Question 1

The biggest barrier tobaselining in InfoSec is the fact that many organizations do notshare warnings with other organizations.____________

Accepted Answer

benchmarking

Question 2

One question you should ask when choosing among recommended practices is "Can your organization afford to implement the recommended practice?"

Accepted Answer

It is important to consider the cost and resources required to implement recommended practices, as not all organizations may have the necessary resources to do so.

Question 3

One of the critical tasks in the measurement process is to assess and quantify what willbe measured and how it is measured.____________

Accepted Answer

This statement is true. In order to obtain accurate and meaningful results, it is important to define what is being measured and how it will be measured using clear and specific criteria.

Question 4

Problems with benchmarking include all but which of the following?
A) Organizations don't often share information on successful attacks
B) Organizations being benchmarked are seldom identical
C) Recommended practices change and evolve, thus past performance is no indicator of future success
D) Benchmarking doesn't help in determining the desired outcome of the security process

Accepted Answer

Benchmarking can help in determining the desired outcome of the security process. This option is incorrect. The problems with benchmarking include organizations not sharing information on successful attacks, organizations being benchmarked not being identical, and recommended practices changing and evolving.

Question 5

Attaining certification in security management is a long and difficult process,but once attained,an organization remains certified for the life of the organization.

Accepted Answer

Attaining certification in security management requires ongoing maintenance and renewal, typically every few years. Therefore, an organization cannot remain certified for the life of the organization without effort to maintain the certification.

Question 6

Creating a blueprint by looking at the paths taken by organizations similar to the one whose plan you are developing is known as which of the following?
A) benchmarking
B) best practices
C) baselining
D) due diligence

Accepted Answer

Benchmarking involves studying the methods and performance of other organizations in order to identify the best techniques and practices. This information is then used to create a blueprint that can guide the development of a new plan or strategy. Best practices may be one of the elements considered during benchmarking, but they are not the same thing as benchmarking itself. Baselining refers to the process of establishing a starting point or baseline for measuring progress over time, while due diligence involves conducting a thorough investigation and analysis of a potential investment or business opportunity.

Question 7

Using a practice called baselining,you are able to develop policy based on the typical practices of the industry in which you are working.

Accepted Answer

The answer of Using a practice called baselining,you are able...

Question 8

Recommended practices are those security efforts that seek to provide a superior level of performancein the protection of information.____________

Accepted Answer

Recommended practices are indeed security efforts that aim to provide a higher level of performance in protecting information, as they represent best practices, industry standards, and expert recommendations that have been tested and proven to be effective in reducing risks, improving resilience, and enhancing trustworthiness. Examples of recommended practices in cybersecurity include implementing strong authentication, using encryption, keeping software up-to-date, performing regular backups, conducting security awareness training, and adhering to regulatory compliance requirements.

Question 9

A comprehensive assessment of a system's technical and nontechnical protectionstrategies,as specified by a particular set of requirements is known as accreditation.____________

Accepted Answer

certification

Question 10

Data or the trends in data that may indicate the effectiveness ofsecurity countermeasures or controls-technical and managerial-implemented in theorganization are known as program measurements.____________

Accepted Answer

performance

Question 11

A company striving for 'best security practices' makes every effort to establish security program elements that meet every minimum standard in their industry.

Accepted Answer

"Best security practices" go beyond just meeting minimum standards and strive for excellence in all aspects of security. While meeting industry standards is important, it is not enough to ensure the highest level of security.

Question 12

Which of the following is a possible result of failure to establish and maintain standards of due care and due diligence?
A) Baselining
B) Legal liability
C) Competitive disadvantage
D) Certification revocation

Accepted Answer

Failure to establish and maintain standards of due care and due diligence can result in legal liability, as the organization may be held accountable for any damages or losses resulting from their negligence. Baselining refers to establishing a benchmark for measuring performance, and certification revocation is a consequence of failing to meet the standards required for a particular certification. Competitive disadvantage may be a possible consequence of not maintaining standards, but it is not as direct or immediate as legal liability.

