Question 1

When choosing from among recommended practices,an organization should consider a number of questions.List four.

Accepted Answer

Does your organization resemble the targ

Question 2

Production-level statistics depend greatly on the number of ____.

Accepted Answer

A)  performance measures developed 
B)  systems and users of those systems 
C)  threats and attacks 
D)  activities and goals implemented by the business unit 
A)  performance measures developed 
B)  systems and users of those systems 
C)  threats and attacks 
D)  activities and goals implemented by the business unit

Question 3

Organizations that adopt minimum levels of security to establish a future legal defense may need to verify that they have done what any ____________________ organization would do in similar circumstances.

Accepted Answer

prudent
 r

Question 4

It is no longer sufficient to simply assert effective information security; an organization must demonstrate that it is taking effective measures in the spirit of ____________________.

Accepted Answer

due dilige

Question 5

NIST recommends the documentation of performance measures in a format to ensure ____ of measures development,tailoring,collection,and reporting activities.

Accepted Answer

A)  effectiveness 
B)  efficiency 
C)  repeatability 
D)  accountability 
A)  effectiveness 
B)  efficiency 
C)  repeatability 
D)  accountability

Question 6

Even with strong management support,an information security measures program must be able to demonstrate due care to the organization._________________________

Accepted Answer

A) True 
 B)False

Question 7

Organizations that adopt minimum levels of security to establish a future legal defense may need to verify that they have done what any prudent organization would do in similar circumstances; this is known as a standard of due care.

Accepted Answer

A) True 
 B)False

Question 8

Organizations must consider all but which of the following during development and implementation of an information security measurement program?

Accepted Answer

A)  Measures must yield quantifiable information (percentages, averages, and numbers) 
B)  Data that supports the measures needs to be readily obtainable 
C)  Only repeatable information security processes should be considered for measurement 
D)  Measures must be useful for tracking shortfalls in organizational resources 
A)  Measures must yield quantifiable information (percentages, averages, and numbers) 
B)  Data that supports the measures needs to be readily obtainable 
C)  Only repeatable information security processes should be considered for measurement 
D)  Measures must be useful for tracking shortfalls in organizational resources

Question 9

Performance ____ make it possible to define success in the security program.

Accepted Answer

A)  measures 
B)  targets 
C)  programs 
D)  none of these 
A)  measures 
B)  targets 
C)  programs 
D)  none of these

Question 10

A best practice is a "value or profile of a performance metric against which changes in the performance metric can be usefully compared."

Accepted Answer

A) True 
 B)False

Question 11

Measures are data points or computed trends that may indicate the effectiveness of security countermeasures or controls-technical and managerial-as implemented in the organization._________________________

Accepted Answer

A) True 
 B)False

Question 12

While the terms may be interchangeable in some organizations,typically the term ____ is used for more granular,detailed measurement,while the term ____ is used for aggregate,higher-level results.

Accepted Answer

A)  details; summaries 
B)  objectives; outcomes 
C)  measures; metrics 
D)  metrics; measures 
A)  details; summaries 
B)  objectives; outcomes 
C)  measures; metrics 
D)  metrics; measures

Question 13

Creating a blueprint by looking at the paths taken by organizations similar to the one whose plan you are developing is known as ____.

Accepted Answer

A)  benchmarking 
B)  best practices 
C)  baselining 
D)  standards of due care 
A)  benchmarking 
B)  best practices 
C)  baselining 
D)  standards of due care

Question 14

____________________ is defined as "the comprehensive evaluation of the technical and nontechnical security controls of an IT system to support the accreditation process that establishes the extent to which a particular design and implementation meets a set of specified security requirements."

Accepted Answer

The answer of ____________________ is defined as "the comprehensive evaluation...

When choosing from among recommended practices,an organization should consider a number of questions.List four.

Production-level statistics depend greatly on the number of ____.

Organizations that adopt minimum levels of security to establish a future legal defense may need to verify that they have done what any ____________________ organization would do in similar circumstances.

It is no longer sufficient to simply assert effective information security; an organization must demonstrate that it is taking effective measures in the spirit of ____________________.

NIST recommends the documentation of performance measures in a format to ensure ____ of measures development,tailoring,collection,and reporting activities.

Even with strong management support,an information security measures program must be able to demonstrate due care to the organization._________________________

Organizations that adopt minimum levels of security to establish a future legal defense may need to verify that they have done what any prudent organization would do in similar circumstances; this is known as a standard of due care.

Organizations must consider all but which of the following during development and implementation of an information security measurement program?

Performance ____ make it possible to define success in the security program.

A best practice is a "value or profile of a performance metric against which changes in the performance metric can be usefully compared."

Measures are data points or computed trends that may indicate the effectiveness of security countermeasures or controls-technical and managerial-as implemented in the organization._________________________

While the terms may be interchangeable in some organizations,typically the term is used for more granular,detailed measurement,while the term is used for aggregate,higher-level results.

Creating a blueprint by looking at the paths taken by organizations similar to the one whose plan you are developing is known as ____.

____________________ is defined as "the comprehensive evaluation of the technical and nontechnical security controls of an IT system to support the accreditation process that establishes the extent to which a particular design and implementation meets a set of specified security requirements."

Introduction to the Management of Information Security

Planning for Security

Planning for Contingencies

Information Security Policy

Developing the Security Program

Security Management Models

Risk Management: Identifying and Assessing Risk

Risk Management: Controlling Risk

Protection Mechanisms

Personnel and Security

Law and Ethics

Filters

Exam 7: Security Management Practices

When choosing from among recommended practices,an organization should consider a number of questions.List four.

Production-level statistics depend greatly on the number of ____.

Organizations that adopt minimum levels of security to establish a future legal defense may need to verify that they have done what any ____________________ organization would do in similar circumstances.

It is no longer sufficient to simply assert effective information security; an organization must demonstrate that it is taking effective measures in the spirit of ____________________.

NIST recommends the documentation of performance measures in a format to ensure ____ of measures development,tailoring,collection,and reporting activities.

Even with strong management support,an information security measures program must be able to demonstrate due care to the organization._________________________

Organizations that adopt minimum levels of security to establish a future legal defense may need to verify that they have done what any prudent organization would do in similar circumstances; this is known as a standard of due care.

Organizations must consider all but which of the following during development and implementation of an information security measurement program?

Performance ____ make it possible to define success in the security program.

A best practice is a "value or profile of a performance metric against which changes in the performance metric can be usefully compared."

Measures are data points or computed trends that may indicate the effectiveness of security countermeasures or controls-technical and managerial-as implemented in the organization._________________________

While the terms may be interchangeable in some organizations,typically the term ____ is used for more granular,detailed measurement,while the term ____ is used for aggregate,higher-level results.

Creating a blueprint by looking at the paths taken by organizations similar to the one whose plan you are developing is known as ____.

____________________ is defined as "the comprehensive evaluation of the technical and nontechnical security controls of an IT system to support the accreditation process that establishes the extent to which a particular design and implementation meets a set of specified security requirements."

Introduction to the Management of Information Security

Planning for Security

Planning for Contingencies

Information Security Policy

Developing the Security Program

Security Management Models

Risk Management: Identifying and Assessing Risk

Risk Management: Controlling Risk

Protection Mechanisms

Personnel and Security

Law and Ethics

Filters

While the terms may be interchangeable in some organizations,typically the term is used for more granular,detailed measurement,while the term is used for aggregate,higher-level results.