Question 1

​The goals of information security governance include all but which of the following  
A) Regulatory compliance by using information security knowledge and infrastructure to support minimum standards of due care 
B) ​Strategic alignment of information security with business strategy to support organizational objectives 
C) ​Risk management by executing appropriate measures to manage and mitigate threats to information resources 
D) ​Performance measurement by measuring, monitoring, and reporting information security governance metrics to ensure that organizational objectives are achieved

Accepted Answer

Regulatory compliance is not a primary goal of information security governance; it is more about aligning security with business strategy, managing risks, and measuring performance.

Question 2

One of the basic tenets of security architectures is the layered implementation of security, which is called defense in redundancy. _________________________

Accepted Answer

depth

Question 3

The ________is the high-level information security policy that sets the strategic direction, scope, and tone for all of an organization's security efforts.
A) SysSP
B) EISP 
C) GSP
D) ISSP

Accepted Answer

EISP (Enterprise Information Security Policy) is the high-level information security policy that sets the strategic direction, scope, and tone for all of an organization's security efforts. SysSP (System Security Policy) is a type of policy that specifically focuses on securing individual systems. GSP (Global Security Policy) is not a commonly used term in describing information security policies. ISSP (Information Systems Security Policy) is also a commonly used term for information security policies, but it is not as comprehensive as EISP, as it only focuses on information systems.

Question 4

Evidence is the physical object or documented information that proves an action occurred or identifies the intent of a perpetrator. _________________________

Accepted Answer

This definition accurately describes evidence.

Question 5

A(n) disaster is any adverse event that could result in loss of an information asset or assets, but does not currently threaten the viability of the entire organization. _________________________

Accepted Answer

incident

Question 6

A(n) differential backup only archives the files that have been modified that day, and thus requires less space and time than a full backup. _________________________

Accepted Answer

incremental

Question 7

A service bureau is an agency that provides a service for a fee. _________________________

Accepted Answer

A service bureau is defined as an agency that provides a service for a fee, so the statement is true.

Question 8

The recovery point objective (RPO) is the point in time prior to a disruption or system outage to which mission/business process data can be recovered after an outage. _________________________

Accepted Answer

The definition given in the statement is correct, therefore the answer is true.

Question 9

The stated purpose of ISO/IEC 27002 is to "offer guidelines and voluntary directions for information security __________." 
A) implementation
B) certification 
C) management
D) accreditation

Accepted Answer

ISO/IEC 27002 provides guidelines for information security management, focusing on best practices for managing information security risks.

Question 10

A(n) ________ plan is a plan for the organization's intended strategic efforts over the next several years.
A) standard
B) operational 
C) tactical
D) strategic

Accepted Answer

A strategic plan is a long-term plan that outlines an organization's intended strategic efforts over the next several years to achieve its goals and objectives. It involves setting priorities, allocating resources, and defining strategies for achieving overall organizational success. Standard plans refer to established procedures and guidelines, operational plans guide day-to-day activities, and tactical plans outline specific actions to achieve short-term goals.

Question 11

A(n) DR plan ensures that critical business functions continue if a catastrophic incident or disaster occurs. _________________________

Accepted Answer

business continuity (BC), business continuity, BC

Question 12

An information security ________ is a specification of a model to be followed during the design, selection, and initial and ongoing implementation of all subsequent security controls, including information security policies, security education, and training.
A) plan
B) framework 
C) model
D) policy

Accepted Answer

A framework is a comprehensive set of guidelines that provide direction and support for developing, implementing, and maintaining information security policy, controls, and procedures over time. It provides an essential structure for guiding decisions and actions based on risk assessments, regulatory compliance, and industry-standard best practices. The framework also ensures the consistency of the security program, improves communication among stakeholders, and helps avoid gaps and overlaps in security control implementation. Therefore, a security framework is the best fit for this definition.

Question 13

The process of examining an incident candidate and determining whether it constitutes an actual incident is called incident classification. _________________________

Accepted Answer

Incident classification is the process of identifying an incident or event and determining if it meets the criteria to be classified as an actual security incident.

