Question 1

Which of the following InfoSec measurement specifications makes it possible to define success in the security program?

Accepted Answer

A)  Development approach 
B)  Establishing targets 
C)  Prioritization and selection 
D)  Measurements templates 
A)  Development approach 
B)  Establishing targets 
C)  Prioritization and selection 
D)  Measurements templates

Question 2

List the four factors critical to the success of an InfoSec performance program,according to NIST SP 800-55,Rev.1.

Accepted Answer

Strong upper level management

Question 3

Performance measurements are seldom required in today's regulated InfoSec environment. ​

Accepted Answer

A) True 
 B)False

Question 4

Those security efforts that are considered among the best in theindustry.

Accepted Answer

A) accreditation 
B) baseline 
C) benchmarking 
D) certification 
E) due diligence
F)best security practices
G)recommended business practices
H)standard of due care
I)performance measurements
J)NIST SP 800-37 
A) accreditation 
B) baseline 
C) benchmarking 
D) certification 
E) due diligence
F)best security practices
G)recommended business practices
H)standard of due care
I)performance measurements
J)NIST SP 800-37

Question 5

In security management,which of the following is issued by a management official and serves as a means of assuring that systems are of adequate quality?

Accepted Answer

A)  Accreditation 
B)  Certification 
C)  Performance measurement 
D)  Testimonial 
A)  Accreditation 
B)  Certification 
C)  Performance measurement 
D)  Testimonial

Question 6

____________________ encompasses a requirement that the implemented standards continue to provide the required level of protection.

Accepted Answer

The answer of ____________________ encompasses a requirement that the implemented...

Question 7

A company striving for 'best security practices' makes every effort to establish security program elements that meet every minimum standard in their industry.

Accepted Answer

A) True 
 B)False

Question 8

Astandard of due process is a legal standard that requires an organization and its employees to actas a "reasonable and prudent" individual or organization would under similar circumstances.____________

Accepted Answer

A) True 
 B)False

Question 9

The biggest barrier tobaselining in InfoSec is the fact that many organizations do notshare warnings with other organizations.____________

Accepted Answer

A) True 
 B)False

Question 10

The authorization by an oversight authority of an IT system to process,store,ortransmit information is known as certification.____________

Accepted Answer

A) True 
 B)False

Question 11

A comprehensive assessment of a system's technical and nontechnical protectionstrategies,as specified by a particular set of requirements is known as ​accreditation.____________

Accepted Answer

A) True 
 B)False

Question 12

Those procedures that provide a superior level of security for an organization's information.

Accepted Answer

A) accreditation 
B) baseline 
C) benchmarking 
D) certification 
E) due diligence
F)best security practices
G)recommended business practices
H)standard of due care
I)performance measurements
J)NIST SP 800-37 
A) accreditation 
B) baseline 
C) benchmarking 
D) certification 
E) due diligence
F)best security practices
G)recommended business practices
H)standard of due care
I)performance measurements
J)NIST SP 800-37

Question 13

Best security practices balance the need for user _____________ to information with the need for adequate protection while simultaneously demonstrating fiscal responsibility.

Accepted Answer

The answer of Best security practices balance the need for...

Question 14

A performance measure is an an assessment of the performanceof some action or process against which futureperformance is assessed._____________

Accepted Answer

A) True 
 B)False

Question 15

What are the two major activities into which the InfoSec measurement development process recommended by NIST is divided?

Accepted Answer

1.Identification and definition of the c

Question 16

Problems with benchmarking include all but which of the following?

Accepted Answer

A)  Organizations don't often share information on successful attacks 
B)  Organizations being benchmarked are seldom identical 
C)  Recommended practices change and evolve, thus past performance is no indicator of future success 
D)  Benchmarking doesn't help in determining the desired outcome of the security process 
A)  Organizations don't often share information on successful attacks 
B)  Organizations being benchmarked are seldom identical 
C)  Recommended practices change and evolve, thus past performance is no indicator of future success 
D)  Benchmarking doesn't help in determining the desired outcome of the security process

Question 17

The last phase in the NIST performance measures implementation process is to apply ______________ actions which closes the gap found in Phase 2.

Accepted Answer

The answer of The last phase in the NIST performance...

Question 18

Which of the following terms is described as the process of designing,implementing,and managing the use of the collected data elements to determine the effectiveness of the overall security program?

Accepted Answer

A)  Performance management 
B)  Baselining 
C)  Best practices 
D)  Standards of due care/diligence 
A)  Performance management 
B)  Baselining 
C)  Best practices 
D)  Standards of due care/diligence

Question 19

The Authorize step of the NIST six-step approach to the risk management framework involves all but which of the following tasks?

