Question 1

Which of the following policies requires that every employee be able to perform the work of at least one other staff member?
A) Task rotation
B) Job rotation
C) Two-man control
D) Separation of duties

Accepted Answer

Job rotation requires that every employee be able to perform the work of at least one other staff member by rotating through different roles and responsibilities within the organization. This helps to increase employees' skillsets, broaden their perspectives, and improve overall organizational flexibility. Task rotation involves rotating routine tasks among employees, two-man control involves having two people involved in critical tasks, and separation of duties involves dividing tasks among different employees to prevent fraud and errors.

Question 2

The Certified Computer Examiner (CCE)certification is a computer forensics certification provided by the International Society of Forensic Computer Examiners.Which of the following is NOT part of the CCE certification process?
A) Client and server hardware construction and theory
B) Chain of custody
C) "Rules of evidence" as they relate to computer examinations
D) Acquisition, marking, handling, and storage of evidence procedures

Accepted Answer

Client and server hardware construction and theory is not explicitly mentioned as part of the CCE certification process, while chain of custody, "rules of evidence," and acquisition, marking, handling, and storage of evidence procedures are all specifically mentioned.

Question 3

Which of the following is NOT a common type of background check that may be performed on a potential employee?
A) Identity check
B) Relationship history
C) Motor vehicle records
D) Drug history

Accepted Answer

While identity checks, motor vehicle records, and drug history are common types of background checks, relationship history is not typically included in these types of checks.

Question 4

Which of the following policies requires that two individuals review and approve each other's work before the task is considered complete?
A) Task rotation
B) Two-person control
C) Separation of duties
D) Job rotation

Accepted Answer

Two-person control (also known as dual control) is a policy requiring that two individuals review and approve each other's work before the task is considered complete. This provides an additional level of security and reduces the risk of errors or fraud caused by a single individual. Task rotation involves rotating employees through different tasks or positions to increase their skills and cross-training. Separation of duties divides responsibilities among multiple individuals to prevent a single person from having too much control over a process. Job rotation involves rotating employees through different jobs or departments to provide them with a broader range of experience.

Question 5

____ fall under the category of nonemployees that usually provide secretarial or administrative support.
A) Business partners
B) Contractors
C) Consultants
D) Temporary workers

Accepted Answer

Temporary workers are individuals hired on a short-term basis to provide support in administrative or secretarial roles. Business partners are individuals or organizations with whom a company has a mutually beneficial relationship, consultants are hired to provide expertise and guidance on specific projects, and contractors are individuals or companies hired to complete specific tasks or projects.

Question 6

From Schwartz et al.,information security positions can be categorized as those that define,those that build,and those that ____.
A) implement
B) design
C) administer
D) operate

Accepted Answer

The third category would be those that administer, as this would encompass roles related to managing and enforcing security policies, monitoring systems for security threats, and other operational aspects of information security. The other options are closely related to building or designing systems, but do not necessarily cover the same range of responsibilities as administration.

Question 7

The ____ examination was developed by the International Society of Forensic Computer Examiners.
A) CCE
B) TICSA
C) SSCP
D) CISM

Accepted Answer

The acronym CCE stands for Certified Computer Examiner and is a certification program developed by the International Society of Forensic Computer Examiners (ISFCE).

Question 8

Which of the following is NOT part of the requirements for the CISM certification?
A) Pass the examination
B) Adherence to a code of ethics promulgated by ISACA
C) Pursue continuing education as specified
D) Complete two years of information security work experience with at least one year in information security management in at least one of the defined areas of practice

Accepted Answer

Option D is incorrect as it is part of the requirements for the CISM certification. The other options (A, B, C) are correct requirements for the CISM certification.

Question 9

Which of the following is NOT a task that must be performed if an employee is terminated?
A) Employee must return all media
B) Employee's home computer must be audited
C) Employee's office computer must be secured
D) Office door locks must be changed

Accepted Answer

Auditing the employee's home computer is not a necessary task when an employee is terminated. The other three options are typically standard procedures to protect company data and ensure the security of the workplace.

Question 10

Which of the following policies makes it difficult for an individual to violate information security and is quite useful in monitoring financial affairs?
A) Task rotation
B) Two-man control
C) Separation of duties
D) Job rotation

Accepted Answer

Separation of duties is a policy that ensures no single individual has control over all aspects of a financial transaction, reducing the risk of fraud and errors.

Question 11

____ fall under the category of nonemployees that are typically hired to perform specific services for the organization.
A) Business partners
B) Temporary workers
C) Contractors
D) Consultants

Accepted Answer

Contractors are typically hired to perform specific services for an organization, but they are not considered regular employees. They are paid on a per-project basis and are responsible for their own taxes and benefits. Temporary workers may also be hired for specific services, but they are usually hired on a short-term basis and are paid by the organization, so they fall under a slightly different category. Business partners and consultants may also perform services for an organization, but they are usually more involved in the overall strategy and decision-making, rather than specific tasks or projects.

