Deck 4: Information Security Policy

Question 1

Which of the following sections of the ISSP should provide instructions on how to report observed or suspected policy infractions? 

A) Violations of Policy 
B) Systems Management 
C) Prohibited Usage of Equipment 
D) Authorized Access and Usage of Equipment

Answer 1

A

Question 2

Which policy is the highest level of policy and is usually created first? 

A) SysSP
B) USSP 
C) ISSP
D) EISP

Answer 2

D

Question 3

Which type of security policy is intended to provide a common understanding of the purposes for which an employee can and cannot use a resource? 

A) issue-specific
B) enterprise information 
C) system-specific
D) user-specific

Answer 3

A

Question 4

Policies must specify penalties for unacceptable behavior and define an appeals process.

Question 5

Non mandatory recommendations that the employee may use as a reference in complying with a policy.are known as regulations.____________

Question 6

The need for effective policy management has led to the emergence of a class of hardware tools that supports policy development,implementation,and maintenance.​

Question 7

​Examples of actions that illustrate compliance with policies are known as laws.

Question 8

In addition to specifying the penalties for unacceptable behavior,what else must a policy specify? 

A) appeals process
B) legal recourse 
C) what must be done to comply
D) the proper operation of equipment

Question 9

Rule-based policies are less specific to the operation of a system than access control lists.

Question 10

Which of the following is a policy implementation model that addresses issues by moving from the general to the specific and is a proven mechanism for prioritizing complex changes? 

A) On-target model
B) Wood's model 
C) Bull's-eye model
D) Bergeron and Berube model

Question 11

Since most policies are drafted by a single person and then reviewed by a higher-level manager,employee input should not be considered since it makes the process too complex.

Question 12

Which of the following is an element of the enterprise information security policy? 

A) access control lists 
B) information on the structure of the InfoSec organization 
C) articulation of the organization's SDLC methodology 
D) indemnification of the organization against liability

Question 13

Which of the following is NOT one of the basic rules that must be followed when shaping a policy? 

A) policy should never conflict with law
B) policy must be able to stand up in court if challenged 
C) policy should be agreed upon by all employees and management
D) policy must be properly supported and administered

Question 14

Which type of document is a more detailed statement of what must be done to comply with a policy? 

A) procedure
B) standard 
C) guideline
D) practice

Question 15

Technology is the essential foundation of an effective information security program​._____________

Question 16

The 'Authorized Uses' section of an ISSP specifies what the identified technology cannot be used for.

Question 17

​Information security policies are designed to provide structure in the workplace and explain the will of the organization's management.____________

Question 18

One of the goals of an issue-specific security policy is to indemnify the organization against liability for an employee's inappropriate or illegal use of the system.

Question 19

Which of the following is NOT among the three types of InfoSec policies based on NIST's Special Publication 800-14? 

A) Enterprise information security policy 
B) User-specific security policies 
C) Issue-specific security policies 
D) System-specific security policies

Question 20

Which section of an ISSP should outline a specific methodology for the review and modification of the ISSP? 

A) Policy Review and Modification 
B) Limitations of Liability 
C) Systems Management 
D) Statement of Purpose

Question 21

In which phase of the SecSDLC must the team create a plan to distribute and verify the distribution of the policies? 

A) design
B) implementation 
C) investigation
D) analysis

Question 22

A risk assessment is performed during which phase of the SecSDLC? 

A) implementation
B) analysis 
C) design
D) investigation

Question 23

How should a policy administrator facilitate policy reviews?

Question 24

When an organization demonstrates that it is continuously attempting to meet the requirements of the market in which it operates,what is it ensuring? 

A) policy administration
B) due diligence 
C) adequate security measures
D) certification and accreditation

Question 25

Which of the following are the two general groups into which SysSPs can be separated? 

A) technical specifications and managerial guidance
B) business guidance and network guidance 
C) user specifications and managerial guidance
D) technical specifications and business guidance

Question 26

According to NIST SP 800-18,Rev.1,which individual is responsible for the creation,revision,distribution,and storage of the policy? 

A) policy developer
B) policy reviewer 
C) policy enforcer
D) policy administrator

Question 27

The champion and manager of the information security policy is called the ____________________.

Question 28

What are the two general methods for implementing technical controls? 

A) profile lists and configuration filters 
B) firewall rules and access filters 
C) user profiles and filters 
D) access control lists and configuration rules

Question 29

A detailed outline of the scope of the policy development project is created during which phase of the SecSDLC? 

A) design
B) analysis 
C) implementation
D) investigation

Question 30

____________________ include the user access lists,matrices,and capability tables that govern the rights and privileges of users.

Question 31

A(n)____________________,which is usually presented on a screen to the user during software installation,spells out fair and responsible use of the software being installed.

