Question 1

A firewall can be a single device or a firewall extranet, which consists of multiple firewalls creating a buffer between the outside and inside networks.

Accepted Answer

False

Question 2

A(n) full backup only archives the files that have been modified that day, and thus requires less space and time than the differential.

Accepted Answer

False

Question 3

A(n) contingency plan is prepared by the organization to anticipate, react to, and recover from events that threaten the security of information and information assets in the organization, and, subsequently, to restore the organization to normal modes of business operations.

Accepted Answer

True

Question 4

NIST documents can assist in the design of a security framework.

Accepted Answer

True

Question 5

The security framework is a more detailed version of the security blueprint.

Accepted Answer

False

Question 6

Technical controls are the tactical and technical implementations of security in the organization.

Accepted Answer

True

Question 7

A managerial guidance SysSP document is created by the IT experts in a company to guide management in the implementation and configuration of technology.

Accepted Answer

False

Question 8

ISO/IEC 17799 is more useful than any other information security management approach.

Accepted Answer

False

Question 9

The Federal Bureau of Investigation deals with many computer crimes that are categorized as felonies.

Accepted Answer

True

Question 10

Quality security programs begin and end with policy.

Accepted Answer

True

Question 11

A policy should state that if employees violate a company policy or any law using company technologies, the company will protect them, and the company is liable for the employee\'s actions.

Accepted Answer

False

Question 12

A disaster recovery plan addresses the preparation for and recovery from a disaster, whether natural or man-made.

Accepted Answer

True

Question 13

Many industry observers claim that ISO/IEC 17799 is not as complete as other frameworks.

Accepted Answer

True

Question 14

Proxy servers can temporarily store a frequently visited Web page, and thus are sometimes called demilitarized servers.

Accepted Answer

False

Question 15

NIST 800-14, The Principles for Securing Information Technology Systems, provides detailed methods for assessing, designing, and implementing controls and plans for applications of varying size.

Accepted Answer

False

Question 16

A cold site provides many of the same services and options of a hot site.

Accepted Answer

False

Question 17

ACLs are more specific to the operation of a system than rule-based policies and they may or may not deal with users directly.

Accepted Answer

False

Question 18

Evidence is the physical object or documented information that proves an action occurred or identifies the intent of a perpetrator.

Accepted Answer

True

Question 19

NIST Special Publication 800-18 Rev. 1, The Guide for Developing Security Plans for Federal Information Systems, includes templates for major application security plans.

Accepted Answer

True

Question 20

A service bureau is an agency that provides a service for a fee.

Accepted Answer

True

Question 21

The Federal Agency Security Practices (FASP) site is a popular place to look up best practices.

Accepted Answer

True

Question 22

A standard is a plan or course of action that conveys instructions from an organization\'s senior management to those who make decisions, take actions, and perform other duties.

Accepted Answer

False

Question 23

Failure to develop an information security system based on the organization\'s mission, vision, and culture guarantees the failure of the information security program.

Accepted Answer

True

Question 24

One of the basic tenets of security architectures is the layered implementation of security, which is called defense in layers.

Accepted Answer

False

Question 25

A(n) integrated information security policy is also known as a general security policy.

Accepted Answer

False

Question 26

Each policy should contain procedures and a timetable for periodic review.

Accepted Answer

True

Question 27

A(n) IR plan ensures that critical business functions continue if a catastrophic incident or disaster occurs.

Accepted Answer

False

Question 28

Additional redundancy to RAID can be provided by mirroring entire servers called redundant servers or server fault tolerance.

Accepted Answer

True

Question 29

Disaster recovery personnel must know their roles without supporting documentation.

Accepted Answer

True

Question 30

A(n) honeynet is usually a computing device or a specially configured computer that allows or prevents access to a defined area based on a set of rules.

Accepted Answer

False

Question 31

Every member of the organization needs a formal degree or certificate in information security.

Accepted Answer

False

Question 32

Informational controls guide the development of education, training, and awareness programs for users, administrators, and management.