Question 13

Which of the following is NOT a question to be used as a self-assessment for recommended security practices in the category of people?
A) Do you perform background checks on all employees with access to sensitive data,
Areas, or access points?
B) Are the user accounts of former employees immediately removed on termination?
C) Would the typical employee recognize a security issue?
D) Would the typical employee know how to report a security issue to the right people?

Accepted Answer

The answer of Which of the following is NOT a...

Question 14

What are the legal requirements that an organization adopt a standard based on what a prudent organization should do,and then maintain that standard?
A) Certification and accreditation
B) Best practices
C) Due care and due diligence
D) Baselining and benchmarking

Accepted Answer

The legal requirements for organizations to adopt and maintain a standard based on what a prudent organization should do are due care and due diligence. Due care refers to the actions that a prudent organization would take to safeguard its assets, while due diligence refers to the ongoing monitoring and maintenance of those safeguards. Certification and accreditation, best practices, and baselining and benchmarking are all related to the process of implementing and measuring the effectiveness of a standard, but they do not necessarily constitute legal requirements.

Question 15

Standardization is an an attempt to improve information security practices by comparing anorganization's efforts against those of a similar organization or an industry-developedstandard to produce results it would like to duplicate.____________

Accepted Answer

Benchmarking

Question 16

Performance measurements are seldom required in today's regulated InfoSec environment. ​

Accepted Answer

Performance measurements are often required in regulated InfoSec environments as a way to measure compliance and effectiveness of security controls. Organizations are required to conduct assessments of their security posture, measure the effectiveness of their security controls, and report on performance to regulatory bodies. Failure to meet performance standards can result in penalties or loss of certification.

Question 17

The authorization by an oversight authority of an IT system to process,store,ortransmit information is known as certification.____________

Accepted Answer

accreditation

Question 18

Which of the following is NOT a consideration when selecting recommended best practices?
A) Threat environment is similar
B) Resource expenditures are practical
C) Organization structure is similar
D) Same certification and accreditation agency or standard

Accepted Answer

The same certification and accreditation agency or standard can be a consideration when selecting recommended best practices, but it is not the only consideration. The other choices, such as threat environment, resource expenditures, and organization structure, should also be taken into account.

Question 19

A performance measure is an an assessment of the performanceof some action or process against which futureperformance is assessed._____________

Accepted Answer

baseline

Question 20

Astandard of due process is a legal standard that requires an organization and its employees to actas a "reasonable and prudent" individual or organization would under similar circumstances.____________

Accepted Answer

care

Quiz 9: Security Management Practices

The biggest barrier tobaselining in InfoSec is the fact that many organizations do notshare warnings with other organizations.____________

One question you should ask when choosing among recommended practices is "Can your organization afford to implement the recommended practice?"

One of the critical tasks in the measurement process is to assess and quantify what willbe measured and how it is measured.____________

Problems with benchmarking include all but which of the following?

Attaining certification in security management is a long and difficult process,but once attained,an organization remains certified for the life of the organization.

Creating a blueprint by looking at the paths taken by organizations similar to the one whose plan you are developing is known as which of the following?

Using a practice called baselining,you are able to develop policy based on the typical practices of the industry in which you are working.

Recommended practices are those security efforts that seek to provide a superior level of performancein the protection of information.____________

A comprehensive assessment of a system's technical and nontechnical protectionstrategies,as specified by a particular set of requirements is known as ​accreditation.____________

Data or the trends in data that may indicate the effectiveness ofsecurity countermeasures or controls-technical and managerial-implemented in theorganization are known as program measurements.____________

A company striving for 'best security practices' makes every effort to establish security program elements that meet every minimum standard in their industry.

Which of the following is a possible result of failure to establish and maintain standards of due care and due diligence?

Which of the following is NOT a question to be used as a self-assessment for recommended security practices in the category of people?

What are the legal requirements that an organization adopt a standard based on what a prudent organization should do,and then maintain that standard?