Deck 15: IT Security Controls, Plans, and Procedures

Question 1

Operational controls range from simple to complex measures that worktogether to secure critical and sensitive data, information, and IT systems functions.

Answer 1

False

Question 2

All controls are applicable to all technologies.

Answer 2

False

Question 3

The IT security management process ends with the implementation ofcontrols and the training of personnel.

Answer 3

False

Question 4

An IT security ________ helps to reduce risks.

A) control
B) safeguard
C) countermeasure
D) all of the above

Question 5

_________ is a formal process to ensure that critical assets are sufficiently protected in a cost-effective manner.

A) Configuration management control
B) IT security management
C) Detection and recovery control
D) Security compliance

Question 6

Detection and recovery controls provide a means to restore lostcomputing resources.

Question 7

The implementation phase comprises not only the directimplementation of the controls, but also the associated training and general security awareness programs for the organization.

Question 8

_______ controls are pervasive, generic, underlying technical IT security capabilities that are interrelated with, and used by, many other controls.

A) Preventative
B) Supportive
C) Operational
D) Detection and recovery

Question 9

It is likely that the organization will not have the resources toimplement all the recommended controls.

Question 10

To ensure that a suitable level of security is maintained, managementmust follow up the implementation with an evaluation of the effectiveness of the security controls.

Question 11

Water damage protection is included in security controls.

Question 12

Physical access or environmental controls are only relevant to areashousing the relevant equipment.

Question 13

The recommended controls need to be compatible with theorganization's systems and policies.

Question 14

The selection of recommended controls is not guided by legalrequirements.

Question 15

Controls may vary in size and complexity in relation to theorganization employing them.

Question 16

_______ controls focus on security policies, planning, guidelines, and standards that influence the selection of operational and technical controls to reduce the risk of loss and to protect the organization's mission.

A) Management
B) Technical
C) Preventative
D) Supportive

Question 17

Once in place controls cannot be adjusted, regardless of the results ofrisk assessment of systems in the organization.

Question 18

________ controls focus on the response to a security breach, by warning of violations or attempted violations of security policies.

A) Technical
B) Preventative
C) Detection and recovery
D) Management

Question 19

Management controls refer to issues that management needs to address.

Question 20

Appropriate security awareness training for all personnel in anorganization, along with specific training relating to particular systems and controls, is an essential component in implementing controls.

Question 21

Maintenance of security controls, security compliance checking, change and configuration management, and incident handling are all included in the follow-up stage of the _________ process.

A) management
B) security awareness and training
C) maintenance
D) all of the above

Question 22

The implementation process is typically monitored by the organizational ______.

A) security officer
B) general counsel
C) technology officer
D) human resources

Question 23

An IT security plan should include details of _________.

A) risks
B) recommended controls
C) responsible personnel
D) all of the above

Question 24

Identification and authentication is part of the _______ class of security controls.

A) technical
B) operational
C) management
D) none of the above

Question 25

The objective of the ________ control category is to avoid breaches of any law, statutory, regulatory, or contractual obligations, and of any security requirements.

A) access
B) asset management
C) compliance
D) business continuity management

Question 26

________ is a means of managing risk, including policies, procedures, guidelines, practices, or organizational structures.

Question 27

The _______ plan documents what needs to be done for each selected control, along with the personnel responsible, and the resources and time frame to be used.

Question 28

_______ management is the process used to review proposed changes to systems for implications on the organization's systems and use.

Question 29

_______ management is concerned with specifically keeping track of the configuration of each system in use and the changes made to each.

Question 30

The _________ controls focus on the response to a security breach, by warning of violations or attempted violations of security policies or the identified exploit of a vulnerability and by providing means to restore the resulting lost computing resources.

Question 31

Management should conduct a ________ to identify those controls that are most appropriate and provide the greatest benefit to the organization given the available resources.

A) cost analysis
B) cost-benefit analysis
C) benefit analysis
D) none of the above

Question 32

The follow-up stage of the management process includes _________.

A) maintenance of security controls
B) security compliance checking
C) incident handling
D) all of the above

Question 33

A _________ on an organization's IT systems identifies areas needing treatment.

Question 34

Periodically reviewing controls to verify that they still function as intended, upgrading controls when new requirements are discovered, ensuring that changes to systems do not adversely affect the controls, and ensuring new threats or vulnerabilities have not become known are all ________ tasks.

A) security compliance
B) maintenance
C) incident handling
D) program management

Question 35

A contingency plan for systems critical to a large organization would be _________ than that for a small business.

A) smaller, less detailed
B) larger, less detailed
C) larger, more detailed
D) smaller, more detailed

Question 36

______ checking is an audit process to review the organization's security processes.

Question 37

________ controls involve the correct use of hardware and software security capabilities in systems.

Question 38

The three steps for IT security management controls and implementation are: prioritize risks, respond to risks, and __________ .

Question 39

The objective of the ________ control category is to counteract interruptions to business activities and to protect critical business processes from the effects of major failures of information systems or disasters and to ensure their timely resumption.

A) asset management
B) business continuity management
C) information security incident management
D) physical and environmental security

Question 40

When the implementation is successfully completed, _______ needs to authorize the system for operational use.

Question 41

Contingency planning falls into the _________ class of security controls.

Question 42

Controls can be classified as belonging to one of the following classes: management controls, operational controls, technical controls, detection and recovery controls, preventative controls, and _______ controls.

Question 43

The ________ audit process should be conducted on new IT systems and services once they are implanted; and on existing systems periodically, often as part of a wider, general audit of the organization or whenever changes are made to the organization's security policy.

Question 44

_________ controls focus on preventing security beaches from occurring by inhibiting attempts to violate security policies or exploit a vulnerability.

Question 45

Incident response is part of the ________ class of security controls.