Question 1

ISO/IEC 27001 provieds implementation details using a(n)____________________ cycle.

Accepted Answer

The answer of ISO/IEC 27001 provieds implementation details using a(n)____________________...

Question 2

A(n)____________________ is the outline of an information security blueprint.

Accepted Answer

The answer of A(n)____________________ is the outline of an information...

Question 3

To design a security blueprint,an organization can use a(n)____________________,which is a generic blueprint offered by a service organization.

Accepted Answer

The answer of To design a security blueprint,an organization can...

Question 4

The Graham-Denning model most closely represents which of the following access control models?

Accepted Answer

The Graham-Denning model is a lattice-based access control model.

Question 5

The COSO framework is built on five interrelated components.Which of the following is NOT one of them?

Accepted Answer

The five components of the COSO framework are control environment, risk assessment, control activities, information and communication, and monitoring activities. Therefore, information management is not one of the components.

Question 6

____ provides a library of Special Publications that includes Generally Accepted Principles and Practices for Securing IT Systems.

Accepted Answer

NIST (National Institute of Standards and Technology) provides a library of Special Publications (SPs) that includes Generally Accepted Principles and Practices for Securing IT Systems. These SPs provide guidance on information security and risk management for organizations in various industries.

Question 7

____ controls cover security processes that are designed by the strategic planners and executed by security administrators.

Accepted Answer

Management controls are responsible for setting security policies, procedures, and standards. These controls include strategic planning and risk management. Security administrators execute these processes on a day-to-day basis, but they do not design them. Therefore, management controls are the correct choice.

Question 8

According to COSO a(n)____ is a process,effected by an entity's board of directors,management and other personnel,designed to provide reasonable assurance regarding the achievement of the objectives.

Accepted Answer

The definition given in the question perfectly fits the concept of internal control, which is a fundamental component of the COSO framework. Therefore, the correct option is A (internal control). Option B (external control) is not a recognized term, option C (audit) refers to a different activity, and option D (framework) is a broader concept that includes internal control.

Question 9

The COSO framework component ____ provides the foundation of all internal control components.

Accepted Answer

The control environment is considered the foundation of all internal control components as it sets the tone for the organization and influences the other components. It includes factors such as ethics, integrity, and governance structure that contribute to the overall control environment. The other components (risk assessment, control activities, information management, and monitoring) build upon the foundation set by the control environment.

Question 10

Providing information security for the information and information systems that support the operations and assets under their control is the primary responsibility of which group under the InfoSec governance framework?

Accepted Answer

Senior managers are typically responsible for implementing and enforcing information security policies and procedures within the specific areas of the organization that they oversee. They are responsible for ensuring that information security controls are in place and are effective in protecting the organization's assets and operations. While all employees and users have a role to play in maintaining information security, it is typically the responsibility of senior executives and managers to ensure that the necessary measures are in place and are being effectively implemented. The board of directors/trustees has overall responsibility for governance and strategic direction, but may delegate the day-to-day responsibility for information security to senior management.

Question 11

Which of the following is NOT a change control principle of the Clark-Wilson model?

Accepted Answer

The Clark-Wilson model's change control principles include no changes by unauthorized subjects, no unauthorized changes by authorized subjects, and the maintenance of internal and external consistency. However, there is no principle that requires authorized subjects to have external validation before making changes.

Question 12

Which of the following is NOT a purpose of the ISO/IEC 17799 (later 27002)standard?

Accepted Answer

All of the options listed are valid purposes of the ISO/IEC 17799 (later 27002) standard.

Question 13

The ___ or Chinese Wall model is designed to prevent a conflict of interest between two parties.

Accepted Answer

The Brewer-Nash model, also known as the Chinese Wall model, is designed to prevent a conflict of interest between two parties by restricting access to information. This model is commonly used in the financial industry to prevent insider trading. The Bell-LaPadula model is designed to protect information confidentiality and integrity in a military context, the Graham-Denning model is used for access control in computer systems, and the Harrison-Ruzzo-Ullman model is a formal verification method for concurrency.

Question 14

____ helps organizations comply with critical regulations like the Sarbanes-Oxley Act of 2002.

Accepted Answer

COSO (Committee of Sponsoring Organizations of the Treadway Commission) helps organizations comply with critical regulations like the Sarbanes-Oxley Act of 2002.

Question 15

____________________ is the principle by which members of the organization can access the minimum amount of information for the minimum amount of time necessary to perform their required duties.

Accepted Answer

The answer of ____________________ is the principle by which members...

Question 16

____________________ limits a user's access to the specific information required to perform the currently assigned task,and not merely to the category of data required for a general work function.

Accepted Answer

The answer of ____________________ limits a user's access to the...

Question 17

Which of the following is not an element of the Clark-Wilson model?

Accepted Answer

The Clark-Wilson model includes constrained data items, unconstrained data items, and integrity verification procedures, but not internal consistency validation items.

Question 18

____ is an IT governance framework and supporting toolset that allows managers to bridge the gap between control requirements,technical issues,and business risks.It enables clear policy development and good practice for IT control throughout organizations.

Accepted Answer

COBIT (Control Objectives for Information and Related Technology) is an IT governance framework that provides a set of best practices for managing IT functions and aligning them with business objectives. It helps organizations to develop clear policies and good practices for IT control, addressing technical issues and business risks. COBIT is often used by managers to bridge the gap between control requirements, technical issues, and business risks.

Question 19

The cornerstone of the ISO/IEC 27001 standard is a set of processes known as the ____ cycle.

Accepted Answer

The ISO/IEC 27001 standard follows the Plan-Do-Check-Act (PDCA) cycle, which consists of four stages: Plan, Do, Check, and Act. This iterative process is used for continual improvement of the organization's information security management system. Choice A is close but has the wrong order of the second and third stages. Choices C and D are incorrect options as they are not relevant to the ISO/IEC 27001 standard.

Question 20

Providing oversight of a comprehensive information security program for the entire organization is the primary responsibility of which group under the InfoSec governance framework?

Accepted Answer

Senior executives are primarily responsible for providing oversight of a comprehensive information security program, as they have the authority and responsibility to ensure that security policies align with the organization's objectives and risk management strategies.

Quiz 6: Security Management Models