Question 1

​Information security policies are designed to provide structure in the workplace and explain the will of the organization's management.

Accepted Answer

A) True 
 B)False  True

Question 2

____________________ include the user access lists,matrices,and capability tables that govern the rights and privileges of users.

Accepted Answer

Access control listsACLs

Question 3

The responsibilities of both the users and the systems administrators with regard to specific systems administration duties should be specified in the ____________________ section of the ISSP.

Accepted Answer

Systems Management

Question 4

Non mandatory recommendations that the employee may use as a reference in complying with a policy.are known as regulations.

Accepted Answer

A) True 
 B)False

Question 5

What are configuration rules?  Provide examples.

Accepted Answer

Configuration rules are instructional co

Question 6

The three types of information security policies include the enterprise information security policy,the issue-specific security policy,and the ____________________ security policy.

Accepted Answer

system-spe

Question 7

Which of the following is an element of the enterprise information security policy?

Accepted Answer

A)  access control lists 
B)  information on the structure of the InfoSec organization 
C)  articulation of the organization's SDLC methodology 
D)  indemnification of the organization against liability 
A)  access control lists 
B)  information on the structure of the InfoSec organization 
C)  articulation of the organization's SDLC methodology 
D)  indemnification of the organization against liability

Question 8

Which of the following is a disadvantage of the individual policy approach to creating and managing ISSPs?

Accepted Answer

A)  can suffer from poor policy dissemintation, enforcement, and review 
B)  may skip vulnerabilities otherwise reported 
C)  may be more expensive than necessary 
D)  implementation can be less difficult to manage 
A)  can suffer from poor policy dissemintation, enforcement, and review 
B)  may skip vulnerabilities otherwise reported 
C)  may be more expensive than necessary 
D)  implementation can be less difficult to manage

Question 9

Which of the following is NOT one of the basic rules that must be followed when shaping a policy?

Accepted Answer

A)  policy should never conflict with law 
B)  policy must be able to stand up in court if challenged 
C)  policy should be agreed upon by all employees and management 
D)  policy must be properly supported and administered 
A)  policy should never conflict with law 
B)  policy must be able to stand up in court if challenged 
C)  policy should be agreed upon by all employees and management 
D)  policy must be properly supported and administered

Question 10

What is the final component of the design and implementation of effective policies?  Describe this component.

Accepted Answer

The final component of the design and im

Question 11

In the bull's-eye model,the ____________________ layer is the place where threats from public networks meet the organization's networking infrastructure.

Accepted Answer

The answer of In the bull's-eye model,the ____________________ layer is...

Question 12

​Examples of actions that illustrate compliance with policies are known as laws.

Accepted Answer

A) True 
 B)False

Question 13

The champion and manager of the information security policy is called the ____________________.

Accepted Answer

policy adm

Question 14

Which type of document is a more detailed statement of what must be done to comply with a policy?

Accepted Answer

A)  procedure 
B)  standard 
C)  guideline 
D)  practice 
A)  procedure 
B)  standard 
C)  guideline 
D)  practice

Question 15

The 'Authorized Uses' section of an ISSP specifies what the identified technology cannot be used for.

Accepted Answer

A) True 
 B)False

Question 16

How should a policy administrator facilitate policy reviews?

Accepted Answer

To facilitate policy reviews,the policy

Question 17

Which of the following are instructional codes that guide the execution of the system when information is passing through it?

Accepted Answer

A)  access control lists 
B)  user profiles 
C)  configuration rules 
D)  capability tables 
A)  access control lists 
B)  user profiles 
C)  configuration rules 
D)  capability tables

Question 18

Which of the following is NOT among the three types of InfoSec policies based on NIST's Special Publication 800-14?

Accepted Answer

A)  Enterprise information security policy 
B)  User-specific security policies 
C)  Issue-specific security policies 
D)  System-specific security policies 
A)  Enterprise information security policy 
B)  User-specific security policies 
C)  Issue-specific security policies 
D)  System-specific security policies

Question 19

A detailed statement of what must be done to comply with policy,sometimes viewed?as the rules governing policy compliance.

Accepted Answer

A)  capability table 
B)  statement of purpose 
C)  Bull's eye model 
D)  SysSP 
E)  Procedures
F) InfoSec policy
G) standard
H) access control lists
I) systems management
J) ISSP 
A)  capability table 
B)  statement of purpose 
C)  Bull's eye model 
D)  SysSP 
E)  Procedures
F) InfoSec policy
G) standard
H) access control lists
I) systems management
J) ISSP

Question 20

Since most policies are drafted by a single person and then reviewed by a higher-level manager,employee input should not be considered since it makes the process too complex.

