Question 1

Which of the following is NOT among the three types of InfoSec policies based on NIST's Special Publication 800-14?

Accepted Answer

A)  Enterprise information security policy 
B)  User-specific security policies 
C)  Issue-specific security policies 
D)  System-specific security policies 
A)  Enterprise information security policy 
B)  User-specific security policies 
C)  Issue-specific security policies 
D)  System-specific security policies

Question 2

What is the final component of the design and implementation of effective policies?Describe this component.

Accepted Answer

The final component of the design and im

Question 3

A section of policy that should specify users' and systems administrators' responsibilities.

Accepted Answer

A) capability table 
B) statement of purpose 
C) Bull's eye model 
D) SysSP 
E) procedures
F)InfoSec policy
G)standard
H)access control lists
I)systems management
J)ISSP 
A) capability table 
B) statement of purpose 
C) Bull's eye model 
D) SysSP 
E) procedures
F)InfoSec policy
G)standard
H)access control lists
I)systems management
J)ISSP

Question 4

A(n)____________________,which is usually presented on a screen to the user during software installation,spells out fair and responsible use of the software being installed.

Accepted Answer

end-user license agr

Question 5

According to NIST SP 800-18,Rev.1,whichindividual is responsible for the creation,revision,distribution,and storage of the policy?

Accepted Answer

A)  policy developer 
B)  policy reviewer 
C)  policy enforcer 
D)  policy administrator 
A)  policy developer 
B)  policy reviewer 
C)  policy enforcer 
D)  policy administrator

Question 6

What are configuration rules?Provide examples.

Accepted Answer

Configuration rules are instructional co

Question 7

An organizational policy that provides detailed,targetedguidance to instruct all members of the organization in the use of a resource,such as one of itsprocesses or technologies.

Accepted Answer

A) capability table 
B) statement of purpose 
C) Bull's eye model 
D) SysSP 
E) procedures
F)InfoSec policy
G)standard
H)access control lists
I)systems management
J)ISSP 
A) capability table 
B) statement of purpose 
C) Bull's eye model 
D) SysSP 
E) procedures
F)InfoSec policy
G)standard
H)access control lists
I)systems management
J)ISSP

Question 8

Examples of actions that illustrate compliance with policies are known as laws.

Accepted Answer

A) True 
 B)False

Question 9

In the bull's-eye model,the ____________________ layer is the place where threats from public networks meet the organization's networking infrastructure.

Accepted Answer

The answer of In the bull's-eye model,the ____________________ layer is...

Question 10

What is a SysSP and what is one likely to include?

Accepted Answer

SysSPs often function as standards or pr

Question 11

The three types of information security policies include the enterprise information security policy,the issue-specific security policy,and the ____________________ security policy.

Accepted Answer

system-spe

Question 12

Which section of an ISSP should outline a specific methodology for the review and modification of the ISSP?

Accepted Answer

A)  Policy Review and Modification 
B)  Limitations of Liability 
C)  Systems Management 
D)  Statement of Purpose 
A)  Policy Review and Modification 
B)  Limitations of Liability 
C)  Systems Management 
D)  Statement of Purpose

Question 13

List the major components of the ISSP.

Accepted Answer

Statement of Purpose Authorize

Question 14

The 'Authorized Uses' section of an ISSP specifies what the identified technology cannot be used for.

Accepted Answer

A) True 
 B)False

Question 15

A detailed outline of the scope of the policy development project is created during which phase of the SecSDLC?

Accepted Answer

A)  design 
B)  analysis 
C)  implementation 
D)  investigation 
A)  design 
B)  analysis 
C)  implementation 
D)  investigation

Question 16

Technology is the essential foundation of an effective information security program​._____________

Accepted Answer

A) True 
 B)False

Which of the following is NOT among the three types of InfoSec policies based on NIST's Special Publication 800-14?

What is the final component of the design and implementation of effective policies?Describe this component.

A section of policy that should specify users' and systems administrators' responsibilities.

A(n)____________________,which is usually presented on a screen to the user during software installation,spells out fair and responsible use of the software being installed.

According to NIST SP 800-18,Rev.1,whichindividual is responsible for the creation,revision,distribution,and storage of the policy?

What are configuration rules?Provide examples.

An organizational policy that provides detailed,targetedguidance to instruct all members of the organization in the use of a resource,such as one of itsprocesses or technologies.

Examples of actions that illustrate compliance with policies are known as laws.

In the bull's-eye model,the ____________________ layer is the place where threats from public networks meet the organization's networking infrastructure.

What is a SysSP and what is one likely to include?

The three types of information security policies include the enterprise information security policy,the issue-specific security policy,and the ____________________ security policy.

Which section of an ISSP should outline a specific methodology for the review and modification of the ISSP?

List the major components of the ISSP.

The 'Authorized Uses' section of an ISSP specifies what the identified technology cannot be used for.

A detailed outline of the scope of the policy development project is created during which phase of the SecSDLC?

Technology is the essential foundation of an effective information security program._____________

Introduction to the Management of Information Security

Compliance: Law and Ethics

Governance and Strategic Planning for Security

Developing the Security Program

Risk Management: Identifying and Assessing Risk

Risk Management: Controlling Risk

Security Management Models

Security Management Practices

Planning for Contingencies

Personnel and Security

Protection Mechanisms

Filters

Exam 4: Information Security Policy

Which of the following is NOT among the three types of InfoSec policies based on NIST's Special Publication 800-14?

What is the final component of the design and implementation of effective policies?Describe this component.

A section of policy that should specify users' and systems administrators' responsibilities.

A(n)____________________,which is usually presented on a screen to the user during software installation,spells out fair and responsible use of the software being installed.

According to NIST SP 800-18,Rev.1,whichindividual is responsible for the creation,revision,distribution,and storage of the policy?

What are configuration rules?Provide examples.

An organizational policy that provides detailed,targetedguidance to instruct all members of the organization in the use of a resource,such as one of itsprocesses or technologies.

Examples of actions that illustrate compliance with policies are known as laws.

In the bull's-eye model,the ____________________ layer is the place where threats from public networks meet the organization's networking infrastructure.

What is a SysSP and what is one likely to include?

The three types of information security policies include the enterprise information security policy,the issue-specific security policy,and the ____________________ security policy.

Which section of an ISSP should outline a specific methodology for the review and modification of the ISSP?

List the major components of the ISSP.

The 'Authorized Uses' section of an ISSP specifies what the identified technology cannot be used for.

A detailed outline of the scope of the policy development project is created during which phase of the SecSDLC?

Technology is the essential foundation of an effective information security program​._____________

Introduction to the Management of Information Security

Compliance: Law and Ethics

Governance and Strategic Planning for Security

Developing the Security Program

Risk Management: Identifying and Assessing Risk

Risk Management: Controlling Risk

Security Management Models

Security Management Practices

Planning for Contingencies

Personnel and Security

Protection Mechanisms

Filters

Technology is the essential foundation of an effective information security program._____________