Question 1

From the perspective of information security, HIPAA defines

Accepted Answer

A)  Requirements for financial institutions to protect the privacy of their customers' non-public, personal information 
B)  Protections for the privacy of student education records 
C)  The responsibilities of top executives of publicly traded companies for the accuracy and timeliness of financial data 
D)  Safeguards that covered entities must use to protect the confidentiality, integrity and availability of electronic protected health information 
A)  Requirements for financial institutions to protect the privacy of their customers' non-public, personal information 
B)  Protections for the privacy of student education records 
C)  The responsibilities of top executives of publicly traded companies for the accuracy and timeliness of financial data 
D)  Safeguards that covered entities must use to protect the confidentiality, integrity and availability of electronic protected health information D

Question 2

Security policies serve all the following functions except

Accepted Answer

A)  Conveying organizational priorities 
B)  Obtaining managerial backing 
C)  Evading responsibility 
D)  Ensuring organizational consistency 
A)  Conveying organizational priorities 
B)  Obtaining managerial backing 
C)  Evading responsibility 
D)  Ensuring organizational consistency C

Question 3

Compliance is

Accepted Answer

A)  Procedures that tell units when it would be nice if things were operated a certain way, but it is not a requirement to do so 
B)  Guidelines to users and customers on what is appropriate and what is not appropriate to do with information technology resources 
C)  Following specifications put forth by policies or legal requirements 
D)  A defined set of rules, accepted and adopted by several organizations 
A)  Procedures that tell units when it would be nice if things were operated a certain way, but it is not a requirement to do so 
B)  Guidelines to users and customers on what is appropriate and what is not appropriate to do with information technology resources 
C)  Following specifications put forth by policies or legal requirements 
D)  A defined set of rules, accepted and adopted by several organizations C

Question 4

A guideline is

Accepted Answer

A)  Procedures that tell units when it would be nice if things were operated a certain way, but it is not a requirement to do so 
B)  Guidelines to users and customers on what is appropriate and what is not appropriate to do with information technology resources 
C)  A defined set of rules, accepted and adopted by several organizations 
D)  A document that records a high-level principle or course of action that has been decided on 
A)  Procedures that tell units when it would be nice if things were operated a certain way, but it is not a requirement to do so 
B)  Guidelines to users and customers on what is appropriate and what is not appropriate to do with information technology resources 
C)  A defined set of rules, accepted and adopted by several organizations 
D)  A document that records a high-level principle or course of action that has been decided on

Question 5

If an organization specifies that all laptops in the organization will use whole-disk encryption, the specific encryption technology will be specified in a

Accepted Answer

A)  Guideline 
B)  Standard 
C)  Policy 
D)  Law 
A)  Guideline 
B)  Standard 
C)  Policy 
D)  Law

Question 6

A standard is

Accepted Answer

A)  Procedures that tell units when it would be nice if things were operated a certain way, but it is not a requirement to do so 
B)  Guidelines to users and customers on what is appropriate and what is not appropriate to do with information technology resources 
C)  A document that records a high-level principle or course of action that has been decided on 
D)  A defined set of rules, accepted and adopted by several organizations 
A)  Procedures that tell units when it would be nice if things were operated a certain way, but it is not a requirement to do so 
B)  Guidelines to users and customers on what is appropriate and what is not appropriate to do with information technology resources 
C)  A document that records a high-level principle or course of action that has been decided on 
D)  A defined set of rules, accepted and adopted by several organizations

Question 7

The sections of a policy are generally written in the sequence

Accepted Answer

A)  Overview, scope, definitions, statement, enforcement 
B)  Definitions, overview, scope, statement, enforcement 
C)  Overview, definitions, statement, scope, enforcement 
D)  Overview, enforcement, scope, definitions, statement 
A)  Overview, scope, definitions, statement, enforcement 
B)  Definitions, overview, scope, statement, enforcement 
C)  Overview, definitions, statement, scope, enforcement 
D)  Overview, enforcement, scope, definitions, statement

