Deck 11: Personnel and Security

Question 1

The general management community of interest should integrate solid information security concepts across all of the organization's employment policies and practices.

Answer 1

True

Question 2

CISOs are primarily charged with the day-to-day operation of the information security program.

Answer 2

False

Question 3

Most hiring organizations are aware of the precise value of information security certifications because these programs have been in existence for a long time.

Answer 3

False

Question 4

Handling a problem with information unavailability is within the duties of the Information Security Department Manager and his or her staff.

Question 5

One of the responsibilities of a CISO is to coordinate and perform reviews of contracts,projects,and proposals.

Question 6

The CISO position in an organization is usually an executive-level position and frequently reports to the CIO.

Question 7

In their efforts to hire an effective mix of information security personnel,organizations have control over the supply and demand of varied skills and experience levels that the market has to offer.

Question 8

CompTIA's Security + certification tests for security knowledge mastery of an individual with no on-the-job network experience,and is focused on CompTIA's line of security equipment.

Question 9

An information security engineer has the responsibility of redesigning and reengineering internal information handling processes so that information is appropriately protected from a wide variety of problems.

Question 10

Like the MCSE and CNE exams,the SCP focuses on general networking concepts.

Question 11

Automatic résumé scanning software can be set up to search for strings of characters that represent professional certifications.

Question 12

A Computer Operations Manager's job title is classified as part of the information technology community of interest that may not have an information security job description but still has some information security responsibilities.

Question 13

Similar to the case of other professions,overspecialization in information security can be an advantage.

Question 14

When terminating an employee,the method of employee security outprocessing will generally depend on the employee's job responsibilities.

Question 15

When advertising open positions,organizations should provide complete job descriptions including access privileges,in order to recruit the best candidate possible.

Question 16

Many information security professionals have law enforcement or military experience.

Question 17

In an organization,the security technician coordinates the information security efforts of all internal groups that have one or more information security-related responsibilities.

Question 18

The GIAC family of certifications can be pursued independently or combined to earn a comprehensive certification called the GIAC Security Expert.

Question 19

The CISA certification is a security certification that is appropriate for database,programming,and other IT professionals.

Question 20

(ISC)²'s SSCP is considered to be the most prestigious certification for information security managers and CISOs.

Question 21

Credit reports contain information on a job candidate's medical history,credit history,and other personal data.

Question 22

It is easy to limit a temporary employee's access to only the information required for his or her assigned duties.

Question 23

The CISSP has recently had three concentrations added: the Information Systems Security Architecture Professional (ISSAP),the Information Systems Security Engineering Professional (ISSEP)and the Information Systems Security Management Professional (ISSMP)._________________________

Question 24

In addition to the responsibility of conducting investigations of information security violations,a(n)CISO has to work effectively with external law enforcement to resolve these situations._________________________

Question 25

Security is generally a people problem and not a technological one.

Question 26

In the classification of information security positions,the real technical types who create and install security solutions fall under the category of those that define._________________________

Question 27

When two business partners integrate their information systems,the level of security of both systems must be examined before any physical integration takes place,as system connection means that vulnerability on one system becomes vulnerability for all linked systems.

Question 28

Before extending an offer of employment,it is necessary to conduct a background check on any potential candidate,regardless of job level.

Question 29

The International Information Systems Security Certification Consortium's most popular certification program is the CISM.__________________________________________________

Question 30

Social engineering uses persuasive techniques to gain an individual's confidence in an effort to obtain information.

Question 31

Typical temporary workers include groundskeepers,maintenance,services staff,electricians,mechanics,attorneys,technical consultants,and IT specialists.

Question 32

The general management community of interest should learn more about the requirements and qualifications for information security positions in order to move the information security discipline forward._________________________

Question 33

Organizations are required by LAW to protect sensitive or personal employee information,including personally identifying facts such as employee addresses,phone numbers,Social Security numbers,medical conditions,and even names and addresses of family members.

Question 34

In an effort to push the information security discipline forward,middle management should learn more about personnel and information security budgetary needs._________________________

Question 35

In a friendly departure,the resigning employee's account is usually allowed to continue with a new expiration date.

Question 36

In the efforts to maintain effective personnel security practices,one of the threats to an organization's information is the inability to perform the tasks of an employee who is unable or unwilling to perform them.

Question 37

The SSCP certification is considered to be a scaled-down version of the CISSP,however the SSCP's domains are not a subset of the CISSP domains,but rather contain slightly more technical content._________________________

Question 38

The SCP credential is geared toward experienced information security managers and others who may have information security management responsibilities,and includes areas of information security governance.________________________________________

Question 39

The CISO has the responsibility of obtaining top management's approval and ongoing support for all major information security plans for his or her organization._________________________

Question 40

The CISO is typically considered the top information security officer in an organization._________________________

Question 41

Two methods for handling employee outprocessing,depending on the employee's reasons for leaving,include hostile departures and involuntary departures._________________________

Question 42

Employees who perform security monitoring functions within an organization fall under the classification of information security positions that ____.

A) define
B) build
C) administer
D) audit

Question 43

When conducting security checks on potential employees,organizations must comply with local regulations,including the Fair Credit Reporting Act (FCRA)regarding the use of personal information in employment practices._________________________

Question 44

A background check of a potential candidate's criminal court history investigates his or her involvement as a plaintiff or defendant in a civil suit._________________________

Question 45

By utilizing a(n)human RAID system of requiring employees to know at least one part of another person's job,an organization can survive the loss of any single employee._________________________

Question 46

Contract workers are brought in by organizations to temporarily fill positions or to supplement the existing workforce._________________________

Question 47

Hostile employee departures from a company are usually the most difficult to handle._________________________

Question 48

A candidate for the CISO position should have experience as a ____.

