Question 1

Match each item with a statement below.
-Informal part of an organization's culture.

Accepted Answer

A) managerial guidance SysSP document 
B) security training 
C) incident response 
D) business continuity plan 
E) information security policy
F)de jure
G)de facto
H)security blueprint
I)business impact analysis 
A) managerial guidance SysSP document 
B) security training 
C) incident response 
D) business continuity plan 
E) information security policy
F)de jure
G)de facto
H)security blueprint
I)business impact analysis G

Question 2

Match each item with a statement below.
-Ensures that critical business functions continue if a catastrophic incident or disaster occurs.

Accepted Answer

A) managerial guidance SysSP document 
B) security training 
C) incident response 
D) business continuity plan 
E) information security policy
F)de jure
G)de facto
H)security blueprint
I)business impact analysis 
A) managerial guidance SysSP document 
B) security training 
C) incident response 
D) business continuity plan 
E) information security policy
F)de jure
G)de facto
H)security blueprint
I)business impact analysis D

Question 3

An attack scenario end case is categorized ____.

Accepted Answer

A)  as business-ending or salvageable 
B)  on a scale of 1-10 
C)  according to a grade of A-F. 
D)  either as disastrous or not disastrous 
A)  as business-ending or salvageable 
B)  on a scale of 1-10 
C)  according to a grade of A-F. 
D)  either as disastrous or not disastrous D

Question 4

The details of the allowable use of company-owned networks and the Internet would most likely be covered in the enterprise information security policy.

Accepted Answer

A) True 
 B)False

Question 5

Policies are put in place to support the organization's mission, vision, and strategic planning.

Accepted Answer

A) True 
 B)False

Question 6

____________________ management differs dramatically from incident response, as it focuses first and foremost on the people involved.

Accepted Answer

The answer of ____________________ management differs dramatically from incident response,...

Question 7

Attack profiles should include scenarios depicting a typical attack, with details on the method, the indicators, and the broad consequences of the attack.

Accepted Answer

A) True 
 B)False

Question 8

Within the IETF, the Security Area Working Group acts as an advisory board for security topics that affect the various Internet-related protocols.

Accepted Answer

A) True 
 B)False

Question 9

Explain the difference between a policy and a standard.

Accepted Answer

A policy is a set of guidelines or instr

Question 10

Match each item with a statement below.
-Set of rules for the protection of an organization's information assets.

Accepted Answer

A) managerial guidance SysSP document 
B) security training 
C) incident response 
D) business continuity plan 
E) information security policy
F)de jure
G)de facto
H)security blueprint
I)business impact analysis 
A) managerial guidance SysSP document 
B) security training 
C) incident response 
D) business continuity plan 
E) information security policy
F)de jure
G)de facto
H)security blueprint
I)business impact analysis

Question 11

Explain how access control lists might be implemented.

Accepted Answer

A capability table specifies the subject

Question 12

A security framework specifies the tasks for deploying security tools in the order in which they are to be accomplished.

Accepted Answer

A) True 
 B)False

Question 13

Match each item with a statement below.
-The set of activities taken to plan for, detect, and correct the impact of an incident on information assets.

Accepted Answer

A) managerial guidance SysSP document 
B) security training 
C) incident response 
D) business continuity plan 
E) information security policy
F)de jure
G)de facto
H)security blueprint
I)business impact analysis 
A) managerial guidance SysSP document 
B) security training 
C) incident response 
D) business continuity plan 
E) information security policy
F)de jure
G)de facto
H)security blueprint
I)business impact analysis

Question 14

What are spheres of security? Provide examples illustrating the different components.

Accepted Answer

Spheres of security are the generalized

Question 15

A(n) ____________________ is also known as a general security policy, an IT security policy, or an information security policy.

Accepted Answer

enterprise

Question 16

Explain what might happen if managerial guidance SysSP documents have not been written or provided to technical staff.

Accepted Answer

Imagine that management fails to convey

Question 17

A(n) ____ is an attack against an information asset that poses a clear threat to the confidentiality, integrity, or availability of information resources.

Accepted Answer

A)  incident 
B)  disaster 
C)  crisis 
D)  recovery 
A)  incident 
B)  disaster 
C)  crisis 
D)  recovery

Question 18

The first phase in the development of the contingency planning process is the ____.