Question 8

The relationship between policies, standards and guidelines is that

Accepted Answer

A)  Policies and standards emanate from guidelines 
B)  Standards and guidelines emanate from policies 
C)  Policies emanate from standards and guidelines 
D)  Standards, but not guidelines emanate from policies 
A)  Policies and standards emanate from guidelines 
B)  Standards and guidelines emanate from policies 
C)  Policies emanate from standards and guidelines 
D)  Standards, but not guidelines emanate from policies

Question 9

It is generally advised to consolidate all policy issues into one policy document

Accepted Answer

A) True 
 B)False

Question 10

The first section of a policy generally specifies

Accepted Answer

A)  Who or what is covered by the policy 
B)  Any definitions used in the policy 
C)  The statement of the policy 
D)  The need for the policy 
A)  Who or what is covered by the policy 
B)  Any definitions used in the policy 
C)  The statement of the policy 
D)  The need for the policy

Question 11

From the perspective of information security, the Gramm-Leach-Bliley GLB  act defines

Accepted Answer

A)  Requirements for financial institutions to protect the privacy of their customers' non-public, personal information 
B)  Protections for the privacy of student education records 
C)  The responsibilities of top executives of publicly traded companies for the accuracy and timeliness of financial data 
D)  Safeguards that covered entities must use to protect the confidentiality, integrity and availability of electronic protected health information 
A)  Requirements for financial institutions to protect the privacy of their customers' non-public, personal information 
B)  Protections for the privacy of student education records 
C)  The responsibilities of top executives of publicly traded companies for the accuracy and timeliness of financial data 
D)  Safeguards that covered entities must use to protect the confidentiality, integrity and availability of electronic protected health information

Question 12

In the United States one of the primary sources of standards for information security concerns is the

Accepted Answer

A)  National Institute of Standards and Technology 
B)  Massachusetts Institute of Technology 
C)  Harvard University 
D)  US State Department 
A)  National Institute of Standards and Technology 
B)  Massachusetts Institute of Technology 
C)  Harvard University 
D)  US State Department

Question 13

Who or what is covered by the policy is specified in the

Accepted Answer

A)  Overview 
B)  Statement 
C)  Enforcement 
D)  Scope 
A)  Overview 
B)  Statement 
C)  Enforcement 
D)  Scope

Question 14

A policy is

Accepted Answer

A)  Procedures that tell units when it would be nice if things were operated a certain way, but it is not a requirement to do so 
B)  Guidelines to users and customers on what is appropriate and what is not appropriate to do with information technology resources 
C)  A document that records a high-level principle or course of action that has been decided on 
D)  A defined set of rules, accepted and adopted by several organizations 
A)  Procedures that tell units when it would be nice if things were operated a certain way, but it is not a requirement to do so 
B)  Guidelines to users and customers on what is appropriate and what is not appropriate to do with information technology resources 
C)  A document that records a high-level principle or course of action that has been decided on 
D)  A defined set of rules, accepted and adopted by several organizations

Question 15

Key information security issues for which an organization should have policies include all of the following except

Accepted Answer

A)  Employee count 
B)  Incident response 
C)  Acceptable use 
D)  Information classification 
A)  Employee count 
B)  Incident response 
C)  Acceptable use 
D)  Information classification

Question 16

From the perspective of information security, the Sarbanes-Oxley SOX  act defines

Accepted Answer

A)  Requirements for financial institutions to protect the privacy of their customers' non-public, personal information 
B)  Protections for the privacy of student education records 
C)  The responsibilities of top executives of publicly traded companies for the accuracy and timeliness of financial data 
D)  Safeguards that covered entities must use to protect the confidentiality, integrity and availability of electronic protected health information 
A)  Requirements for financial institutions to protect the privacy of their customers' non-public, personal information 
B)  Protections for the privacy of student education records 
C)  The responsibilities of top executives of publicly traded companies for the accuracy and timeliness of financial data 
D)  Safeguards that covered entities must use to protect the confidentiality, integrity and availability of electronic protected health information

Question 17

The need for the policy is specified in the

Accepted Answer

A)  Scope 
B)  Statement 
C)  Overview 
D)  Enforcement 
A)  Scope 
B)  Statement 
C)  Overview 
D)  Enforcement