Question 14

A(n) sequential roster is activated as the first person calls a few people on the roster, who in turn call a few other people. _________________________

Accepted Answer

hierarchical

Question 15

When BS 7799 first came out, several countries, including the United States, Germany, and Japan, refused to adopt it, claiming that it had fundamental problems. Which of the following is NOT one of those problems  
A) The standard lacked the measurement precision associated with a technical standard. 
B) It was not as complete as other frameworks. 
C) The standard was hurriedly prepared, given the tremendous impact its adoption could have on industry information security controls. 
D) The global information security community had already defined a justification for a code of practice, such as the one identified in ISO/IEC 17799.

Accepted Answer

The problem not mentioned was that the standard was hurriedly prepared.

Question 16

A(n) alarming event is an event with negative consequences that could threaten the organization's information assets or operations.__________________

Accepted Answer

adverse

Question 17

The Computer Security Resource Center at NIST provides several useful documents free of charge in its special publications area. _________________________

Accepted Answer

The Computer Security Resource Center at NIST does provide several useful documents free of charge in its special publications area.

Question 18

________often function as standards or procedures to be used when configuring or maintaining systems.
A) ESSPs
B) EISPs 
C) ISSPs
D) SysSPs

Accepted Answer

SysSPs (System-Specific Security Policies) often function as standards or procedures to be used when configuring or maintaining systems.

Question 19

Standards may be published, scrutinized, and ratified by a group, as in formal or ________ standards.
A) de formale
B) de public 
C) de jure
D) de facto

Accepted Answer

"De jure" refers to formal, legally recognized standards that have been ratified by a group or government.

Question 20

Technical controls are the tactical and technical implementations of security in the organization. _________________________

Accepted Answer

Technical controls are indeed the tactical and technical implementations of security in the organization. They include access controls, firewalls, encryption, intrusion detection and prevention systems, and other technologies that protect the organization's assets.

Quiz 4: Planning for Security

​The goals of information security governance include all but which of the following

One of the basic tenets of security architectures is the layered implementation of security, which is called defense in redundancy. _________________________

The ________is the high-level information security policy that sets the strategic direction, scope, and tone for all of an organization's security efforts.

Evidence is the physical object or documented information that proves an action occurred or identifies the intent of a perpetrator. _________________________

A(n) disaster is any adverse event that could result in loss of an information asset or assets, but does not currently threaten the viability of the entire organization. _________________________

A(n) differential backup only archives the files that have been modified that day, and thus requires less space and time than a full backup. _________________________

A service bureau is an agency that provides a service for a fee. _________________________

The recovery point objective (RPO) is the point in time prior to a disruption or system outage to which mission/business process data can be recovered after an outage. _________________________

The stated purpose of ISO/IEC 27002 is to "offer guidelines and voluntary directions for information security __________."

A(n) ________ plan is a plan for the organization's intended strategic efforts over the next several years.

A(n) DR plan ensures that critical business functions continue if a catastrophic incident or disaster occurs. _________________________

An information security ________ is a specification of a model to be followed during the design, selection, and initial and ongoing implementation of all subsequent security controls, including information security policies, security education, and training.

The process of examining an incident candidate and determining whether it constitutes an actual incident is called incident classification. _________________________

A(n) sequential roster is activated as the first person calls a few people on the roster, who in turn call a few other people. _________________________

When BS 7799 first came out, several countries, including the United States, Germany, and Japan, refused to adopt it, claiming that it had fundamental problems. Which of the following is NOT one of those problems

A(n) alarming event is an event with negative consequences that could threaten the organization's information assets or operations.__________________

The Computer Security Resource Center at NIST provides several useful documents free of charge in its special publications area. _________________________

________often function as standards or procedures to be used when configuring or maintaining systems.

Standards may be published, scrutinized, and ratified by a group, as in formal or ________ standards.

Technical controls are the tactical and technical implementations of security in the organization. _________________________

The goals of information security governance include all but which of the following