Question 1

Which of the following elements ensures a policy is enforceable?
A) Compliance can be measured.
B) Appropriate sanctions are applied when the policy is violated.
C) Appropriate administrative, technical, and physical controls are put in place to support the policy.
D) All of the above

Accepted Answer

All of the options listed are essential for ensuring a policy is enforceable. Measuring compliance, applying sanctions for violations, and supporting the policy with appropriate controls are all critical elements.

Question 2

FERPA protects which of the following?
A) Medical records
B) Educational records
C) Personally identifiable information
D) Financial records

Accepted Answer

FERPA (Family Educational Rights and Privacy Act) specifically protects the privacy of student educational records.

Question 3

Which of the following is an example of an information asset?
A) Business plans
B) Employee records
C) Company reputation
D) All of the above

Accepted Answer

All the options listed (business plans, employee records, and company reputation) are examples of information assets as they hold value and are critical to the organization's operations and decision-making processes.

Question 4

Policy implementation and enforcement are part of which of the following phases of the cybersecurity policy life cycle?
A) Develop
B) Review
C) Adopt
D) Publish

Accepted Answer

Policy implementation and enforcement occur during the Adopt phase, where policies are put into action and compliance is ensured.

Question 5

Which of the following is the correct order of the policy life cycle?
A) Review, develop, adopt, publish
B) Develop, publish, adopt, review
C) Publish, develop, review, adopt
D) Review, adopt, develop, publish

Accepted Answer

The correct order of the policy life cycle typically starts with developing the policy, then publishing it so that it is accessible, followed by adopting it into practice, and finally reviewing it periodically to ensure it remains relevant and effective.

Question 6

Endorsed is one of the seven policy characteristics. Which of the following statements best describes endorsed?
A) The policy is supported by management.
B) The policy is accepted by the organization's employees.
C) The policy is mandatory; compliance is measured; and appropriate sanctions are applied.
D) The policy is regulated by the government.

Accepted Answer

Endorsed means that the policy has the support of management, indicating that it is officially approved or sanctioned by the leadership of the organization.

Question 7

Which of the following is the outcome of policy review?
A) Retirement or renewal
B) Retirement or reauthorization
C) Renewal or reauthorization
D) None of the above

Accepted Answer

Policy review can lead to either the retirement of a policy if it is deemed no longer relevant or necessary, or reauthorization if it is still considered useful and relevant.

Question 8

How often should policies be reviewed?
A) Monthly
B) Twice a year
C) Annually
D) Never

Accepted Answer

Policies should be reviewed annually to ensure they remain relevant and effective in light of any changes in the organization, technology, laws, or industry standards.

Question 9

Which of the following statements is not true?
A) Policies should require only what is possible.
B) Policies that are no longer applicable should be retired.
C) All guiding principles and corporate cultures are good.
D) Guiding principles set the tone for a corporate culture.

Accepted Answer

Not all guiding principles and corporate cultures are inherently good. They can sometimes promote negative behaviors or be misaligned with ethical standards, which contradicts the statement.

Question 10

Which of the following is not one of the tasks of the policy development phase?
A) Approve
B) Write
C) Communicate
D) Authorize

Accepted Answer

Communicate is not a task of the policy development phase but rather a part of the policy implementation phase, where policies are communicated to the relevant stakeholders. The development phase typically involves writing, approving, and authorizing the policy.

Question 11

The United States Department of Homeland Security defines how many critical infrastructure sectors?
A) 16
B) 14
C) 20
D) 17

Accepted Answer

The United States Department of Homeland Security defines 16 critical infrastructure sectors.

Question 12

Which of the following is the seminal tool used to protect both our critical infrastructure and our individual liberties?
A) Information security
B) Society
C) Physical security
D) Policy

Accepted Answer

Policy is the seminal tool as it sets the framework and guidelines for protecting critical infrastructure and individual liberties, balancing security needs with civil rights.

Question 13

Which of the following can be defined as the shared attitudes, goals, and practices that characterize a company, corporation, or institution?
A) Regulations
B) Corporate culture
C) Cybersecurity policy
D) Guiding principles

Accepted Answer

Corporate culture refers to the shared attitudes, goals, and practices that characterize a company, corporation, or institution. It encompasses the values, visions, norms, working language, systems, symbols, beliefs, and habits of a group.