Accepted Answer

A)  crisis plan 
B)  disaster recovery plan 
C)  incident response plan 
D)  business impact analysis 
A)  crisis plan 
B)  disaster recovery plan 
C)  incident response plan 
D)  business impact analysis

Question 19

RFC 2196: Site Security Handbook is produced by ____.

Accepted Answer

A)  the ISO 
B)  NIST 
C)  the Security Area Working Group 
D)  the Federal Agency Security Practices 
A)  the ISO 
B)  NIST 
C)  the Security Area Working Group 
D)  the Federal Agency Security Practices

Question 20

The ____ is created by a systems administer to direct practices with many details.

Accepted Answer

A)  EISP 
B)  ISSP 
C)  managerial guidance SysSP 
D)  technical specification SysSP 
A)  EISP 
B)  ISSP 
C)  managerial guidance SysSP 
D)  technical specification SysSP

Match each item with a statement below. -Informal part of an organization's culture.

Match each item with a statement below. -Ensures that critical business functions continue if a catastrophic incident or disaster occurs.

An attack scenario end case is categorized ____.

The details of the allowable use of company-owned networks and the Internet would most likely be covered in the enterprise information security policy.

Policies are put in place to support the organization's mission, vision, and strategic planning.

____________________ management differs dramatically from incident response, as it focuses first and foremost on the people involved.

Attack profiles should include scenarios depicting a typical attack, with details on the method, the indicators, and the broad consequences of the attack.

Within the IETF, the Security Area Working Group acts as an advisory board for security topics that affect the various Internet-related protocols.

Explain the difference between a policy and a standard.

Match each item with a statement below. -Set of rules for the protection of an organization's information assets.

Explain how access control lists might be implemented.

A security framework specifies the tasks for deploying security tools in the order in which they are to be accomplished.

Match each item with a statement below. -The set of activities taken to plan for, detect, and correct the impact of an incident on information assets.

What are spheres of security? Provide examples illustrating the different components.

A(n) ____________________ is also known as a general security policy, an IT security policy, or an information security policy.

Explain what might happen if managerial guidance SysSP documents have not been written or provided to technical staff.

A(n) ____ is an attack against an information asset that poses a clear threat to the confidentiality, integrity, or availability of information resources.

The first phase in the development of the contingency planning process is the ____.

RFC 2196: Site Security Handbook is produced by ____.

The ____ is created by a systems administer to direct practices with many details.

Introduction to Information Security

Authenticating Users

Introduction to Firewalls

Packet Filtering

Firewall Configuration and Administration

Working With Proxy Servers and Application-Level Firewalls

Implementing the Bastion Host

Encryption - The Foundation for the Virtual Private Network

Setting up a Virtual Private Network

Filters

Exam 2: Security Policies and Standards

Match each item with a statement below. -Informal part of an organization's culture.

Match each item with a statement below. -Ensures that critical business functions continue if a catastrophic incident or disaster occurs.

An attack scenario end case is categorized ____.

The details of the allowable use of company-owned networks and the Internet would most likely be covered in the enterprise information security policy.

Policies are put in place to support the organization's mission, vision, and strategic planning.

____________________ management differs dramatically from incident response, as it focuses first and foremost on the people involved.

Attack profiles should include scenarios depicting a typical attack, with details on the method, the indicators, and the broad consequences of the attack.

Within the IETF, the Security Area Working Group acts as an advisory board for security topics that affect the various Internet-related protocols.

Explain the difference between a policy and a standard.

Match each item with a statement below. -Set of rules for the protection of an organization's information assets.

Explain how access control lists might be implemented.

A security framework specifies the tasks for deploying security tools in the order in which they are to be accomplished.

Match each item with a statement below. -The set of activities taken to plan for, detect, and correct the impact of an incident on information assets.

What are spheres of security? Provide examples illustrating the different components.

A(n) ____________________ is also known as a general security policy, an IT security policy, or an information security policy.

Explain what might happen if managerial guidance SysSP documents have not been written or provided to technical staff.

A(n) ____ is an attack against an information asset that poses a clear threat to the confidentiality, integrity, or availability of information resources.

The first phase in the development of the contingency planning process is the ____.

RFC 2196: Site Security Handbook is produced by ____.

The ____ is created by a systems administer to direct practices with many details.

Introduction to Information Security

Authenticating Users

Introduction to Firewalls

Packet Filtering

Firewall Configuration and Administration

Working With Proxy Servers and Application-Level Firewalls

Implementing the Bastion Host

Encryption - The Foundation for the Virtual Private Network

Setting up a Virtual Private Network

Filters