Question 1

Redundancy can be implemented at a number of points throughout the security architecture, such as in ________.

Accepted Answer

Redundancy can and should be implemented at multiple points throughout the security architecture to ensure that no single point of failure can compromise the overall security of the system. This includes firewalls, proxy servers, access controls, and any other key security components. By implementing redundancy at multiple levels, organizations can minimize the risk of a breach and ensure that their systems remain secure and resilient even in the face of sophisticated cyber threats.

Question 2

_________ is the rapid determination of the scope of the breach in the confidentiality, integrity, and availability of information and information assets during or just following an incident.

Accepted Answer

Damage assessment is the process of quickly determining the extent of the damage caused by an incident, including the impact on confidentiality, integrity, and availability of information and information assets. It helps to identify the necessary steps for containment and recovery.

Question 3

A fundamental difference between a BIA and risk management is that risk management focuses on identifying threats, vulnerabilities, and attacks to determine which controls can protect information, while the BIA assumes __________.

Accepted Answer

Risk management focuses on identifying threats, vulnerabilities, and attacks to determine which controls can protect information, while the BIA assumes that controls have failed.

Question 4

The spheres of security are the foundation of the security framework and illustrate how information is under attack from a variety of sources, with far fewer protection layers between the information and potential attackers on the __________ side of the organization.

Accepted Answer

The spheres of security emphasize the importance of people in the security framework and how they can be a potential source of attack. The other options (technology, internet, operational) do not directly relate to the spheres of security.

Question 5

The transfer of large batches of data to an off-site facility, usually through leased lines or services, is called ____.

Accepted Answer

The transfer of large batches of data to an off-site facility is called electronic vaulting. Off-site storage refers to storing data at a different physical location than the primary location. Remote journaling and database shadowing involve real-time synchronization of data between multiple locations rather than batch transfers.

Question 6

A(n) _________ is a document containing contact information for the people to be notified in the event of an incident.

Accepted Answer

An alert roster is specifically designed to contain contact information for individuals who need to be notified in the event of an incident. While a phone list might contain similar information, it may also include contacts who do not need to be notified in an emergency situation. Emergency notification system and call register refer to broader systems or processes, rather than a specific document.

Question 7

A ____ site provides only rudimentary services and facilities.

Accepted Answer

The term "cold site" is used in information technology to refer to a backup location that provides only the most basic facilities and infrastructure. It is a facility that has been set aside by an organization, but does not have the equipment, software, or data required to support their business operations. It is typically used for disaster recovery purposes, and is cheaper than a fully-equipped "hot" or "warm" site, which are also terms used in IT.

Question 8

In early 2014, in response to Executive Order 13636, NIST published the Cybersecurity Framework, which intends to allow organizations to __________.

Accepted Answer

The NIST Cybersecurity Framework helps organizations identify and prioritize opportunities for improvement within a continuous and repeatable process.

Question 9

__________ is a strategy of using multiple types of technology that prevent the failure of one system from compromising the security of information.

Accepted Answer

Redundancy is a strategy that involves using multiple backups, devices, or systems to ensure the availability and reliability of information in case of a failure of one component. Redundancy can be used in hardware, software, and network systems to ensure that any failure of a single system or component does not compromise information security. Firewalling (A) involves using a security system to monitor and control network traffic, hosting (B) involves providing space and services for websites and applications on a server, and domaining (D) involves registering and managing domain names for websites. While these strategies may be relevant to information security, they do not specifically address the use of multiple technologies to prevent system failures.

Question 10

The transfer of transaction data in real time to an off-site facility is called ____.

Accepted Answer

Remote journaling is the process of transferring transaction data in real time to an off-site facility. Option A, off-site storage, refers to the physical location where data is stored off-site. Option C, electronic vaulting, refers to the process of periodically transferring data to an off-site location for backup purposes. Option D, database shadowing, is a process in which a replica of a database is created and kept synchronized with the primary database.

Question 11

________ controls cover security processes that are designed by strategic planners and implemented by the security administration of the organization.

Accepted Answer

Managerial controls are designed by strategic planners and implemented by the security administration of the organization. These controls involve policies, procedures, and guidelines to ensure that security objectives are achieved effectively and efficiently. Technical, operational, and informational controls are more focused on specific areas of security implementation and may not involve the same level of strategic planning and management.

Question 12

​Security __________ are the areas of trust within which users can freely communicate.