Accepted Answer

A)  Prepare the plan of action and develop milestones 
B)  Assemble the security authorization package 
C)  Determine if the cost/benefit ratio is acceptable 
D)  Determine the risk to organizational operations 
A)  Prepare the plan of action and develop milestones 
B)  Assemble the security authorization package 
C)  Determine if the cost/benefit ratio is acceptable 
D)  Determine the risk to organizational operations

Which of the following InfoSec measurement specifications makes it possible to define success in the security program?

List the four factors critical to the success of an InfoSec performance program,according to NIST SP 800-55,Rev.1.

Performance measurements are seldom required in today's regulated InfoSec environment.

Those security efforts that are considered among the best in theindustry.

In security management,which of the following is issued by a management official and serves as a means of assuring that systems are of adequate quality?

____________________ encompasses a requirement that the implemented standards continue to provide the required level of protection.

A company striving for 'best security practices' makes every effort to establish security program elements that meet every minimum standard in their industry.

Astandard of due process is a legal standard that requires an organization and its employees to actas a "reasonable and prudent" individual or organization would under similar circumstances.____________

The biggest barrier tobaselining in InfoSec is the fact that many organizations do notshare warnings with other organizations.____________

The authorization by an oversight authority of an IT system to process,store,ortransmit information is known as certification.____________

A comprehensive assessment of a system's technical and nontechnical protectionstrategies,as specified by a particular set of requirements is known as accreditation.____________

Those procedures that provide a superior level of security for an organization's information.

Best security practices balance the need for user _____________ to information with the need for adequate protection while simultaneously demonstrating fiscal responsibility.

A performance measure is an an assessment of the performanceof some action or process against which futureperformance is assessed._____________

What are the two major activities into which the InfoSec measurement development process recommended by NIST is divided?

Problems with benchmarking include all but which of the following?

The last phase in the NIST performance measures implementation process is to apply ______________ actions which closes the gap found in Phase 2.

Which of the following terms is described as the process of designing,implementing,and managing the use of the collected data elements to determine the effectiveness of the overall security program?

The Authorize step of the NIST six-step approach to the risk management framework involves all but which of the following tasks?

Introduction to the Management of Information Security

Compliance: Law and Ethics

Governance and Strategic Planning for Security

Information Security Policy

Developing the Security Program

Risk Management: Identifying and Assessing Risk

Risk Management: Controlling Risk

Security Management Models

Planning for Contingencies

Personnel and Security

Protection Mechanisms

Filters

Exam 9: Security Management Practices

Which of the following InfoSec measurement specifications makes it possible to define success in the security program?

List the four factors critical to the success of an InfoSec performance program,according to NIST SP 800-55,Rev.1.

Performance measurements are seldom required in today's regulated InfoSec environment. ​

Those security efforts that are considered among the best in theindustry.

In security management,which of the following is issued by a management official and serves as a means of assuring that systems are of adequate quality?

____________________ encompasses a requirement that the implemented standards continue to provide the required level of protection.

A company striving for 'best security practices' makes every effort to establish security program elements that meet every minimum standard in their industry.

Astandard of due process is a legal standard that requires an organization and its employees to actas a "reasonable and prudent" individual or organization would under similar circumstances.____________

The biggest barrier tobaselining in InfoSec is the fact that many organizations do notshare warnings with other organizations.____________

The authorization by an oversight authority of an IT system to process,store,ortransmit information is known as certification.____________

A comprehensive assessment of a system's technical and nontechnical protectionstrategies,as specified by a particular set of requirements is known as ​accreditation.____________

Those procedures that provide a superior level of security for an organization's information.

Best security practices balance the need for user _____________ to information with the need for adequate protection while simultaneously demonstrating fiscal responsibility.

A performance measure is an an assessment of the performanceof some action or process against which futureperformance is assessed._____________

What are the two major activities into which the InfoSec measurement development process recommended by NIST is divided?

Problems with benchmarking include all but which of the following?

The last phase in the NIST performance measures implementation process is to apply ______________ actions which closes the gap found in Phase 2.

Which of the following terms is described as the process of designing,implementing,and managing the use of the collected data elements to determine the effectiveness of the overall security program?

The Authorize step of the NIST six-step approach to the risk management framework involves all but which of the following tasks?

Introduction to the Management of Information Security

Compliance: Law and Ethics

Governance and Strategic Planning for Security

Information Security Policy

Developing the Security Program

Risk Management: Identifying and Assessing Risk

Risk Management: Controlling Risk

Security Management Models

Planning for Contingencies

Personnel and Security

Protection Mechanisms

Filters

Performance measurements are seldom required in today's regulated InfoSec environment.

A comprehensive assessment of a system's technical and nontechnical protectionstrategies,as specified by a particular set of requirements is known as accreditation.____________