question

principles

answer

Which of the following is NOT a unique function of Information Security Management?

question

authentication

answer

The use of cryptographic certificates to establish Secure Sockets Layer (SSL) connections is an example of which process?

question

What other activities require the same resources as this activity?

answer

It is possible to take a very complex operation and diagram it in PERT if you can answer three key questions about each activity. Which of the following is NOT one of them?

question

F

answer

The first step in solving problems is to gather facts and make assumptions.

question

people

answer

Which function of InfoSec Management encompasses security personnel as well as aspects of the SETA program?

question

Confidentiality

answer

Which of the following is a C.I.A. characteristic that ensures that only those with sufficient privileges and a demonstrated need may access certain information?

question

Project Management Body of Knowledge (PMBoK)

answer

Information security project managers often follow methodologies based on what methodology promoted by the Project Management Institute?

question

accountability

answer

What do audit logs that track user activity on an information system provide?

question

Recognize and define the problem

answer

Which of the following is the first step in the problem-solving process?

question

False

answer

Corruption of information can occur only while information is being stored.

question

The number of people and other resources needed for each task

answer

In the WBS approach, the project plan is first broken down into tasks placed on the WBS task list. The minimum attributes that should be identified for each task include all but which of the following?

question

planning

answer

Which of the following is the process that develops, creates, and implements strategies for the accomplishment of objectives?

question

organization

answer

Which of the following is the principle of management dedicated to the structuring of resources to support the accomplishment of objectives?

question

F

answer

The authorization process takes place before the authentication process.

question

PERT

answer

Which of the following was originally developed in the late 1950s to meet the need of the rapidly expanding engineering projects associated with government acquisitions such as weapons systems?

question

Failure to meet project deadlines

answer

What is one of the most frequently cited failures in project management?

question

media, technology, and content

answer

Communications security involves the protection of which of the following?

question

Build support among management for the candidate solution

answer

Which of the following is NOT a step in the problem-solving process?

question

Technology

answer

Which of the following is NOT a knowledge area in the Project Management knowledge body?

question

critical path

answer

Using the Program Evaluation and Review Technique, which of the following identifies the sequence of events or activities that requires the longest duration to complete, and that therefore cannot be delayed without delaying the entire project?

question

policy

answer

Which of the following functions of Information Security Management seeks to dictate certain behavior within the organization through a set of organizational guidelines?

question

All workers operate at approximately the same level of efficiency

answer

The management of human resources must address many complicating factors; which of the following is NOT among them?

question

T

answer

A project can have more than one critical path.

question

Operational

answer

Which type of planning is used to organize the ongoing, day-to-day performance of tasks?

question

F

answer

The primary goal of external monitoring is to maintain an informed awareness of the state of all of the organization's networks, information systems, and information security defenses

question

Physical

answer

resources include people, hardware, and the supporting system elements and resources associated with the management of information in all its states

question

Initiating

answer

According to the Corporate Governance Task Force (CGTF), which phase in the IDEAL model and framework lays the groundwork for a successful improvement effort?

question

Hold regular meetings with the CIO to discuss tactical InfoSect planning

answer

The National Association of Corporate Directors (NACD) recommends four essential practices for boards of directors. Which of the following is NOT one of these recommended practices?

question

tactical

answer

In which level of planning are budgeting, resource allocation, and manpower critical components?

question

An InfoSec risk management methodology

answer

Which of the following should be included in an InfoSec governance program?

question

F

answer

A top-down approach to information security usually begins with a systems administrator's attempt to improve the security of their systems.

question

denial-of-service (DoS)

answer

Which type of attack involves sending a large number of connection or information requests to a target?

question

F

answer

Penetration testing is often conducted by contractors, who are commonly referred to as black-hats.

question

investigation

answer

What is the first phase of the SecSDLC?

question

F

answer

Because it sets out general business intentions, a mission statement does not need to be concise.

question

strategic

answer

Which type of planning is the primary tool in determining the long-term direction taken by an organization?

question

buffer

answer

overflow is an application error that occurs when the system can't handle the amount of data that is sent.

