Question 1

Which of the following is likely in a small-business environment?

Accepted Answer

A)  Most small businesses employ a full-time information-technology staff. 
B)  Resources are available as needed. 
C)  Small businesses have security personnel on staff. 
D)  Most employees have experience with information security. 
E)  Security budgets are very small. 
A)  Most small businesses employ a full-time information-technology staff. 
B)  Resources are available as needed. 
C)  Small businesses have security personnel on staff. 
D)  Most employees have experience with information security. 
E)  Security budgets are very small.

Question 2

Which of the following entities review partner-extranet requirements?

Accepted Answer

A)  Information systems 
B)  Shipping and receiving 
C)  Marketing 
D)  Requesting department 
E)  Chief Information Officer 
A)  Information systems 
B)  Shipping and receiving 
C)  Marketing 
D)  Requesting department 
E)  Chief Information Officer

Question 3

Which of the following should be included in an enterprise Business Continuity Plan (BCP)? (Choose THREE.)

Accepted Answer

A)  Accidental or intentional data deletion 
B)  Severe weather disasters 
C)  Employee terminations 
D)  Employee administrative leave 
E)  Minor power outages 
A)  Accidental or intentional data deletion 
B)  Severe weather disasters 
C)  Employee terminations 
D)  Employee administrative leave 
E)  Minor power outages

Question 4

_________ educate(s) security administrators and end users about organizations' security policies.

Accepted Answer

A)  Security-awareness training 
B)  Information Security (INFOSE
C)  briefings 
C)  Acceptable-use policies 
D)  Continuing education 
E)  Nondisclosure agreements 
A)  Security-awareness training 
B)  Information Security (INFOSE
C)  briefings 
C)  Acceptable-use policies 
D)  Continuing education 
E)  Nondisclosure agreements

Question 5

Who should have physical access to network-connectivity devices and corporate servers?

Accepted Answer

A)  Customers and clients 
B)  Accounting, information-technology, and auditing staff 
C)  Managers and C-level executives 
D)  Only appropriate information-technology personnel 
E)  Only the maintenance staff 
A)  Customers and clients 
B)  Accounting, information-technology, and auditing staff 
C)  Managers and C-level executives 
D)  Only appropriate information-technology personnel 
E)  Only the maintenance staff

Question 6

Enterprise employees working remotely require access to data at an organization's headquarters. Which of the following is the BEST method to transfer this data?

Accepted Answer

A)  Standard e-mail 
B)  Faxed information 
C)  Dial-in access behind the enterprise firewall 
D)  Virtual private network 
E)  CD-ROMs shipped with updated versions of the data 
A)  Standard e-mail 
B)  Faxed information 
C)  Dial-in access behind the enterprise firewall 
D)  Virtual private network 
E)  CD-ROMs shipped with updated versions of the data

Question 7

Public servers are typically placed in the --------- to enhance security.

Accepted Answer

A)  Restricted Entry Zone 
B)  Open Zone 
C)  Internet Zone 
D)  Demilitarized Zone 
E)  Public Entry Zone 
A)  Restricted Entry Zone 
B)  Open Zone 
C)  Internet Zone 
D)  Demilitarized Zone 
E)  Public Entry Zone

Question 8

What is mandatory sign-on? An authentication method that:

Accepted Answer

A)  uses smart cards, hardware tokens, and biometrics to authenticate users; also known as three-factor authentication 
B)  requires the use of one-time passwords, so users authenticate only once, with a given set of credentials 
C)  requires users to re-authenticate at each server and access control 
D)  stores user credentials locally, so that users need only authenticate the first time a local machine is used 
E)  allows users to authenticate once, and then uses tokens or other credentials to manage subsequent authentication attempts 
A)  uses smart cards, hardware tokens, and biometrics to authenticate users; also known as three-factor authentication 
B)  requires the use of one-time passwords, so users authenticate only once, with a given set of credentials 
C)  requires users to re-authenticate at each server and access control 
D)  stores user credentials locally, so that users need only authenticate the first time a local machine is used 
E)  allows users to authenticate once, and then uses tokens or other credentials to manage subsequent authentication attempts

Question 9

All of the following are possible configurations for a corporate intranet, EXCEPT:

Accepted Answer

A)  Value-added network 
B)  Wide-area network 
C)  Campus-area network 
D)  Metropolitan-area network 
E)  Local-area network 
A)  Value-added network 
B)  Wide-area network 
C)  Campus-area network 
D)  Metropolitan-area network 
E)  Local-area network

Question 10

Which of these strategies can be employed to test training effectiveness? (Choose THREE.)