Accepted Answer

A) True 
 B)False

Information security policies are designed to provide structure in the workplace and explain the will of the organization's management.

____________________ include the user access lists,matrices,and capability tables that govern the rights and privileges of users.

The responsibilities of both the users and the systems administrators with regard to specific systems administration duties should be specified in the ____________________ section of the ISSP.

Non mandatory recommendations that the employee may use as a reference in complying with a policy.are known as regulations.

What are configuration rules? Provide examples.

The three types of information security policies include the enterprise information security policy,the issue-specific security policy,and the ____________________ security policy.

Which of the following is an element of the enterprise information security policy?

Which of the following is a disadvantage of the individual policy approach to creating and managing ISSPs?

Which of the following is NOT one of the basic rules that must be followed when shaping a policy?

What is the final component of the design and implementation of effective policies? Describe this component.

In the bull's-eye model,the ____________________ layer is the place where threats from public networks meet the organization's networking infrastructure.

Examples of actions that illustrate compliance with policies are known as laws.

The champion and manager of the information security policy is called the ____________________.

Which type of document is a more detailed statement of what must be done to comply with a policy?

The 'Authorized Uses' section of an ISSP specifies what the identified technology cannot be used for.

How should a policy administrator facilitate policy reviews?

Which of the following are instructional codes that guide the execution of the system when information is passing through it?

Which of the following is NOT among the three types of InfoSec policies based on NIST's Special Publication 800-14?

A detailed statement of what must be done to comply with policy,sometimes viewed?as the rules governing policy compliance.

Since most policies are drafted by a single person and then reviewed by a higher-level manager,employee input should not be considered since it makes the process too complex.

Introduction to the Management of Information Security

Compliance: Law and Ethics

Governance and Strategic Planning for Security

Developing the Security Program

Risk Management: Identifying and Assessing Risk

Risk Management: Controlling Risk

Security Management Models

Security Management Practices

Planning for Contingencies

Personnel and Security

Protection Mechanisms

Filters

Exam 4: Information Security Policy

​Information security policies are designed to provide structure in the workplace and explain the will of the organization's management.

____________________ include the user access lists,matrices,and capability tables that govern the rights and privileges of users.

The responsibilities of both the users and the systems administrators with regard to specific systems administration duties should be specified in the ____________________ section of the ISSP.

Non mandatory recommendations that the employee may use as a reference in complying with a policy.are known as regulations.

What are configuration rules? Provide examples.

The three types of information security policies include the enterprise information security policy,the issue-specific security policy,and the ____________________ security policy.

Which of the following is an element of the enterprise information security policy?

Which of the following is a disadvantage of the individual policy approach to creating and managing ISSPs?

Which of the following is NOT one of the basic rules that must be followed when shaping a policy?

What is the final component of the design and implementation of effective policies? Describe this component.

In the bull's-eye model,the ____________________ layer is the place where threats from public networks meet the organization's networking infrastructure.

​Examples of actions that illustrate compliance with policies are known as laws.

The champion and manager of the information security policy is called the ____________________.

Which type of document is a more detailed statement of what must be done to comply with a policy?

The 'Authorized Uses' section of an ISSP specifies what the identified technology cannot be used for.

How should a policy administrator facilitate policy reviews?

Which of the following are instructional codes that guide the execution of the system when information is passing through it?

Which of the following is NOT among the three types of InfoSec policies based on NIST's Special Publication 800-14?

A detailed statement of what must be done to comply with policy,sometimes viewed?as the rules governing policy compliance.

Since most policies are drafted by a single person and then reviewed by a higher-level manager,employee input should not be considered since it makes the process too complex.

Introduction to the Management of Information Security

Compliance: Law and Ethics

Governance and Strategic Planning for Security

Developing the Security Program

Risk Management: Identifying and Assessing Risk

Risk Management: Controlling Risk

Security Management Models

Security Management Practices

Planning for Contingencies

Personnel and Security

Protection Mechanisms

Filters

Information security policies are designed to provide structure in the workplace and explain the will of the organization's management.

Examples of actions that illustrate compliance with policies are known as laws.