Deck 11: Wireless Security Policy

Question 1

The goal of information security is to protect the integrity, ____, and availability of data on the devices that store, manipulate, and transmit the information.

A) authorization
B) authentication
C) confidentiality
D) accounting

Answer 1

C

Question 2

The best approach to creating a security policy is for a member of the IT staff to create the document in a few days with little or no input from other individuals.

Answer 2

False

Question 3

____ is defined as the obligations that are imposed on owners and operators of assets to exercise reasonable care of the assets and take necessary precautions to protect them.

A) Due care
B) Separation of duties
C) Need to know
D) Risk assessment

Answer 3

A

Question 4

Identifying assets is a fairly simple and quick process.

Question 5

The ____ is the expected monetary loss that can be expected for an asset because of a risk over a one-year period.

A) Exposure Factor (EF)
B) Annualized Rate of Occurrence (ARO)
C) Annualized Loss Expectancy (ALE)
D) Single Loss Expectancy (SLE)

Question 6

A(n) ____ is defined as any item that has a positive economic value.

A) risk
B) asset
C) threat
D) vulnerability

Question 7

A ____ is a document that outlines specific requirements or rules that must be met.

A) policy
B) standard
C) guideline
D) risk

Question 8

A ____ is a collection of requirements specific to the system or procedure that must be met by everyone.

A) code of ethics
B) guideline
C) standard
D) policy

Question 9

A(n) ____ involves determining the damage that would result from an attack and the likelihood that a vulnerability is a risk to the organization.

A) threat modeling
B) risk assessment
C) attack tree
D) attack modeling

Question 10

The proper development of a security policy is accomplished through what is called the ____.

A) software life cycle
B) data life cycle
C) assets policy cycle
D) security policy cycle

Question 11

If policies are too restrictive or too hard to implement and comply with, they will either be ignored or people will find a way to circumvent the controls in the policies.

Question 12

____ takes a current snapshot of the security of the organization as it now stands.

A) Asset modeling
B) Asset tree
C) Threat modeling
D) Vulnerability appraisal

Question 13

The main purpose of an ethics code is to state the values, principles, and ideals that each member of an organization must agree to.

Question 14

The ____ is the expected monetary loss every time a risk occurs.

A) Exposure Factor (EF)
B) Annualized Loss Expectancy (ALE)
C) Annualized Rate of Occurrence (ARO)
D) Single Loss Expectancy (SLE)

Question 15

The risks for the least important assets should be reduced first.

Question 16

____ is the process of tracking the assets.

A) Asset management
B) Risk identification
C) Threat management
D) Vulnerability identification

Question 17

____ seeks to determine the risks that an organization faces against its information assets.

A) Risk identification
B) Security policy design
C) Security policy evaluation
D) Compliance monitoring and evaluation

Question 18

A ____ is a collection of suggestions that should be implemented.

A) code of ethics
B) guideline
C) standard
D) policy

Question 19

A(n) ____ provides a visual image of the attacks that may occur against an asset.

A) asset tree
B) attack tree
C) asset modeling
D) asset identification

Question 20

____ constructs scenarios of the types of threats that assets can face.

A) Asset management
B) Vulnerability identification
C) Threat modeling
D) Asset identification

Question 21

____________________ means that one person's work serves as a complementary check on another person's actions.

Question 22

Many organizations now enforce a(n) ____ policy to address accessing public hotspots.

A) acceptable use
B) VPN
C) password management
D) public access WLAN use

Question 23

What are the options faced by an organization when confronted with a risk?

Question 24

What are the layers of information security?

Question 25

A ____ can help to clarify some of the ethical obligations and responsibilities undertaken by users.

A) guideline
B) security policy
C) code of ethics
D) standard

Question 26

A(n) ____ policy should clearly address how passwords are managed.

A) password management
B) VPN
C) acceptable use
D) WLAN use

Question 27

The ALE is calculated by multiplying the SLE by the ____________________.

Question 28

A(n) ____________________ is any threat that exists against an asset.

Question 29

Why is it critical to have users "buy in" to the policy and willingly follow it?

Question 30

What are the three models of trust?

Question 31

What are the characteristics of a policy?

Question 32

The SLE is computed by multiplying the value of the asset (Asset Value or AV) by the ____________________.

Question 33

Managing the process of implementing changes is known as ____.

A) risk assessment
B) change management
C) change identification
D) change modeling

Question 34

Only that employee whose job function depends on knowing the information is provided access. This is called ____.

A) Due care
B) Separation of duties
C) Risk assessment
D) Need to know

Question 35

What are the types of assets available at any organization?

Question 36

A(n) ____________________ is a document or series of documents that clearly defines the defense mechanisms an organization will employ to keep information secure.

Question 37

Briefly explain how to perform a risk assessment.

Question 38

What are some of the factors to consider when determining the relative value of an asset?

Question 39

A(n) ____ outlines the actions to be performed when a security breach occurs.

A) risk identification
B) threat modeling
C) risk management
D) incident response

Question 40

What are some of the principles that are involved for good compliance monitoring and evaluation?

Question 41

Briefly describe the areas that should be considered when creating an incident response team (IRT).