Question 12

____ is one of the practice areas covered by the CISM examination.
A) Infrastructure security
B) Communication security
C) Response management
D) Protection of information assets

Accepted Answer

The answer of ____ is one of the practice areas...

Question 13

Which of the following is a domain of the CompTIA Security+ exam?
A) General security concepts
B) Business risk management
C) IS audit process
D) Disaster recovery and business continuity

Accepted Answer

The CompTIA Security+ exam covers general security concepts, which include understanding threats, attacks, and vulnerabilities, as well as implementing security measures.

Question 14

____ should not be allowed to wander freely in and out of buildings.
A) Consultants
B) Business partners
C) Service contractors
D) Temporary workers

Accepted Answer

Service contractors should not be allowed to wander freely in and out of buildings as they may not be familiar with the premises and could pose a security risk.

Question 15

____ is a personnel security practice whereby all critical functions can be performed by multiple individuals.
A) Task rotation
B) Separation of duties
C) Job rotation
D) Two-man control

Accepted Answer

The answer of ____ is a personnel security practice whereby...

Question 16

____ work on special projects for organizations,and are self-employed people with their own contractual obligations and security requirements.
A) Consultants
B) Contractors
C) Business partners
D) Temporary workers

Accepted Answer

Consultants are self-employed professionals who work on special projects for organizations, often under their own contractual obligations and security requirements.

Question 17

Nondisclosure agreements are an important part of a collaborative effort between ____ who engage in strategic alliances so as to enjoy some mutual advantages.
A) business partners
B) temporary workers
C) consultants
D) contractors

Accepted Answer

Nondisclosure agreements are typically used between business partners who are collaborating on a strategic alliance or partnership. This allows them to share confidential information without risking it being shared with third parties. Temporary workers, consultants, and contractors may also sign nondisclosure agreements in certain situations, but they are not typically involved in strategic alliances.

Question 18

Job candidates can be given a(n)____ clause in their initial contract to compel them to agree to key policies,whereas existing employees are usually not.
A) employment contingent upon agreement
B) nondisclosure agreement
C) policy agreement and indemnification
D) liability assessment

Accepted Answer

The employment contingent upon agreement clause is typically included in the initial contract for job candidates to ensure that they agree to the company's key policies and to make their employment offer contingent upon their agreement. This clause is not typically included for existing employees, as they are already employed at the company and their agreement to key policies would have been established through their initial contract or previous employee agreements. The other options may also be included in employment contracts, but they do not specifically address the issue of compelling agreement to key policies.

Question 19

Which of the following is part of the employee termination process?
A) Orientation
B) Security checks
C) On-the-job security training
D) Exit interview

Accepted Answer

The exit interview is typically conducted as part of the employee termination process to gather feedback and insights from the departing employee. Orientation, security checks, and on-the-job security training are typically conducted during the onboarding process or while the employee is still employed.

Question 20

Adherence to the Information Systems Auditing Standards is a requirement of the ____ certification exam.
A) GIAC
B) SCP
C) CISSP
D) CISA

Accepted Answer

The Information Systems Auditing Standards are a core focus of the Certified Information Systems Auditor (CISA) certification exam. The other certifications listed may have some overlap with information systems auditing, but it is not their primary focus.

Quiz 11: Personnel and Security

Which of the following policies requires that every employee be able to perform the work of at least one other staff member?

The Certified Computer Examiner (CCE) certification is a computer forensics certification provided by the International Society of Forensic Computer Examiners.Which of the following is NOT part of the CCE certification process?

Which of the following is NOT a common type of background check that may be performed on a potential employee?

Which of the following policies requires that two individuals review and approve each other's work before the task is considered complete?

____ fall under the category of nonemployees that usually provide secretarial or administrative support.

From Schwartz et al.,information security positions can be categorized as those that define,those that build,and those that ____.

The ____ examination was developed by the International Society of Forensic Computer Examiners.

Which of the following is NOT part of the requirements for the CISM certification?

Which of the following is NOT a task that must be performed if an employee is terminated?

Which of the following policies makes it difficult for an individual to violate information security and is quite useful in monitoring financial affairs?

____ fall under the category of nonemployees that are typically hired to perform specific services for the organization.

____ is one of the practice areas covered by the CISM examination.

Which of the following is a domain of the CompTIA Security+ exam?

____ should not be allowed to wander freely in and out of buildings.

____ is a personnel security practice whereby all critical functions can be performed by multiple individuals.

____ work on special projects for organizations,and are self-employed people with their own contractual obligations and security requirements.

Nondisclosure agreements are an important part of a collaborative effort between ____ who engage in strategic alliances so as to enjoy some mutual advantages.

Job candidates can be given a(n) ____ clause in their initial contract to compel them to agree to key policies,whereas existing employees are usually not.

Which of the following is part of the employee termination process?

Adherence to the Information Systems Auditing Standards is a requirement of the ____ certification exam.