Accepted Answer

A)  Create a survey for managers, to see if participants practice behaviors presented during training. 
B)  Provide feedback forms for employees to rate instruction and training material, immediately after training has ended. 
C)  Include auditors before and after the training. This checks to see if the number of security-related incidents is reduced, because of the training. 
D)  Give incentives to employees who attend security-awareness training. Perform spot-checks, to see if incentives are displayed. 
E)  Test employees on security concepts several months after training has ended. 
A)  Create a survey for managers, to see if participants practice behaviors presented during training. 
B)  Provide feedback forms for employees to rate instruction and training material, immediately after training has ended. 
C)  Include auditors before and after the training. This checks to see if the number of security-related incidents is reduced, because of the training. 
D)  Give incentives to employees who attend security-awareness training. Perform spot-checks, to see if incentives are displayed. 
E)  Test employees on security concepts several months after training has ended.

Question 11

A(n)___________ is a one-way mathematical function that maps variable values into smaller values of a fixed length.

Accepted Answer

A)  Symmetric key 
B)  Algorithm 
C)  Back door 
D)  Hash function 
E)  Integrity 
A)  Symmetric key 
B)  Algorithm 
C)  Back door 
D)  Hash function 
E)  Integrity

Question 12

------------ is the process of subjects establishing who they are to an access control.

Accepted Answer

A)  Identification 
B)  Authentication 
C)  Authorization 
D)  Validation 
E)  Biometrics 
A)  Identification 
B)  Authentication 
C)  Authorization 
D)  Validation 
E)  Biometrics

Question 13

A __________ posture provides many levels of security possibilities, for access control.

Accepted Answer

A)  Layered defensive 
B)  Multiple offensive 
C)  Flat defensive 
D)  Reactive defensive 
E)  Proactive offensive 
A)  Layered defensive 
B)  Multiple offensive 
C)  Flat defensive 
D)  Reactive defensive 
E)  Proactive offensive

Question 14

When should procedures be evaluated?

Accepted Answer

A)  When new functional users join an organization 
B)  On the anniversary of the procedures' implementation 
C)  Each time procedures are used 
D)  Whenever business processes are modified 
E)  When new exploits and attacks are discovered 
A)  When new functional users join an organization 
B)  On the anniversary of the procedures' implementation 
C)  Each time procedures are used 
D)  Whenever business processes are modified 
E)  When new exploits and attacks are discovered

Question 15

Maintenance of the Business Continuity Plan (BCP) must be integrated with________an organization's process.

Accepted Answer

A)  Change-control 
B)  Disaster-recovery 
C)  Inventory-maintenance 
D)  Discretionary-budget 
E)  Compensation-review 
A)  Change-control 
B)  Disaster-recovery 
C)  Inventory-maintenance 
D)  Discretionary-budget 
E)  Compensation-review

Question 16

Distinguish between the role of the data owner and the role of the data custodian. Complete the following sentence. The data owner is the:

Accepted Answer

A)  department in the organization responsible for the data's physical storage location. The data custodian is anyone who has access the data for any reason. 
B)  person or entity who accesses/and or manipulates data or information, in the course of assigned duties. The data custodian is a person or process with the appropriate level of privilege to access the data. 
C)  person or entity ultimately responsible for the security of an information asset. The data custodian is the person or entity responsible for imposing and enforcing policies and restrictions, dictated by the data owner. 
D)  person or process that originally creates the information. The data custodian is a role that shifts to any person or process currently accessing the data, and passes to the next person or process to access the data. 
E)  person or entity responsible for imposing and enforcing policies and restrictions, dictated by the functional user. The data custodian is a person or process who accesses and/or manipulates the information. 
A)  department in the organization responsible for the data's physical storage location. The data custodian is anyone who has access the data for any reason. 
B)  person or entity who accesses/and or manipulates data or information, in the course of assigned duties. The data custodian is a person or process with the appropriate level of privilege to access the data. 
C)  person or entity ultimately responsible for the security of an information asset. The data custodian is the person or entity responsible for imposing and enforcing policies and restrictions, dictated by the data owner. 
D)  person or process that originally creates the information. The data custodian is a role that shifts to any person or process currently accessing the data, and passes to the next person or process to access the data. 
E)  person or entity responsible for imposing and enforcing policies and restrictions, dictated by the functional user. The data custodian is a person or process who accesses and/or manipulates the information.

Question 17

Which type of Business Continuity Plan (BCP) test involves shutting down z on-line, and moving all operations to the alternate site?

Accepted Answer

A)  Parallel 
B)  Full interruption 
C)  Checklist 
D)  Structured walkthrough 
E)  Simulation 
A)  Parallel 
B)  Full interruption 
C)  Checklist 
D)  Structured walkthrough 
E)  Simulation

Question 18

Why does the (ISC)2 access-control systems and methodology functional domain address both the confidentiality and integrity aspects of the Information Security Triad? Access-control systems and methodologies:

Accepted Answer

A)  are required standards in health care and banking. 
B)  provide redundant systems and data backups. 
C)  control who is allowed to view and modify information. 
D)  are academic models not suitable for implementation. 
E)  set standards for acceptable media-storage devices. 
A)  are required standards in health care and banking. 
B)  provide redundant systems and data backups. 
C)  control who is allowed to view and modify information. 
D)  are academic models not suitable for implementation. 
E)  set standards for acceptable media-storage devices.