Question 32

The responsibilities of both the users and the systems administrators with regard to specific systems administration duties should be specified in the ____________________ section of the ISSP.

Question 33

List the significant guidelines used in the formulation of effective information security policy.

Question 34

Which of the following is a disadvantage of the individual policy approach to creating and managing ISSPs? 

A) can suffer from poor policy dissemintation, enforcement, and review 
B) may skip vulnerabilities otherwise reported 
C) may be more expensive than necessary 
D) implementation can be less difficult to manage

Question 35

The three types of information security policies include the enterprise information security policy,the issue-specific security policy,and the ____________________ security policy.

Question 36

Which of the following is NOT an aspect of access regulated by ACLs? 

A) what authorized users can access
B) where the system is located 
C) how authorized users can access the system
D) when authorized users can access the system

Question 37

Which of the following are instructional codes that guide the execution of the system when information is passing through it? 

A) access control lists
B) user profiles 
C) configuration rules
D) capability tables

Question 38

List the advantages and disadvantages of using a modular approach for creating and managing the ISSP.
ANSWER: The advantages of the modular ISSP policy are:
Often considered an optimal balance between the individual ISSP and the comprehensive ISSP approaches
Well controlled by centrally managed procedures,assuring complete topic coverage
Clear assignment to a responsible department
Written by those with superior subject matter expertise for technology-specific systems
The disadvantages of the modular ISSP policy are:
May be more expensive than other alternatives
Implementation can be difficult to manage

Question 39

In the bull's-eye model,the ____________________ layer is the place where threats from public networks meet the organization's networking infrastructure.

Question 40

List the major components of the ISSP.

Question 41

What should an effective ISSP accomplish?

Question 42

a. capability table
b. statement of purpose
c. Bull's eye model
d. SysSPe. Procedures
f. InfoSec policy
g. standard
h. access control lists
i. systems management
j. ISSP
A clear declaration that outlines the scope and applicability of a policy.

Question 43

a. capability table
b. statement of purpose
c. Bull's eye model
d. SysSPe. Procedures
f. InfoSec policy
g. standard
h. access control lists
i. systems management
j. ISSP
The high-level information security policy that sets the strategic direction,scope,and tone for all of an organization's security efforts

Question 44

In which phase of the development of an InfoSec policy must a plan to distribute the policies be developed?  Why is this important?

Question 45

a. capability table
b. statement of purpose
c. Bull's eye model
d. SysSPe. Procedures
f. InfoSec policy
g. standard
h. access control lists
i. systems management
j. ISSP
When issues are addressed by moving from the general to the specific, always starting with policy.

Question 46

a. capability table
b. statement of purpose
c. Bull's eye model
d. SysSPe. Procedures
f. InfoSec policy
g. standard
h. access control lists
i. systems management
j. ISSP
Step-by-step instructions designed to assist employees in following policies, standards and guidelines.

Question 47

a. capability table
b. statement of purpose
c. Bull's eye model
d. SysSPe. Procedures
f. InfoSec policy
g. standard
h. access control lists
i. systems management
j. ISSP
A detailed statement of what must be done to comply with policy,sometimes viewed?as the rules governing policy compliance.

Question 48

a. capability table
b. statement of purpose
c. Bull's eye model
d. SysSPe. Procedures
f. InfoSec policy
g. standard
h. access control lists
i. systems management
j. ISSP
A section of policy that should specify users' and systems administrators' responsibilities.

Question 49

What are configuration rules?  Provide examples.

Question 50

What is a SysSP and what is one likely to include?

Question 51

What are the four elements that an EISP document should include?

Question 52

a. capability table
b. statement of purpose
c. Bull's eye model
d. SysSPe. Procedures
f. InfoSec policy
g. standard
h. access control lists
i. systems management
j. ISSP
​Organizational policies that often function as standards or procedures to be used when configuring or maintaining systems.​

Question 53

a. capability table
b. statement of purpose
c. Bull's eye model
d. SysSPe. Procedures
f. InfoSec policy
g. standard
h. access control lists
i. systems management
j. ISSP
Specifications of authorization that govern the rights and privileges of users to a particular information asset.

Question 54

What is the final component of the design and implementation of effective policies?  Describe this component.

Question 55

a. capability table
b. statement of purpose
c. Bull's eye model
d. SysSPe. Procedures
f. InfoSec policy
g. standard
h. access control lists
i. systems management
j. ISSP
Specifies which subjects and objects that users or groups can access.

Question 56

a. capability table
b. statement of purpose
c. Bull's eye model
d. SysSPe. Procedures
f. InfoSec policy
g. standard
h. access control lists
i. systems management
j. ISSP
An organizational policy that provides detailed,targeted guidance to instruct all members of the organization in the use of a resource,such as one of its processes or technologies.