Deck 5: Developing the Security Program

Question 1

In the early stages of planning,the project planner should attempt to specify completion dates only for major employees within the project._________________________

Answer 1

 False
milestones

Question 2

Threats from insiders are more likely in a small organization than in a large one.

Answer 2

 False

Question 3

Which of the following variables is the most influential in determining how to structure an information security program? 

A) Security capital budget
B) Organizational size 
C) Security personnel budget
D) Organizational culture

Answer 3

D

Question 4

Which of the following functions includes identifying the sources of risk and may include offering advice on controls that can reduce risk? 

A) Risk management
B) Risk assessment 
C) Systems testing
D) Vulnerability assessment

Question 5

Which of the following would be responsible for configuring firewalls and IDPSs,implementing security software,and diagnosing and troubleshooting problems? 

A) A security technician
B) A security analyst 
C) A security consultant
D) The security manager

Question 6

The work breakdown structure (WBS)can only be prepared with a complex specialized desktop PC application.

Question 7

Most information security projects require a trained project developer._________________________

Question 8

Which of the following is true about the security staffing,budget,and needs of a medium-sized organization? 

A) they have a larger security staff than a small organization 
B) they have a larger security budget (as percent of IT budget) than a small organization 
C) they have a smaller security budget (as percent of IT budget) than a large organization 
D) they have larger information security needs than a small organization

Question 9

Small organizations spend more per user on security than medium- and large-sized organizations.

Question 10

Which function needed to implement the information security program includes researching,creating,maintaining,and promoting information security plans? 

A) compliance
B) policy 
C) planning
D) systems security administration

Question 11

GGG security is commonly used to describe which aspect of security? 

A) technical
B) software 
C) physical
D) theoretical

Question 12

Planners need to estimate the effort required to complete each task,subtask,or action step.

Question 13

On-the-job training can result in substandard work performance while the trainee gets up to speed.

Question 14

Legal assessment for the implementation of the information security program is almost always done by the information security or IT departments.

Question 15

The security education,training,and awareness (SETA)program is designed to reduce the occurence of external security attacks.

Question 16

A task or subtask becomes a(n)action step when it can be completed by one individual or skill set and when it includes a single deliverable._________________________

Question 17

Each organization has to determine its own project management methodology for IT and information security projects.

Question 18

Which of the following is NOT among the functions typically performed within the InfoSec department as a compliance enforcement obligation? 

A) policy 
B) centralized authentication 
C) compliance/audit 
D) risk management

Question 19

Which of the following functions needed to implement the information security program evaluates patches used to close software vulnerabilities and acceptance testing of new systems to assure compliance with policy and effectiveness? 

A) Systems testing
B) Risk assessment 
C) Incident response
D) Systems security administration

Question 20

The first step in the work breakdown structure (WBS)approach encompasses activities,but not deliverables.

Question 21

Which of the following is an advantage of the formal class method of training? 

A) Personal 
B) Self-paced, can go as fast or as slow as the trainee needs 
C) Can be scheduled to fit the needs of the trainee 
D) Interaction with trainer is possible

Question 22

An organization's information security program refers to the entire set of activities,resources,personnel,and technologies used by an organization to manage the risks to the information  _______ of the organization.

Question 23

A(n)____________________ is a specific point in the project plan when a task that has a noticeable impact on plan's the progress is complete.

Question 24

Which of the following is true about a company's InfoSec awareness Web site? 

A) it should contain large images to maintain interest 
B) appearance doesn't matter if the information is there 
C) it should be placed on the Internet for public use 
D) it should be tested with multiple browsers

Question 25

Which of the following is a disadvantage of the one-on-one training method? 

A) Inflexible 
B) May not be responsive to the needs of all the trainees 
C) Content may not be customized to the needs of the organization 
D) Resource intensive, to the point of being inefficient

Question 26

__________ is a simple project management planning tool.

A) RFP
B) WBS 
C) ISO 17799
D) SDLC

Question 27

Which of the following is the first step in the process of implementing training? 

A) Identify training staff 
B) Identify target audiences 
C) Identify program scope, goals, and objectives 
D) Motivate management and employees

Question 28

What is the SETA program designed to do? 

A) reduce the occurrence of external attacks 
B) improve operations 
C) reduce the occurence of accidental security breaches 
D) increase the efficiency of InfoSec staff

Question 29

Which of the following is the most cost-effective method for disseminating security information and news to employees? 

A) distance learning seminars
B) security-themed Web site 
C) conference calls
D) security newsletter

Question 30

The information security ____________________ is usually brought in when the organization makes the decision to outsource one or more aspects of its security program.

Question 31

Which of the following is an advantage of the one-on-one method of training? 

A) Trainees can learn from each other
B) Very cost-effective 
C) Customized
D) Maximizes use of company resources

Question 32

Advanced technical training can be selected or developed based on which of the following? 

A) level of previous education
B) level of previous training 
C) technology product
D) number of employees

Question 33

The purpose of SETA is to enhance security in all but which of the following ways? 