Accepted Answer

False

Question 33

Management controls address the design and implementation of the security planning process and security program management.

Accepted Answer

True

Question 34

Database shadowing only processes a duplicate in real-time data storage but does not duplicate the databases at the remote site.

Accepted Answer

False

Question 35

The gateway router can be used as the front-line defense against attacks, as it can be configured to allow only set types of protocols to enter.

Accepted Answer

True

Question 36

Laws are more detailed statements of what must be done to comply with policy.

Accepted Answer

False

Question 37

Security training provides detailed information and hands-on instruction to employees to prepare them to perform their duties securely.

Accepted Answer

True

Question 38

Host-based IDPSs are usually installed on the machines they protect to monitor the status of various files stored on those machines.

Accepted Answer

True

Question 39

Within security perimeters the organization can establish security circles.

Accepted Answer

False

Question 40

The global information security community has universally agreed with the justification for the code of practices as identified in the ISO/IEC 17799.

Accepted Answer

False

Question 41

You can create a single comprehensive ISSP document covering all information security issues.

Accepted Answer

True

Question 42

The Security Area Working Group endorses ISO/IEC 17799.

Accepted Answer

False

Question 43

The standard should begin with a clear statement of purpose.

Accepted Answer

False

Question 44

To remain viable, security policies must have a responsible individual, a schedule of reviews, a method for making recommendations for reviews, and a policy issuance and planned revision date.

Accepted Answer

True

Question 45

Some policies may also need a(n) sunset clause indicating their expiration date.

Accepted Answer

True

Question 46

The policy administrator is responsible for the creation, revision, distribution, and storage of the policy.

Accepted Answer

True

Question 47

The vision of an organization is a written statement of an organization\'s purpose.

Accepted Answer

False

Question 48

A(n) capability table specifies which subjects and objects users or groups can access.

Accepted Answer

True

Question 49

Information security safeguards provide two levels of control: managerial and remedial.

Accepted Answer

False

Question 50

Policies are living documents that must be managed.

Accepted Answer

True

Question 51

SP 800-18 Rev. 1, The Guide for Developing Security Plans for Federal Information Systems, must be customized to fit the particular needs of a(n) organization.

Accepted Answer

True

Question 52

A(n) sequential roster is activated as the first person calls a few people on the roster, who in turn call a few other people.

Accepted Answer

False

Question 53

The ISSP sets out the requirements that must be met by the information security blueprint or framework.

Accepted Answer

False

Question 54

The security blueprint is the basis for the design, selection, and implementation of all security program elements including such things as policy implementation and ongoing policy management.

Accepted Answer

True

Question 55

Systems-specific security policies are formalized as written documents readily identifiable as policy.

Accepted Answer

False

Question 56

Strategic planning is the process of moving the organization towards its ____.

Accepted Answer

Vision

Question 57

The ____________________ of an organization is a written statement about the organization\'s goals answering the question of where the organization will be in five years.

Accepted Answer

Vision

Question 58

Incident damage ____ is the rapid determination of the scope of the breach of the confidentiality, integrity, and availability of information and information assets during or just following an incident.

Accepted Answer

Assessment

Question 59

Effective management includes planning and ____.

Accepted Answer

Controlling   Organizing   and Leading

Question 60

The transfer of live transactions to an off-site facility is called ____________________.

Accepted Answer

Remote Journaling

Question 61

The ____ is based on and directly supports the mission, vision, and direction of the organization and sets the strategic direction, scope, and tone for all security efforts.

Accepted Answer

EISP

Question 62

A(n) ____________________ server performs actions on behalf of another system.

Accepted Answer

Proxy

Question 63

What country adopted ISO/IEC 17799?

Accepted Answer

Britain

Question 64

The spheres of ____ are the foundation of the security framework and illustrate how information is under attack from a variety of sources.

Accepted Answer

Security

Information Security Chapter 5 – Flashcards

Unlock all answers in this set

Haven't found what you were looking for?

Search for samples, answers to your questions and flashcards