Question 1

Employee behavior is not a critical concern in ensuring the security of
computer systems.

Accepted Answer

A) True 
 B)False  False

Question 2

The education and experience learning level provides the foundation
for subsequent training by providing a universal baseline of key security terms and concepts.

Accepted Answer

A) True 
 B)False  False

Question 3

An employer cannot be held liable for negligent hiring if an
employee causes harm to a third party while acting as an employee.

Accepted Answer

A) True 
 B)False  False

Question 4

_______ are ways for an awareness program to promote the security message to employees.

Accepted Answer

A) Posters 
B) Newsletters 
C) Workshops and training sessions 
D) All of the above 
A) Posters 
B) Newsletters 
C) Workshops and training sessions 
D) All of the above

Question 5

After security basics and literacy,training becomes focused on providing the knowledge,skills,and abilities specific to an individual's _______ relative to IT systems.

Accepted Answer

roles and

Question 6

A capability set up for the purpose of assisting in responding to computer security-related incidents that involve sites within a defined constituency is called a ______.

Accepted Answer

A) CIRT 
B) CIRC 
C) CSIRT 
D) all of the above 
A) CIRT 
B) CIRC 
C) CSIRT 
D) all of the above

Question 7

Complying with regulations and contractual obligations is a benefit of
security awareness,training,and education programs.

Accepted Answer

A) True 
 B)False

Question 8

________ need training on the development of risk management goals,means of measurement,and the need to lead by example in the area of security awareness.

Accepted Answer

A) Executives 
B) Analysts 
C) Managers 
D) Trainers 
A) Executives 
B) Analysts 
C) Managers 
D) Trainers

Question 9

From a security point of view,which of the following actions should be done upon the termination of an employee?

Accepted Answer

A) remove the person's name from all lists of authorized access 
B) recover all assets,including employee ID,disks,documents and equipment 
C) remove all personal access codes 
D) all of the above 
A) remove the person's name from all lists of authorized access 
B) recover all assets,including employee ID,disks,documents and equipment 
C) remove all personal access codes 
D) all of the above

Question 10

In large and medium-sized organizations,a(n)_________ is responsible for rapidly detecting incidents,minimizing loss and destruction,mitigating the weaknesses that were exploited,and restoring computing services.

Accepted Answer

computer s

Question 11

In general,a(n)________ program seeks to inform and focus an employee's attention on issues related to security within the organization.

Accepted Answer

The answer of In general,a(n)________ program seeks to inform and...

Question 12

Many companies incorporate specific e-mail and Internet use policies
into the organization's security policy document.

Accepted Answer

A) True 
 B)False

Question 13

Security awareness,training,and education programs may be needed to
comply with regulations and contractual obligations.

Accepted Answer

A) True 
 B)False

Question 14

Any action that threatens one or more of the classic security services of confidentiality,integrity,availability,accountability,authenticity,and reliability in a system constitutes a(n)________.

Accepted Answer

The answer of Any action that threatens one or more...

Question 15

Awareness only communicates information security policies and
procedures that need to be followed and does not provide the foundation for any sanctions or disciplinary actions imposed for noncompliance.

Accepted Answer

A) True 
 B)False

Question 16

A(n)_______ is a characteristic of a piece of technology that can be exploited to perpetrate a security incident.

Accepted Answer

The answer of A(n)_______ is a characteristic of a piece...

Question 17

________ is the process of receiving,initial sorting,and prioritizing of information to facilitate its appropriate handling.

Accepted Answer

A) Incident 
B) Triage 
C) Constituency 
D) Handling 
A) Incident 
B) Triage 
C) Constituency 
D) Handling

Question 18

As part of their contractual obligation,employees should agree and
sign the terms and conditions of their employment contract,which should state their and the organization's responsibilities for information security.

Accepted Answer

A) True 
 B)False

Question 19

________ is explicitly required for all employees.

Accepted Answer

A) Security awareness 
B) Education and experience 
C) Security basics and literacy 
D) Roles and responsibilities relative to IT systems 
A) Security awareness 
B) Education and experience 
C) Security basics and literacy 
D) Roles and responsibilities relative to IT systems

Question 20

_______ is a benefit of security awareness,training,and education programs to organizations.

Accepted Answer

A) Improving employee behavior 
B) Increasing the ability to hold employees accountable for their actions 
C) Mitigating liability of the organization for an employee's behavior 
D) All of the above 
A) Improving employee behavior 
B) Increasing the ability to hold employees accountable for their actions 
C) Mitigating liability of the organization for an employee's behavior 
D) All of the above

Exam 17: Human Resources Security

Employee behavior is not a critical concern in ensuring the security of computer systems.

The education and experience learning level provides the foundation for subsequent training by providing a universal baseline of key security terms and concepts.

An employer cannot be held liable for negligent hiring if an employee causes harm to a third party while acting as an employee.

_______ are ways for an awareness program to promote the security message to employees.

After security basics and literacy,training becomes focused on providing the knowledge,skills,and abilities specific to an individual's _______ relative to IT systems.

A capability set up for the purpose of assisting in responding to computer security-related incidents that involve sites within a defined constituency is called a ______.

Complying with regulations and contractual obligations is a benefit of security awareness,training,and education programs.

________ need training on the development of risk management goals,means of measurement,and the need to lead by example in the area of security awareness.

From a security point of view,which of the following actions should be done upon the termination of an employee?

In large and medium-sized organizations,a(n)_________ is responsible for rapidly detecting incidents,minimizing loss and destruction,mitigating the weaknesses that were exploited,and restoring computing services.

In general,a(n)________ program seeks to inform and focus an employee's attention on issues related to security within the organization.

Many companies incorporate specific e-mail and Internet use policies into the organization's security policy document.

Security awareness,training,and education programs may be needed to comply with regulations and contractual obligations.

Any action that threatens one or more of the classic security services of confidentiality,integrity,availability,accountability,authenticity,and reliability in a system constitutes a(n)________.

Awareness only communicates information security policies and procedures that need to be followed and does not provide the foundation for any sanctions or disciplinary actions imposed for noncompliance.

A(n)_______ is a characteristic of a piece of technology that can be exploited to perpetrate a security incident.

________ is the process of receiving,initial sorting,and prioritizing of information to facilitate its appropriate handling.

As part of their contractual obligation,employees should agree and sign the terms and conditions of their employment contract,which should state their and the organization's responsibilities for information security.

________ is explicitly required for all employees.

_______ is a benefit of security awareness,training,and education programs to organizations.

Computer Systems Overview

Cryptographic Tools

User Authentication

Access Control

Database and Cloud Security

Malicious Software

Denial-Of-Service Attacks

Intrusion Detection

Firewalls and Intrusion Prevention Systems

Buffer Overflow

Software Security

Operating System Security

Trusted Computing and Multilevel Security

It Security Management and Risk Assessment

It Security Controls,plans,and Procedures

Physical and Infrastructure Security

Security Auditing

Legal and Ethical Aspects

Symmetric Encryption and Message Confidentiality

Public-Key Cryptography and Message Authentication

Internet Security Protocols and Standards

Internet Authentication Applications

Wireless Network Security

Filters