Accepted Answer

Domains are defined areas within which users can communicate with each other without restrictions or security barriers. Perimeters, layers, and rectangles are security concepts related to defining boundaries and areas of control within a system.

Question 13

_________ controls address personnel security, physical security, and the protection of production inputs and outputs.

Accepted Answer

Operational controls are concerned with the day-to-day operations and include personnel security, physical security, and the protection of production inputs and outputs.

Question 14

SP 800-14, Generally Accepted Principles and Practices for Securing Information Technology Systems, provides best practices and security principles that can direct the security team in the development of a security ________.

Accepted Answer

The answer of SP 800-14, Generally Accepted Principles and Practices...

Question 15

The ____________________ of an organization are the intermediate states obtained to achieve progress toward a goal or goals.

Accepted Answer

The answer of The ____________________ of an organization are the intermediate...

Question 16

The SETA program is a control measure designed to reduce the instances of __________ security breaches by employees.

Accepted Answer

The SETA (Security Education, Training, and Awareness) program is aimed at reducing accidental security breaches by educating employees on security policies and best practices.

Question 17

The CPMT conducts the BIA in three stages.  Which of the following is NOT one of those stages

Accepted Answer

All of these are BIA stages. The CPMT conducts the BIA in three stages, which are: determining mission/business processes and recovery criticality, identifying recovery priorities for system resources, and identifying resource requirements.

Question 18

According to NIST SP 800-14's security principles, security should ________.

Accepted Answer

NIST SP 800-14's security principles state that security should support the mission of the organization, require a comprehensive and integrated approach, and be cost-effective. Therefore, option D, "All of the above," is the best choice.

Question 19

RAID is an acronym for a __________ array of independent disk drives that stores information across multiple units to spread out data and minimize the impact of a single drive failure.

Accepted Answer

RAID stands for redundant array of independent disks, which means that data is stored redundantly across multiple drives to provide fault tolerance and minimize the risk of data loss in case of a drive failure. Therefore, option D, redundant, is the most appropriate choice.

Question 20

__________ is a strategy for the protection of information assets that uses multiple layers and different types of controls (managerial, operational, and technical) to provide optimal protection.

Accepted Answer

Defense in depth is a comprehensive approach to information security that uses multiple layers of controls to protect information assets. This strategy involves using a combination of managerial, operational, and technical controls to provide optimal protection. This approach improves the overall security posture of an organization by making it more difficult for attackers to compromise the system.

Quiz 4: Planning for Security

Redundancy can be implemented at a number of points throughout the security architecture, such as in ________.

_________ is the rapid determination of the scope of the breach in the confidentiality, integrity, and availability of information and information assets during or just following an incident.

A fundamental difference between a BIA and risk management is that risk management focuses on identifying threats, vulnerabilities, and attacks to determine which controls can protect information, while the BIA assumes __________.

The spheres of security are the foundation of the security framework and illustrate how information is under attack from a variety of sources, with far fewer protection layers between the information and potential attackers on the __________ side of the organization.

The transfer of large batches of data to an off-site facility, usually through leased lines or services, is called ____.

A(n) _________ is a document containing contact information for the people to be notified in the event of an incident.

A ____ site provides only rudimentary services and facilities.

In early 2014, in response to Executive Order 13636, NIST published the Cybersecurity Framework, which intends to allow organizations to __________.

__________ is a strategy of using multiple types of technology that prevent the failure of one system from compromising the security of information.

The transfer of transaction data in real time to an off-site facility is called ____.

________ controls cover security processes that are designed by strategic planners and implemented by the security administration of the organization.

​Security __________ are the areas of trust within which users can freely communicate.

_________ controls address personnel security, physical security, and the protection of production inputs and outputs.

SP 800-14, Generally Accepted Principles and Practices for Securing Information Technology Systems, provides best practices and security principles that can direct the security team in the development of a security ________.

The ____________________ of an organization are the intermediate states obtained to achieve progress toward a goal or goals.

The SETA program is a control measure designed to reduce the instances of __________ security breaches by employees.

The CPMT conducts the BIA in three stages. Which of the following is NOT one of those stages

According to NIST SP 800-14's security principles, security should ________.

RAID is an acronym for a __________ array of independent disk drives that stores information across multiple units to spread out data and minimize the impact of a single drive failure.

__________ is a strategy for the protection of information assets that uses multiple layers and different types of controls (managerial, operational, and technical) to provide optimal protection.

Security __________ are the areas of trust within which users can freely communicate.