory 
B) General computer hardware used in data collection 
C) Ethics in practice 
D) Forensics data seizure procedures

Question 22

A security ____________________ is the typical information security entry-level position.

Question 23

Ultimately,the _______________________ is the spokesperson for the security team and is responsible for the overall InfoSec program.

Question 24

In the classification of information security positions,senior people with a lot of broad knowledge,but often not a lot of depth,fall under the category of those that ____________________.

Question 25

Before hiring security personnel,which of the following should be conducted before the organization extends an offer to any candidate,regardless of job level? 

A) New hire orientation
B) Covert surveillance 
C) Organizational tour
D) Background check

Question 26

Which of the following policies requires that every employee be able to perform the work of at least one other staff member? 

A) Collusion
B) Job rotation 
C) Two-person control
D) Separation of duties

Question 27

Which of the following policies makes it difficult for an individual to violate InfoSec and is quite useful in monitoring financial affairs? 

A) Task rotation
B) Mandatory vacations 
C) Separation of duties
D) Job rotation

Question 28

Which of the following is expected of the security technician? 

A) To be expert, certified and proficient
B) To possess technical qualifications which may vary by position 
C) To possess experience with a particular hardware and/or software package
D) All of these

Question 29

Which of the following is a responsibility of an information security department manager? 

A) Offering technical information security consulting services to network administrators 
B) Running vulnerability identification software packages 
C) Preparing postmortem analyses of information security breaches 
D) Training Access Control System administrators to set up firewalls

Question 30

Which of the following is NOT a CISSP concentration? 

A) ISSAP
B) ISSTP 
C) ISSMP
D) ISSEP

Question 31

Which of the following is a responsibility of an InfoSec technician? 

A) Developing InfoSec requirements for the organization 
B) Providing hands-on technical consulting services to teams of technical specialists 
C) Establishing procedures for the identification of information assets 
D) Managing the development of InfoSec policies

Question 32

The CompTIA ____________________ certification tests an individual's security knowledge mastery and requires two years on-the-job networking experience,with emphasis on security.

Question 33

Which of the following security certifications is considered the most prestigious for security managers and CISOs? 

A) CISSP
B) GIAC 
C) SSCP
D) SCP

Question 34

Which of the following is NOT a task that must be performed if an employee is terminated? 

A) Former employee must return all media 
B) Former employee's home computer must be audited 
C) Former employee's office computer must be secured 
D) Former employee should be escorted from the premises

Question 35

Which of the following is a domain of the CISSP examination? 

A) Cryptography
B) Risk, response, and recovery 
C) Monitoring and analysis
D) Malicious code and activity

Question 36

Which certification program has certifications that require the applicant to complete a written practical assignment that tests the applicant's ability to apply skills and knowledge.

A) GIAC
B) CGEIT 
C) CRISC
D) CISA

Question 37

Temporary hires called contract employees - or simply contractors - should not be allowed to do what? 

A) Work on the premises
B) Wander freely in and out of buildings 
C) Visit the facility without specific, prior coordination
D) Compensated by the organization based on hourly rates

Question 38

It is the responsibility of a _______________________ to develop appropriate InfoSec policies,standards,guidelines,and procedures.

Question 39

Which of the following is NOT a common type of background check that may be performed on a potential employee? 

A) Identity check
B) Political activism 
C) Motor vehicle records
D) Drug history

Question 40

Which of the following policies requires that two individuals review and approve each other's work before the task is considered complete? 

A) Task rotation
B) Two-person control 
C) Separation of duties
D) Job rotation

Question 41

a. Definers
b. Builders
c. security manager
d. security technician
e. systems programmer
f. ethics officer
g. CISSPh. SSCP
i. SANSj. CCE
provide the policies,guidelines,and standards,performing conulting and risk assessment and develop technical architectures

Question 42

Describe the certifications developed by SANS. How are they different from InfoSec certifications like CISSP and SSCP?

Question 43

a. Definers
b. Builders
c. security manager
d. security technician
e. systems programmer
f. ethics officer
g. CISSPh. SSCP
i. SANSj. CCE
a technically qualified individual who may configure firewalls and IDPSs,implement security software,diagnose and troubleshoot problems,and coordinate with systemsand network administrators to ensure that security technical controls are properly implemented

Question 44

Briefly describe at least five types of background checks.

Question 45

Describe the position of security manager.

Question 46

What is the Security+ certification and who is a typical candidate for this certification?

Question 47

Briefly describe the two outprocessing methods of handling employees who leave their positions at a company.

Question 48

a. Definers
b. Builders
c. security manager
d. security technician
e. systems programmer
f. ethics officer
g. CISSPh. SSCP
i. SANSj. CCE
computer forensics certification from ISFCE

Question 49

What are the qualifications and position requirements of a typical security technician?

Question 50

a. Definers
b. Builders
c. security manager
d. security technician
e. systems programmer
f. ethics officer
g. CISSPh. SSCP
i. SANSj. CCE
a member of the general business community having an information security related role

Question 51

Briefly describe the classifications of InfoSec positions as defined by Schwartz et al.

Question 52

a. Definers
b. Builders
c. security manager
d. security technician
e. systems programmer
f. ethics officer
g. CISSPh. SSCP
i. SANSj. CCE
accountable for the day-to-day operation of all or part of the InfoSec program and assigned objectives identified by the CISO

Question 53

a. Definers
b. Builders
c. security manager
d. security technician
e. systems programmer
f. ethics officer
g. CISSPh. SSCP
i. SANSj. CCE
an ISC2 certificate that is often considered to be the most prestigious certification for security managers

Question 54

a. Definers
b. Builders
c. security manager
d. security technician
e. systems programmer
f. ethics officer
g. CISSPh. SSCP
i. SANSj. CCE
create and install security solutions

Question 55

List the six key principles that should shape the career of a CISO.

Question 56

Describe the SSCP certification. How does it compare to the CISSP?

Question 57

What are some of the common qualifications for a CISO?

Question 58

a. Definers
b. Builders
c. security manager
d. security technician
e. systems programmer
f. ethics officer
g. CISSPh. SSCP
i. SANSj. CCE
an organization  that developed a series of technical security certifications such as the GIAC

Question 59

a. Definers
b. Builders
c. security manager
d. security technician
e. systems programmer
f. ethics officer
g. CISSPh. SSCP
i. SANSj. CCE
an ISC2 certification that focuses on practices,roles,and responsibilities as defined by experts

Question 60

a. Definers
b. Builders
c. security manager
d. security technician
e. systems programmer
f. ethics officer
g. CISSPh. SSCP
i. SANSj. CCE
a member of the IT community often responsible for complex operating system programs