Question 1

For policies to be effective,they must first be developed using generally-accepted practices._________________________

Accepted Answer

industry

Question 2

The EISP guides the development,implementation,and management requirements of the information security program._________________________

Accepted Answer

EISP (Enterprise Information Security Program) is a framework that guides the development, implementation, and management requirements of an organization's information security program. Therefore, the statement is true.

Question 3

To ensure due diligence an organization must demonstrate that it is continuously attempting to meet the requirements of the market in which it operates._________________________

Accepted Answer

Due diligence involves continuous efforts to monitor and meet market requirements and expectations.

Question 4

During the implementation phase of the policy development SecSDLC,the development team creating the information security policy should make sure that the policy is written at a reasonable reading level._________________________

Accepted Answer

The implementation phase of the policy development SecSDLC does include the requirement to ensure that the information security policy is written at a reasonable reading level. This is because policies that are difficult to read and understand are less likely to be followed effectively, which can undermine the effectiveness of the policy and its purpose. By ensuring that the policy is written in clear and accessible language, the development team can help to ensure that it is understandable and actionable by those who will be responsible for following it.

Question 5

A(n)capability table specifies which subjects and objects that users or groups can access._________________________

Accepted Answer

A capability table lists the capabilities (i.e., permissions) that are granted or denied to users or groups for accessing specific subjects and objects.

Question 6

A(n)blow-by screen is an organizational tool to ensure that all the appropriate information security policy messages are presented to all the appropriate audiences._________________________

Accepted Answer

coverage matrix

Question 7

The policy administrator must be identified on the policy document as the primary contact for providing additional information or suggesting revisions to the policy._________________________

Accepted Answer

According to the statement, it is true that the policy administrator must be identified as the primary contact for providing additional information or suggesting revisions to the policy.

Question 8

The analysis phase of the SecSDLC in policy development should produce a new or recent risk assessment or IT audit documenting the current information security needs of the organization._________________________

Accepted Answer

The analysis phase of the SecSDLC in policy development should produce a new or recent risk assessment or IT audit documenting the current information security needs of the organization. Therefore, the statement is true.

Question 9

The ____ layer is the outermost layer of the bull's-eye model,hence the first to be assessed for marginal improvement.
A) Systems
B) Networks
C) Policies
D) Applications

Accepted Answer

The bull's-eye model starts with the outermost layer, the Policies layer, which includes rules, procedures, and guidelines that govern an organization's use of technology. Therefore, it is the first layer to be assessed for marginal improvement.

Question 10

Practices are built on sound policy and carry the weight of policy._________________________

Accepted Answer

Standards

Question 11

Configuration rules are configuration codes that guide the execution of a system when information is passing through it._________________________

Accepted Answer

Configuration rules are indeed codes that provide guidance for the system's execution when information is being processed.

Question 12

Granularity is the level of specificity and detail with which administrators can control access to their systems._________________________

Accepted Answer

Granularity refers to the level of control or detail that administrators have over access to their systems. Higher granularity means more specific and detailed control, while lower granularity means broader and less detailed control.

Question 13

Policies must also specify the penalties for unacceptable behavior and define a(n)____.
A) appeals process
B) legal recourse
C) responsible managers
D) requirements for revision

Accepted Answer

An appeals process is necessary to ensure fairness and provide a mechanism for employees to dispute penalties or decisions related to unacceptable behavior. While legal recourse may also be relevant, it is not always necessary or appropriate to include in policies. Responsible managers and requirements for revision are important components of policy development but do not directly relate to penalties for unacceptable behavior.

Question 14

According to Charles Cresson Wood "policies are important reference documents for internal ____ and for the resolution of legal disputes about management's due diligence; policy documents can act as a clear statement of management's intent".
A) assessment
B) awareness
C) policies
D) audits

Accepted Answer

The answer of According to Charles Cresson Wood "policies are...

Question 15

The ____ model describes the layers at which marginal assessment of security controls can be performed and is a proven mechanism for prioritizing complex changes.
A) NSTISSC
B) EISP
C) bull's-eye
D) policy

Accepted Answer

The bull's-eye model is a widely recognized framework for risk management that helps prioritize security controls by describing the layers at which marginal assessment of security controls (i.e., their effectiveness and cost) can be conducted. It consists of concentric circles, with the core representing critical assets that need the most protection and the outer layers representing less critical assets that require less protection. This approach can aid organizations in prioritizing changes that improve security posture in a systematic and cost-effective manner. The other options (NSTISSC, EISP, and policy) are not directly related to this model.

Question 16

Some policies incorporate a(n)sunset clause indicating a specific date the policy will expire._________________________

Accepted Answer

A sunset clause is a provision that specifies when a policy or regulation will expire, usually after a certain period of time. Therefore, the statement is true.

Question 17

Policy servers code organization-specific policies in a special machine-readable language that then can be accessed by operating systems,access control packages,and network management systems._________________________

Accepted Answer

Policy servers are designed to code organization-specific policies in a machine-readable language, which can then be accessed by various operating systems, access control packages, and network management systems. Therefore, the statement is true.

Question 18

An effective issue-specific security policy serves to demonstrate that the organization has made a good-faith effort to ensure that its facilities will not be used in an inappropriate manner._________________________

Accepted Answer

technologies

Question 19

It is during the design phase of the SecSDLC that the policy development team must provide for policy distribution._________________________

Accepted Answer

implementation

Question 20

Which of the following is NOT a guideline that may help in the formulation of information technology (IT)policy as well as information security policy?
A) All policies must contribute to the success of the organization
B) Policies must be reviewed and approved by legal council before administration
C) Management must ensure the adequate sharing of responsibility for proper use of information systems
D) End users of information systems should be involved in the steps of policy formulation

Accepted Answer

While it is important for policies to comply with legal regulations and standards, they do not need to be reviewed and approved by legal council before administration. However, policies should be reviewed by relevant stakeholders, including legal counsel, to ensure they are comprehensive and effective.

Quiz 4: Information Security Policy