Deck 15: It Security Controls, plans, and Procedures

Question 1

_________ is a formal process to ensure that critical assets are sufficiently protected in a cost-effective manner.

A)Configuration management control
B)IT security management
C)Detection and recovery control
D)Security compliance

Answer 1

B

Question 2

________ controls focus on the response to a security breach,by warning of violations or attempted violations of security policies.

A)Technical
B)Preventative
C)Detection and recovery
D)Management

Answer 2

C

Question 3

Detection and recovery controls provide a means to restore lost
computing resources.

Answer 3

True

Question 4

The selection of recommended controls is not guided by legal
requirements.

Question 5

The implementation phase comprises not only the direct
implementation of the controls,but also the associated training and general security awareness programs for the organization.

Question 6

Water damage protection is included in security controls.

Question 7

To ensure that a suitable level of security is maintained,management
must follow up the implementation with an evaluation of the effectiveness of the security controls.

Question 8

All controls are applicable to all technologies.

Question 9

Appropriate security awareness training for all personnel in an
organization,along with specific training relating to particular systems and controls,is an essential component in implementing controls.

Question 10

The IT security management process ends with the implementation of
controls and the training of personnel.

Question 11

Management controls refer to issues that management needs to address.

Question 12

Once in place controls cannot be adjusted,regardless of the results of
risk assessment of systems in the organization.

Question 13

_______ controls focus on security policies,planning,guidelines,and standards that influence the selection of operational and technical controls to reduce the risk of loss and to protect the organization's mission.

A)Management
B)Technical
C)Preventative
D)Supportive

Question 14

Operational controls range from simple to complex measures that work
together to secure critical and sensitive data,information,and IT systems functions.

Question 15

_______ controls are pervasive,generic,underlying technical IT security capabilities that are interrelated with,and used by,many other controls.

A)Preventative
B)Supportive
C)Operational
D)Detection and recovery

Question 16

An IT security ________ helps to reduce risks.

A)control
B)safeguard
C)countermeasure
D)all of the above

Question 17

Physical access or environmental controls are only relevant to areas
housing the relevant equipment.

Question 18

The recommended controls need to be compatible with the
organization's systems and policies.

Question 19

It is likely that the organization will not have the resources to
implement all the recommended controls.

Question 20

Controls may vary in size and complexity in relation to the
organization employing them.

Question 21

________ is a means of managing risk,including policies,procedures,guidelines,practices,or organizational structures.

Question 22

The objective of the ________ control category is to counteract interruptions to business activities and to protect critical business processes from the effects of major failures of information systems or disasters and to ensure their timely resumption.

A)asset management
B)business continuity management
C)information security incident management
D)physical and environmental security

Question 23

The implementation process is typically monitored by the organizational ______.

A)security officer
B)general counsel
C)technology officer
D)human resources

Question 24

Maintenance of security controls,security compliance checking,change and configuration management,and incident handling are all included in the follow-up stage of the _________ process.

A)management
B)security awareness and training
C)maintenance
D)all of the above

Question 25

_______ management is the process used to review proposed changes to systems for implications on the organization's systems and use.

Question 26

The _________ controls focus on the response to a security breach,by warning of violations or attempted violations of security policies or the identified exploit of a vulnerability and by providing means to restore the resulting lost computing resources.

Question 27

The follow-up stage of the management process includes _________.

A)maintenance of security controls
B)security compliance checking
C)incident handling
D)all of the above

Question 28

The _______ plan documents what needs to be done for each selected control,along with the personnel responsible,and the resources and time frame to be used.

Question 29

Periodically reviewing controls to verify that they still function as intended,upgrading controls when new requirements are discovered,ensuring that changes to systems do not adversely affect the controls,and ensuring new threats or vulnerabilities have not become known are all ________ tasks.

A)security compliance
B)maintenance
C)incident handling
D)program management

Question 30

A _________ on an organization's IT systems identifies areas needing treatment.

Question 31

_______ management is concerned with specifically keeping track of the configuration of each system in use and the changes made to each.

Question 32

The objective of the ________ control category is to avoid breaches of any law,statutory,regulatory,or contractual obligations,and of any security requirements.

A)access
B)asset management
C)compliance
D)business continuity management

Question 33

When the implementation is successfully completed,_______ needs to authorize the system for operational use.

Question 34

Controls can be classified as belonging to one of the following classes: management controls,__________,and technical controls.

Question 35

An IT security plan should include details of _________.

A)risks
B)recommended controls
C)responsible personnel
D)all of the above

Question 36

Identification and authentication is part of the _______ class of security controls.

A)technical
B)operational
C)management
D)none of the above

Question 37

________ controls involve the correct use of hardware and software security capabilities in systems.

Question 38

A contingency plan for systems critical to a large organization would be _________ than that for a small business.

A)smaller,less detailed
B)larger,less detailed
C)larger,more detailed
D)smaller,more detailed

Question 39

______ checking is an audit process to review the organization's security processes.

Question 40

Management should conduct a ________ to identify those controls that are most appropriate and provide the greatest benefit to the organization given the available resources.

A)cost analysis
B)cost-benefit analysis
C)benefit analysis
D)none of the above

Question 41

Controls can be classified as belonging to one of the following classes: management controls,operational controls,technical controls,detection and recovery controls,preventative controls,and _______ controls.

Question 42

Contingency planning falls into the _________ class of security controls.

Question 43

Incident response is part of the ________ class of security controls.

Question 44

_________ controls focus on preventing security beaches from occurring by inhibiting attempts to violate security policies or exploit a vulnerability.

Question 45

The ________ audit process should be conducted on new IT systems and services once they are implanted; and on existing systems periodically,often as part of a wider,general audit of the organization or whenever changes are made to the organization's security policy.