A) security officer
B) security consultant
C) security technician
D) security manager

Question 49

The principle of least access infers that employees should be able to access only the information they need,and only for the period required to perform their tasks._________________________

Question 50

Employees who perform risk assessment functions within an organization fall under the classification of information security positions that ____.

A) define
B) administer
C) build
D) audit

Question 51

The checks-and-balances method of two-man control requires multiple employees to be involved in order for a crime to occur,referred to as collusion._________________________

Question 52

A(n)job rotation policy requires that multiple individuals within an organization can perform all critical tasks._________________________

Question 53

____ tend to be business managers first and technologists second.

A) Security officers
B) CISOs
C) Security technicians
D) Security consultants

Question 54

An employee management policy that includes an optional vacation of at least one week per year gives an organization the opportunity to perform a detailed review of everyone's work._________________________

Question 55

A specific concern with consultants is their natural desire to share success stories with other clients._________________________

Question 56

The day-to-day operation of the information security program is the responsibility of the ____.

A) CISO
B) security manager
C) security officer
D) security consultant

Question 57

Security concerns associated with business partners are usually addressed in an agency contract._________________________

Question 58

The CIFI program is currently being developed to evaluate expertise in the tasks and responsibilities of a security administrator or security manager,including incident response,working with law enforcement,and auditing._________________________

Question 59

Task or job rotation is used to make it difficult for an individual to violate information security._________________________

Question 60

Organizations should conduct periodic security awareness and training activities to keep security at the forefront of employees' minds and minimize employee mistakes._________________________

Question 61

Which of the following is a domain of the CISSP certification?

A) Cryptography
B) Administration
C) Audit and monitoring
D) Malicious code/malware

Question 62

Configuring firewalls and IDSs,implementing security software,and diagnosing and troubleshooting problems are some of the responsibilities of a ____.

A) security manager
B) CISO
C) security technician
D) security officer

Question 63

Which of the following is a responsibility of an information security technician?

A) Developing information security requirements for the organization
B) Providing hands-on technical consulting services to teams of technical specialists
C) Establishing procedures for the identification of information assets
D) Managing the development of information security policies

Question 64

Which of the following is NOT a CISSP concentration?

A) ISSAP
B) ISSCE
C) ISSMP
D) All of these are CISSP concentrations

Question 65

In the GIAC program,the ____ certification is considered the comprehensive technical credential,covering the entire range of GIAC technical and managerial security knowledge.

A) GIAC Certified Firewall Analyst
B) GIAC Certified Incident Handler
C) GIAC Security Leadership Certificate
D) GIAC Security Engineer

Question 66

When terminating an employee,how the security process is handled depends upon whether the termination is ____.

A) a retirement or a relocation
B) hostile or friendly
C) internal or external
D) voluntary or optional

Question 67

A security technician usually reports to a ____ who in turn reports to a(n)____.

A) security engineer; security manager
B) support staff member; analyst
C) CISO, CEO
D) security manager, CISO

Question 68

The ____ certification program is an option for individuals who wish to take the CISSP or SSCP exams before obtaining the requisite experience for certification.

A) TICSA
B) SCP
C) MCSE
D) (ISC)² Associate

Question 69

In addition to performing other tasks,many organizations conduct a(n)____ to remind the employee of any contractual obligations,such as nondisclosure agreements,and to obtain feedback on the employee's tenure in the organization.

A) legal disclaimer
B) immediate severance
C) exit interview
D) out briefing

Question 70

____ is a domain of the SSCP certification program.

A) Business continuity planning
B) Law, investigation, and ethics
C) Physical security
D) Administration

Question 71

Which of the following job titles with information security elements is part of the IT community of interest?

A) Access control system administrator
B) Local InfoSec coordinator
C) Physical asset protection specialist
D) Business analyst

Question 72

Which of the following job titles with information security elements is part of the information security community of interest?

A) Access control system administrator
B) InfoSys quality assurance analyst
C) Web site administrator
D) InfoSys analyst

Question 73

The ____ takes the lead in the interviewing and hiring process and screens personnel.

A) security manager
B) security technician
C) security consultant
D) CISO

Question 74

Currently the only advanced technical security certifications are offered by ____.

A) (ISC)²
B) ISACA
C) GIAC
D) ISO

Question 75

Which of the following job titles with information security elements is part of the general business community of interest?

A) Computer operator
B) Systems administrator
C) Business contingency planner
D) Database administrator

Question 76

Which of the following is a responsibility of an information security department manager?

A) Offering technical information security consulting services to network administrators
B) Running vulnerability identification software packages
C) Preparing post-mortem analyses of information security breaches
D) Training Access Control System administrators to set up firewalls

Question 77

The ____ program offers a wide array of certification tracks and requires applicants to complete a written practical assignment that tests the application of skills and knowledge.

A) GIAC
B) SCP
C) (ISC)² Associate
D) TICSA

Question 78

The ____ works with others who periodically run vulnerability identification software packages.

A) CISO
B) security engineer
C) security consultant
D) security officer

Question 79

A common job title for a security technician in an organization is ____.

A) security manager
B) security engineer
C) security officer
D) security consultant

Question 80

The ____ is considered the most prestigious certification for security managers and CISOs.

A) CISSP
B) GIAC
C) SSCP
D) SCP