question

back door

answer

Which of the following is a feature left behind by system designers or maintenance staff that allows quick access to a system at a later time by bypassing access controls?

question

F

answer

A top-down approach to information security usually begins with a systems administrator's attempt to improve the security of their systems.

question

managerial controls

answer

Which of the following set the direction and scope of the security process and provide detailed instruction for its conduct?

question

utilizes the technical expertise of the individual administrators

answer

Which of the following is a key advantage of the bottom-up approach to security implementation?

question

mission statement

answer

Which of the following explicitly declares the business of the organization and its intended areas of operations?

question

maintenance and change

answer

phase is the last phase of SecSDLC, but perhaps the most important.

question

penetration testing

answer

testing, security personnel simulate or perform specific and controlled attacks to compromise or disrupt their own systems by exploiting documented vulnerabilities.

question

waterfall

answer

In which model in the SecSDLC does the work products of each phase fall into the next phase to serve as its starting point?

question

Strategic plans are used to create tactical plans

answer

Which of the following is true about planning?

question

contingency planning

answer

Which of the following has the main goal of restoring normal modes of operation with minimal cost and disruption to normal business activities after an event?

question

alert roster

answer

is a document containing contact information of the individuals to notify in the event of an actual incident.

question

incident response

answer

plan is a detailed set of processes and procedures that anticipate, detect, and mitigate the effects of an unexpected event that might compromise information resources and assets

question

after action review

answer

When dealing with an incident, the incident response team must conduct a(n) ____________________, which entails a detailed examination of the events that occurred from first detection to final recovery.

question

business continuity

answer

When a disaster renders the current business location unusable, which plan is put into action?

question

simulation

answer

Which contingency plan strategy do individuals work on their own tasks and are responsible for identifying the faults in their own procedures?

question

electronic vaulting

answer

The bulk batch-transfer of data to an off-site facility is known as

question

full-interruption

answer

testing of contingency plans, the individuals follow each and every procedure, including the interruption of service, restoration of data from backups, and notification of appropriate individuals.

question

parallel testing

answer

In which contingency plan strategy do individuals act as if an actual incident occurred, and begin performing their required tasks and executing the necessary procedures, without interfering with the normal operations of the business?

question

prioritize resources associated with the business processes

answer

What is the last stage of the business impact analysis?

question

cold site

answer

In which type of site are no computer hardware or peripherals provided?

question

business continuity

answer

In the event of an incident or disaster, which team sets up and starts off-site operations?

question

F

answer

In most organizations, the COO is responsible for creating the IR plan

question

weighted analysis tool

answer

Which of the following is a tool that can be useful in resolving the issue of what business function is the most critical?

question

conduct an after-action review

answer

After an incident, but before returning to its normal duties, the CSIRT must do which of the following?

question

Activating the alert roster

answer

Which of the following is a responsibility of the crisis management team?

question

full-interruption

answer

is an agency that provides, in the case of DR/BC planning, physical facilities for a fee.

question

BCP BC plan business continuity plan

answer

If operations at the primary site cannot be quickly restored, the ____________________ occurs concurrently with the DR plan, enabling the business to continue at an alternate site.

question

It duplicates computing resources, peripherals, phone systems, applications, and workstations.

answer

Which of the following is true about a hot site?

question

service bureau

answer

is an agency that provides, in the case of DR/BC planning, physical facilities for a fee.

question

F

answer

In a warm site, all services and communications links are fully configured and the site can be fully functional within minutes.

question

F

answer

When an incident takes place, the disaster recovery (DR) plan is invoked before the incident response (IR) plan.

question

Electronic vaulting

answer

Which of the following is usually conducted via leased lines or secure Internet connections whereby the receiving server archives the data as it is received

question

Incident classification

answer

Which of the following is the process of examining a possible incident and determining whether it constitutes an actual incident

question

alert roster

answer

is a document containing contact information of the individuals to notify in the event of an actual incident.

question

F

answer

Training should be as specialized as possible; personnel who are responsible for one duty should not be trained on other duties to avoid confusion during a disaster

Chapter 1 Practice test – Flashcards

Unlock all answers in this set

Haven't found what you were looking for?

Search for samples, answers to your questions and flashcards