Exam 15: It Security Controls, plans, and Procedures

All controls are applicable to all technologies.

Incident response is part of the ________ class of security controls.

Maintenance of security controls,security compliance checking,change and configuration management,and incident handling are all included in the follow-up stage of the _________ process.

It is likely that the organization will not have the resources to implement all the recommended controls.

Once in place controls cannot be adjusted,regardless of the results of risk assessment of systems in the organization.

Operational controls range from simple to complex measures that work together to secure critical and sensitive data,information,and IT systems functions.

The recommended controls need to be compatible with the organization's systems and policies.

Detection and recovery controls provide a means to restore lost computing resources.

_______ controls are pervasive,generic,underlying technical IT security capabilities that are interrelated with,and used by,many other controls.

Controls can be classified as belonging to one of the following classes: management controls,__________,and technical controls.

Water damage protection is included in security controls.

The follow-up stage of the management process includes _________.

________ controls involve the correct use of hardware and software security capabilities in systems.

Identification and authentication is part of the _______ class of security controls.

The objective of the ________ control category is to avoid breaches of any law,statutory,regulatory,or contractual obligations,and of any security requirements.

A _________ on an organization's IT systems identifies areas needing treatment.

________ controls focus on the response to a security breach,by warning of violations or attempted violations of security policies.

An IT security ________ helps to reduce risks.

_______ controls focus on security policies,planning,guidelines,and standards that influence the selection of operational and technical controls to reduce the risk of loss and to protect the organization's mission.

The objective of the ________ control category is to counteract interruptions to business activities and to protect critical business processes from the effects of major failures of information systems or disasters and to ensure their timely resumption.