Question 19

Which of the following statements about the maintenance and review of information security policies is NOT true?

Accepted Answer

A)  The review and maintenance of security policies should be tied to the performance evaluations of accountable individuals. 
B)  Review requirements should be included in the security policies themselves. 
C)  When business requirements change, security policies should be reviewed to confirm that policies reflect the new business requirements. 
D)  Functional users and information custodians are ultimately responsible for the accuracy and relevance of information security policies. 
E)  In the absence of changes to business requirements and processes, information-security policy reviews should be annual. 
A)  The review and maintenance of security policies should be tied to the performance evaluations of accountable individuals. 
B)  Review requirements should be included in the security policies themselves. 
C)  When business requirements change, security policies should be reviewed to confirm that policies reflect the new business requirements. 
D)  Functional users and information custodians are ultimately responsible for the accuracy and relevance of information security policies. 
E)  In the absence of changes to business requirements and processes, information-security policy reviews should be annual.

Question 20

Which TWO of the following items should be accomplished, when interviewing candidates for a position within an organization?

Accepted Answer

A)  Hire an investigation agency to run background checks. 
B)  Verify all dates of previous employment. 
C)  question candidates, using polygraphs, n 
D)  Contact personal and professional references. 
E)  Run criminal-background checks. 
A)  Hire an investigation agency to run background checks. 
B)  Verify all dates of previous employment. 
C)  question candidates, using polygraphs, n 
D)  Contact personal and professional references. 
E)  Run criminal-background checks.

Which of the following is likely in a small-business environment?

Which of the following entities review partner-extranet requirements?

Which of the following should be included in an enterprise Business Continuity Plan (BCP)? (Choose THREE.)

_________ educate(s) security administrators and end users about organizations' security policies.

Who should have physical access to network-connectivity devices and corporate servers?

Enterprise employees working remotely require access to data at an organization's headquarters. Which of the following is the BEST method to transfer this data?

Public servers are typically placed in the --------- to enhance security.

What is mandatory sign-on? An authentication method that:

All of the following are possible configurations for a corporate intranet, EXCEPT:

Which of these strategies can be employed to test training effectiveness? (Choose THREE.)

A(n)___________ is a one-way mathematical function that maps variable values into smaller values of a fixed length.

------------ is the process of subjects establishing who they are to an access control.

A __________ posture provides many levels of security possibilities, for access control.

When should procedures be evaluated?

Maintenance of the Business Continuity Plan (BCP) must be integrated with________an organization's process.

Distinguish between the role of the data owner and the role of the data custodian. Complete the following sentence. The data owner is the:

Which type of Business Continuity Plan (BCP) test involves shutting down z on-line, and moving all operations to the alternate site?

Why does the (ISC)2 access-control systems and methodology functional domain address both the confidentiality and integrity aspects of the Information Security Triad? Access-control systems and methodologies:

Which of the following statements about the maintenance and review of information security policies is NOT true?

Which TWO of the following items should be accomplished, when interviewing candidates for a position within an organization?

Check Point Certified Security Administrator (CCSA R80)

Check Point Certified Security Expert - R80

Filters

Exam 1: Check Point Certified Security Principles Associate (CCSPA)

Which of the following is likely in a small-business environment?

Which of the following entities review partner-extranet requirements?

Which of the following should be included in an enterprise Business Continuity Plan (BCP)? (Choose THREE.)

_________ educate(s) security administrators and end users about organizations' security policies.

Who should have physical access to network-connectivity devices and corporate servers?

Enterprise employees working remotely require access to data at an organization's headquarters. Which of the following is the BEST method to transfer this data?

Public servers are typically placed in the --------- to enhance security.

What is mandatory sign-on? An authentication method that:

All of the following are possible configurations for a corporate intranet, EXCEPT:

Which of these strategies can be employed to test training effectiveness? (Choose THREE.)

A(n)___________ is a one-way mathematical function that maps variable values into smaller values of a fixed length.

------------ is the process of subjects establishing who they are to an access control.

A __________ posture provides many levels of security possibilities, for access control.

When should procedures be evaluated?

Maintenance of the Business Continuity Plan (BCP) must be integrated with________an organization's process.

Distinguish between the role of the data owner and the role of the data custodian. Complete the following sentence. The data owner is the:

Which type of Business Continuity Plan (BCP) test involves shutting down z on-line, and moving all operations to the alternate site?

Why does the (ISC)2 access-control systems and methodology functional domain address both the confidentiality and integrity aspects of the Information Security Triad? Access-control systems and methodologies:

Which of the following statements about the maintenance and review of information security policies is NOT true?

Which TWO of the following items should be accomplished, when interviewing candidates for a position within an organization?

Check Point Certified Security Administrator (CCSA R80)

Check Point Certified Security Expert - R80

Filters