Question 18

Policies, standards and guidelines are useful because they

Accepted Answer

A)  Allow security administrators to obtain executive level endorsement for security objectives 
B)  Keep managers busy generating documents 
C)  Allow security administrators to educate the organization's leadership about information security 
D)  Help in detecting information security incidents 
A)  Allow security administrators to obtain executive level endorsement for security objectives 
B)  Keep managers busy generating documents 
C)  Allow security administrators to educate the organization's leadership about information security 
D)  Help in detecting information security incidents

Question 19

Policy review is usually triggered by all of the following except

Accepted Answer

A)  Time lapse since last review 
B)  Change in vendors for significant technologies 
C)  Significant technology change 
D)  Changes in regulatory compliance 
A)  Time lapse since last review 
B)  Change in vendors for significant technologies 
C)  Significant technology change 
D)  Changes in regulatory compliance

Question 20

From the perspective of information security, the Family Educational Rights and Privacy FERPA act defines

Accepted Answer

A)  Requirements for financial institutions to protect the privacy of their customers' non-public, personal information 
B)  Protections for the privacy of student education records 
C)  The responsibilities of top executives of publicly traded companies for the accuracy and timeliness of financial data 
D)  Safeguards that covered entities must use to protect the confidentiality, integrity and availability of electronic protected health information 
A)  Requirements for financial institutions to protect the privacy of their customers' non-public, personal information 
B)  Protections for the privacy of student education records 
C)  The responsibilities of top executives of publicly traded companies for the accuracy and timeliness of financial data 
D)  Safeguards that covered entities must use to protect the confidentiality, integrity and availability of electronic protected health information

From the perspective of information security, HIPAA defines

Security policies serve all the following functions except

Compliance is

A guideline is

If an organization specifies that all laptops in the organization will use whole-disk encryption, the specific encryption technology will be specified in a

A standard is

The sections of a policy are generally written in the sequence

The relationship between policies, standards and guidelines is that

It is generally advised to consolidate all policy issues into one policy document

The first section of a policy generally specifies

From the perspective of information security, the Gramm-Leach-Bliley GLB act defines

In the United States one of the primary sources of standards for information security concerns is the

Who or what is covered by the policy is specified in the

A policy is

Key information security issues for which an organization should have policies include all of the following except

From the perspective of information security, the Sarbanes-Oxley SOX act defines

The need for the policy is specified in the

Policies, standards and guidelines are useful because they

Policy review is usually triggered by all of the following except

From the perspective of information security, the Family Educational Rights and Privacy FERPA act defines

Introduction

System Administration

System Administration 2

Basic Information Security Model

Asset Identification and Characterization

Threats and Vulnerabilities

Encryption Controls

Identity and Access Management

Hardware and Software Controls

Shell Scripting

Incident Handling

Incident Analysis

It Risk Analysis and Risk Management

Filters

Exam 13: Policies, Standards and Guidelines

From the perspective of information security, HIPAA defines

Security policies serve all the following functions except

Compliance is

A guideline is

If an organization specifies that all laptops in the organization will use whole-disk encryption, the specific encryption technology will be specified in a

A standard is

The sections of a policy are generally written in the sequence

The relationship between policies, standards and guidelines is that

It is generally advised to consolidate all policy issues into one policy document

The first section of a policy generally specifies

From the perspective of information security, the Gramm-Leach-Bliley GLB act defines

In the United States one of the primary sources of standards for information security concerns is the

Who or what is covered by the policy is specified in the

A policy is

Key information security issues for which an organization should have policies include all of the following except

From the perspective of information security, the Sarbanes-Oxley SOX act defines

The need for the policy is specified in the

Policies, standards and guidelines are useful because they

Policy review is usually triggered by all of the following except

From the perspective of information security, the Family Educational Rights and Privacy FERPA act defines

Introduction

System Administration

System Administration 2

Basic Information Security Model

Asset Identification and Characterization

Threats and Vulnerabilities

Encryption Controls

Identity and Access Management

Hardware and Software Controls

Shell Scripting

Incident Handling

Incident Analysis

It Risk Analysis and Risk Management

Filters