A) by building in-depth knowledge 
B) by adding barriers 
C) by developing skills 
D) by improving awareness

Question 34

An organization carries out a risk ____________________ function to evaluate risks present in IT initiatives and/or systems.

Question 35

A SETA program consists of three elements: security education,security training,and which of the following?.

A) security accountability
B) security authentication 
C) security awareness
D) security authorization

Question 36

Which of the following is an advantage of the user support group form of training? 

A) Usually conducted in an informal social setting 
B) Formal training plan 
C) Can be live, or can be archived and viewed at the trainee's convenience 
D) Can be customized to the needs of the trainee

Question 37

A study of information security positions found that positions can be classified into one of three types: ____________________ are the real technical types,who create and install security solutions.

Question 38

Which of the following is NOT a step in the process of implementing training? 

A) administer the program 
B) hire expert consultants 
C) motivate management and employees 
D) identify target audiences

Question 39

The ____________________ program is designed to reduce the occurrence of accidental security breaches by members of the organization.

Question 40

Project ____________________ is a description of a project's features,capabilities,functions,and quality level,used as the basis of a project plan.

Question 41

What is the purpose of a security awareness program?  What advantage does an awareness program have for the InfoSec program?

Question 42

____________________ is a phenomenon in which the project manager spends more time documenting project tasks,collecting performance measurements,recording project task information,and updating project completion forecasts than in accomplishing meaningful project work.

Question 43

The three methods for selecting or developing advanced technical training are by job category,by job function,and by ____________________.

Question 44

a. InfoSec program
b. SETA
c. scope creep
d. security watchstander
e. security manager
f. CISO
g. projectitis
h. critical path method
i. security technicians
j. security awareness program
Occurs when a project manager spends more time working in the project management software than accomplishing meaningful project work.

Question 45

a. InfoSec program
b. SETA
c. scope creep
d. security watchstander
e. security manager
f. CISO
g. projectitis
h. critical path method
i. security technicians
j. security awareness program
​

Question 46

What is the security education,training,and awareness program? Describe how the program aims to enhance security.

Question 47

The goal of a security ____________________ program is to keep information security at the forefront of users' minds on a daily basis.

Question 48

What are some of the variables that determine how a given organization chooses to construct its InfoSec program?

Question 49

Explain the conflict between the goals and objectives of the CIO and the CISO.

Question 50

a. InfoSec program
b. SETA
c. scope creep
d. security watchstander
e. security manager
f. CISO
g. projectitis
h. critical path method
i. security technicians
j. security awareness program
In larger organizations,responsible for some aspect of information security; in smaller organizations,this title may be assigned to the only or senior security administrator.

Question 51

a. InfoSec program
b. SETA
c. scope creep
d. security watchstander
e. security manager
f. CISO
g. projectitis
h. critical path method
i. security technicians
j. security awareness program
​

Question 52

a. InfoSec program
b. SETA
c. scope creep
d. security watchstander
e. security manager
f. CISO
g. projectitis
h. critical path method
i. security technicians
j. security awareness program
A program designed to improve the security of information assets by providing targeted information,skills,and guidance for organizational employees.

Question 53

What is the role of help desk personnel in the InfoSec team?

Question 54

The project planner should describe the skills or personnel needed for a task,often referred to as a(n)____________________,needed to accomplish a task.

Question 55

What is the Chief Information Security Office primarily responsible for?

Question 56

List the steps of the seven-step methodology for implementing training.

Question 57

a. InfoSec program
b. SETA
c. scope creep
d. security watchstander
e. security manager
f. CISO
g. projectitis
h. critical path method
i. security technicians
j. security awareness program
Entry-level InfoSec professional responsible for the routine monitoring and operation of a particular InfoSec technology.

Question 58

Which security functions are normally performed by IT groups outside the InfoSec area of management control?

Question 59

What are the four areas into which it is recommended to separate the functions of security?

Question 60

What are the components of the security program element described as preparing for contingencies and disasters?

Question 61

a. InfoSec program
b. SETA
c. scope creep
d. security watchstander
e. security manager
f. CISO
g. projectitis
h. critical path method
i. security technicians
j. security awareness program
A diagramming technique designed to identify the sequence of tasks that make up the shortest elapsed time needed to complete a project.

Question 62

a. InfoSec program
b. SETA
c. scope creep
d. security watchstander
e. security manager
f. CISO
g. projectitis
h. critical path method
i. security technicians
j. security awareness program
​

Question 63

a. InfoSec program
b. SETA
c. scope creep
d. security watchstander
e. security manager
f. CISO
g. projectitis
h. critical path method
i. security technicians
j. security awareness program
The expansion of the quantity or quality of project deliverables from the original project plan.

Question 64

What minimum attributes for project tasks does the WBS document?

Question 65

a. InfoSec program
b. SETA
c. scope creep
d. security watchstander
e. security manager
f. CISO
g. projectitis
h. critical path method
i. security technicians
j. security awareness program
Typically considered the top information security officer in an organization.