Question 1

Physical access or environmental controls are only relevant to areashousing the relevant equipment.

Accepted Answer

A) True 
 B)False

Question 2

The recommended controls need to be compatible with theorganization's systems and policies.

Accepted Answer

A) True 
 B)False

Question 3

Incident response is part of the ________ class of security controls.

Accepted Answer

The answer of Incident response is part of the ________...

Question 4

An IT security plan should include details of _________.

Accepted Answer

A)  risks 
B)  recommended controls 
C)  responsible personnel 
D)  all of the above

Question 5

Management controls refer to issues that management needs to address.

Accepted Answer

A) True 
 B)False

Question 6

_______ controls are pervasive, generic, underlying technical IT security capabilities that are interrelated with, and used by, many other controls.

Accepted Answer

A)  Preventative 
B)  Supportive 
C)  Operational 
D)  Detection and recovery

Question 7

_________ controls focus on preventing security beaches from occurring by inhibiting attempts to violate security policies or exploit a vulnerability.

Accepted Answer

The answer of _________ controls focus on preventing security beaches...

Question 8

_______ controls focus on security policies, planning, guidelines, and standards that influence the selection of operational and technical controls to reduce the risk of loss and to protect the organization's mission.

Accepted Answer

A)  Management 
B)  Technical 
C)  Preventative 
D)  Supportive

Question 9

The IT security management process ends with the implementation ofcontrols and the training of personnel.

Accepted Answer

A) True 
 B)False

Question 10

The three steps for IT security management controls and implementation are: prioritize risks, respond to risks, and __________ .

Accepted Answer

The answer of The three steps for IT security management...

Question 11

_______ management is the process used to review proposed changes to systems for implications on the organization's systems and use.

Accepted Answer

The answer of _______ management is the process used to...

Question 12

Once in place controls cannot be adjusted, regardless of the results ofrisk assessment of systems in the organization.

Accepted Answer

A) True 
 B)False

Question 13

A contingency plan for systems critical to a large organization would be _________ than that for a small business.

Accepted Answer

A)  smaller, less detailed 
B)  larger, less detailed 
C)  larger, more detailed 
D)  smaller, more detailed

Question 14

The objective of the ________ control category is to avoid breaches of any law, statutory, regulatory, or contractual obligations, and of any security requirements.

Accepted Answer

A)  access 
B)  asset management 
C)  compliance 
D)  business continuity management

Question 15

Contingency planning falls into the _________ class of security controls.

Accepted Answer

The answer of Contingency planning falls into the _________ class...

Question 16

The implementation process is typically monitored by the organizational ______.

Accepted Answer

A)  security officer 
B)  general counsel 
C)  technology officer 
D)  human resources

Question 17

Water damage protection is included in security controls.

Accepted Answer

A) True 
 B)False

Question 18

All controls are applicable to all technologies.

Accepted Answer

A) True 
 B)False

Question 19

It is likely that the organization will not have the resources toimplement all the recommended controls.

Accepted Answer

A) True 
 B)False

Question 20

An IT security ________ helps to reduce risks.

Accepted Answer

A)  control 
B)  safeguard 
C)  countermeasure 
D)  all of the above

Exam 15: IT Security Controls, Plans, and Procedures

Physical access or environmental controls are only relevant to areashousing the relevant equipment.

The recommended controls need to be compatible with theorganization's systems and policies.

Incident response is part of the ________ class of security controls.

An IT security plan should include details of _________.

Management controls refer to issues that management needs to address.

_______ controls are pervasive, generic, underlying technical IT security capabilities that are interrelated with, and used by, many other controls.

_________ controls focus on preventing security beaches from occurring by inhibiting attempts to violate security policies or exploit a vulnerability.

_______ controls focus on security policies, planning, guidelines, and standards that influence the selection of operational and technical controls to reduce the risk of loss and to protect the organization's mission.

The IT security management process ends with the implementation ofcontrols and the training of personnel.

The three steps for IT security management controls and implementation are: prioritize risks, respond to risks, and __________ .

_______ management is the process used to review proposed changes to systems for implications on the organization's systems and use.

Once in place controls cannot be adjusted, regardless of the results ofrisk assessment of systems in the organization.

A contingency plan for systems critical to a large organization would be _________ than that for a small business.

The objective of the ________ control category is to avoid breaches of any law, statutory, regulatory, or contractual obligations, and of any security requirements.

Contingency planning falls into the _________ class of security controls.

The implementation process is typically monitored by the organizational ______.

Water damage protection is included in security controls.

All controls are applicable to all technologies.

It is likely that the organization will not have the resources toimplement all the recommended controls.

An IT security ________ helps to reduce risks.