Question 14

Which of the following is a collection of articles and amendments that provide a framework for the American government and define citizens' rights?
A) The Constitution
B) The Torah
C) Data Protection Act
D) Consumer Credit Act

Accepted Answer

The Constitution of the United States is a foundational document that outlines the structure of the federal government, delineates the powers of its three branches (legislative, executive, and judicial), and specifies the rights and freedoms of citizens. It also includes amendments, such as the Bill of Rights, which further protect individual liberties.

Question 15

Which layer in the defense-in-depth strategy includes firewalls, IDS/IPS devices, segmentation, and VLANs?
A) Physical security
B) Network security
C) Perimeter security
D) Application security

Accepted Answer

Perimeter security includes firewalls, IDS/IPS devices, segmentation, and VLANs.

Question 16

Which of the following is another term for statutory law?
A) Legislation
B) Regulation
C) Policy
D) Governance

Accepted Answer

Statutory law refers to laws that are written and enacted by a legislative body, which is why "Legislation" is another term for statutory law.

Question 17

Which of the following federal legislations, also known as the Financial Modernization Act of 1999, was created to reform and modernize the banking industry by eliminating existing barriers between banking and commerce?
A) HITECH
B) HIPAA
C) FERPA
D) GLBA

Accepted Answer

The Gramm-Leach-Bliley Act (GLBA), also known as the Financial Modernization Act of 1999, was designed to allow the consolidation of financial institutions, thereby removing barriers that previously existed between banking, securities, and insurance organizations.

Question 18

Which major regulation entity within the European Union (EU) was created to maintain a single standard for data protection among all member states in the EU?
A) Directive on Security of Network and Information Systems (the NIS Directive)
B) EU General Data Protection Regulation (GDPR)
C) European Union Agency for Network and Information Security (ENISA)
D) The Consumer Credit Regulations 2010

Accepted Answer

The EU General Data Protection Regulation (GDPR) was established to unify data protection for all individuals within the European Union, aiming to give control back to citizens over their personal data and to simplify the regulatory environment for international business by unifying the regulation within the EU.

Question 19

Which key task in the policy development phase requires the authors to consult with internal and external experts, including legal counsel, human resources, compliance, cybersecurity and technology professionals, auditors, and regulators?
A) Writing
B) Authorizing
C) Vetting
D) Planning

Accepted Answer

Vetting is the key task in the policy development phase that requires authors to consult with various internal and external experts. This step ensures that the policy is comprehensive, compliant with laws and regulations, and aligns with best practices in the relevant fields.

Question 20

Which key task in the policy adoption phase is the busiest and most challenging task of all?
A) Implementation
B) Enforcement
C) Monitoring
D) Education

Accepted Answer

Implementation is considered the busiest and most challenging task in the policy adoption phase because it involves putting the policy into action and dealing with the complexities of applying the policy in real-world situations.

Quiz 1: Understanding Cybersecurity Policy and Governance

Which of the following elements ensures a policy is enforceable?

FERPA protects which of the following?

Which of the following is an example of an information asset?

Policy implementation and enforcement are part of which of the following phases of the cybersecurity policy life cycle?

Which of the following is the correct order of the policy life cycle?

Endorsed is one of the seven policy characteristics. Which of the following statements best describes endorsed?

Which of the following is the outcome of policy review?

How often should policies be reviewed?

Which of the following statements is not true?

Which of the following is not one of the tasks of the policy development phase?

The United States Department of Homeland Security defines how many critical infrastructure sectors?

Which of the following is the seminal tool used to protect both our critical infrastructure and our individual liberties?

Which of the following can be defined as the shared attitudes, goals, and practices that characterize a company, corporation, or institution?

Which of the following is a collection of articles and amendments that provide a framework for the American government and define citizens' rights?

Which layer in the defense-in-depth strategy includes firewalls, IDS/IPS devices, segmentation, and VLANs?

Which of the following is another term for statutory law?

Which of the following federal legislations, also known as the Financial Modernization Act of 1999, was created to reform and modernize the banking industry by eliminating existing barriers between banking and commerce?

Which major regulation entity within the European Union (EU) was created to maintain a single standard for data protection among all member states in the EU?

Which key task in the policy development phase requires the authors to consult with internal and external experts, including legal counsel, human resources, compliance, cybersecurity and technology professionals, auditors, and regulators?

Which key task in the policy adoption phase is the busiest and most challenging task of all?