Question 1

Which of the following must an organization's management do if HIPAA applies to its activities?

Accepted Answer

An organization's management must assign a person or persons to be responsible for HIPAA compliance. This is a requirement under HIPAA regulations. The responsible person should ensure that the organization's policies and procedures are in compliance with HIPAA requirements, and that employees receive training on HIPAA regulations.

Choice B is incorrect as organizations must comply with HIPAA regulations if they are engaged in activities that involve protected health information (PHI).

Choice C is unnecessary as there is no HIPAA compliance insurance. However, organizations may seek cyber liability insurance to protect themselves in case of a data breach.

Therefore, the best choice is A.

Question 2

Why is it difficult for companies to manage their e-mail on their own private subnets?

Accepted Answer

All of the options given (A, B, and C) make it difficult for companies to manage their email on their own private subnets. Individuals within an organization can make copies of emails, forward them to others, and may not completely remove them from their storage devices, making it difficult for companies to ensure data privacy and control.

Question 3

Putting plans in place to ensure that employees and business processes can continue when faced with any major unanticipated disruption is called:

Accepted Answer

Business Continuity Planning (BCP) involves creating a plan that ensures that essential business processes can continue during and after a major disruption or disaster. This includes identifying potential risks, developing backup systems and processes, and ensuring that employees are trained and prepared to handle unexpected situations. BCP is a proactive approach to risk management and helps organizations minimize the impact of disruptions on their operations and reputation. The other options (A, B, and C) are related to BCP, but do not accurately describe the full scope of this planning process.

Question 4

Which of the following is not one of the common policy areas generally included in an information security policy?

Accepted Answer

While the usage of social security numbers is certainly a important security consideration, it is not typically included as a distinct policy area within an information security policy. Access control, external access, and acceptable use are all commonly addressed in these policies.

Question 5

What effect does The PATRIOT Act passed by Congress have on the U.S.government's ability to access an individual's personal information?

Accepted Answer

The PATRIOT Act grants the government more extensive surveillance powers, including the ability to access an individual's personal information without a warrant. Therefore, the Act significantly strengthens the government's ability to access an individual's personal information.

Question 6

What is the best term to describe those who break into computers to steal information,wipe out hard drives,or do others harm?

Accepted Answer

"Crackers" is the most accurate term to describe those who break into computers to steal information or cause harm. "Hackers" originally referred to those who use their computer skills and knowledge for creative problem-solving, not malicious activity. "Cyber terrorists" implies a political motive behind the actions, and "computer felons" is not commonly used in the industry.

Question 7

What are sources to use to calculate a single loss expectancy as part of a risk assessment?

Accepted Answer

To accurately calculate a single loss expectancy, it's best to consider both historical experiences of the organization and industry averages. By looking at past incidents and industry standards, you can gather a comprehensive understanding of the potential loss your organization may face. It's important not to rely solely on recent incidents as they may not provide a complete picture of the overall risk.

Question 8

What is just beginning to be addressed in organizations' acceptable-use policies?

Accepted Answer

Usage of social media is just beginning to be addressed in organizations' acceptable-use policies. With the rising importance of social media in both personal and professional lives, organizations have started to outline guidelines and rules for the usage of social media by employees.

Answer: B 
 Usage of emails is not new to acceptable-use policies, but with the increasing number of cyber threats and data breaches through email, organizations are updating their policies to include stricter guidelines on email usage and security measures.

Answer: C 
 Usage of external websites has been a concern for organizations for a while now, but with the growing risk of malware and ransomware attacks, organizations are starting to incorporate stricter policies on accessing external websites and downloading content from them.

Answer: D 
 None of the above is incorrect as all the options are being addressed in organizations' acceptable-use policies in different ways and to different extents.

Question 9

Which organizational position is directly responsible for the balancing of an organization's security risks with the costs to avoid them?

Accepted Answer

The Chief Security Officer (CSO) is primarily responsible for evaluating the security risks of the organization and must balance them with the cost of implementing security measures. While the CEO, CFO, and CIO may also have some responsibility for security, it is not their primary focus.

Question 10

What are some of the benefits to organizations with written privacy policies?

Accepted Answer

Written privacy policies provide justification for removing employees who behave improperly, help organizations comply with SOX, and can improve their ability to obtain insurance coverage. Therefore, all of the above are benefits of having a written privacy policy.

Question 11

Hackers can be differentiated from crackers by:

Accepted Answer

Hackers are generally differentiated from crackers based on their intent. Hackers might not necessarily have malicious intentions and often hack for learning, ethical reasons, or to identify security vulnerabilities (white hat hackers). Crackers, on the other hand, typically have malicious intent, focusing on gaining unauthorized access to systems and data for personal gain or to cause harm.

Question 12

Determining a Return Benefit for a specific security action is based on which of the following?

Accepted Answer

Determining a Return Benefit for a specific security action involves calculating the annualized Expected Losses and Annualized Cost of Actions. Benefits of remote PC access and electronic records management may have their own return benefits, but they are not relevant in this context.

Question 13

Which of the following is not one of the rules that the GLBA gives federal agencies and states the ability to enforce?

Accepted Answer

The GLBA does not specifically mention a "Credit Information Rule." However, it does include provisions related to the sharing and protection of consumer credit information as part of the Financial Privacy Rule and Safeguards Rule. Therefore, B is not one of the rules that the GLBA gives federal agencies and states the ability to enforce.

Question 14

Which type of employee does not need to be aware of basic types of information security technologies?

Accepted Answer

All employees, regardless of their role, need to have an awareness of basic information security technologies to ensure the overall security posture of an organization. This includes business managers, IT application managers, and the Chief Security Officer (CSO).

Question 15

What is the approximate total business loss (in U.S.dollars)resulting from the largest reported customer data security breach to date involving retailers or financial institutions as of 2010?

Accepted Answer

According to a study conducted by the Ponemon Institute in 2010, the largest reported customer data security breach resulted in a total business loss of $1 billion.

Question 16

Research has shown that an organization's inability to return to normal business activities after a major disruption is a key predictor of:

Accepted Answer

If an organization is unable to return to normal business activities after a major disruption, it is at risk of not surviving. Therefore, the inability to return to normal business activities is a key predictor of business survival.

Question 17

What are some means to deal with key information security management issues?

Accepted Answer

All three options are necessary means to deal with key information security management issues. Managers must first identify their information assets and prioritize them based on their value. Then, they must assess the criticality of each asset and determine how long the organization can function without each one. Finally, the departmental managers and asset owners need to develop and implement security procedures to protect all major assets. By doing all three, organizations can effectively manage and address their information security risks.

Question 18

Which of the following is one of the areas in which controls are assessed by auditors using the COSO framework?

Accepted Answer

The COSO framework evaluates controls in all three areas - Control Environment, Risk Assessment, and Monitoring. Therefore, option D - all of the above is the correct choice.

Question 19

When a web site mimics a legitimate site for the purpose of misleading or defrauding an Internet user,it is called:

Accepted Answer

Spoofing is when a website mimics a legitimate site to mislead or defraud users.

Question 20

Which of the following is a typical statement included in an organization's acceptable use policy?

Accepted Answer

All of the above are typical statements included in an organization's acceptable use policy. The policy usually outlines the ownership of the computing resources, employee privacy rights or lack thereof, and the prohibitions related to illegal computing behavior.

Quiz 14: Information Security