security chapter 14 – Flashcards
Unlock all answers in this set
Unlock answersquestion
Audits serve to verify that the security protections enacted by an organization are being followed and that corrective actions can be swiftly implemented before an attacker exploits a vulnerability.
answer
True
question
The first phase of the security policy cycle involves a vulnerability assessment.
answer
True
question
What may be defined as the components required to identify, analyze, and contain an incident? Vulnerability response Incident response Risk response Threat response
answer
Incident response
question
What kind of learners learn from taking notes, being at the front of the class, and watching presentations? Kinesthetic Auditory Spatial Visual
answer
Visual
question
Generally considered to be the most important information security policies, what item below defines the actions a user may perform while accessing systems and networking equipment? Acceptable use policies Encryption policies Data loss policies VPN policies
answer
Acceptable use policies
question
Most organizations follow a three-phase cycle in the development and maintenance of a security policy.
answer
True
question
What concept below is at the very heart of information security? threat mitigation risk management
answer
risk
question
What kind of policy outlines how organizations use personal information it collects? VPN network encryption privacy
answer
privacy
question
A person's fundamental beliefs and principals, which are used to define what is good, and how to distinguish right from wrong, are collectively called a person's: Morals Values Ethics Standards
answer
Values
question
The objective of incident management is to restore normal operations as quickly as possible with the least possible impact on either the business or the users.
answer
true
question
What are values that are attributed to a system of beliefs that help the individual distinguish right from wrong called? Morals Ethics Standards Morays
answer
Morals
question
A due process policy is a policy that defines the actions users may perform while accessing systems and networking equipment.
answer
False
question
Which type of network below uses a direct connection between users, and involves each device simultaneously acting as a client and a server? Peer Client-server P2P Share
answer
P2P
question
What type of learner tends to sit in the middle of the class and learns best through lectures and discussions? Visual Auditory Kinesthetic Spatial
answer
Auditory
question
Select below the option that best describes a policy: A collection of requirements specific to the system or procedure that must be met by everyone A collection of suggestions that should be implemented A list of all items that have a positive economic value A document that outlines specific requirements or rules that must be met
answer
A document that outlines specific requirements or rules that must be met
question
Websites that group individuals and organizations into clusters or groups based on some sort of affiliation are considered to be what type of websites? social networking social engineering social management social control
answer
social networking
question
What is the name for a framework and corresponding functions required to enable incident response and incident handling within an organization? Incident reporting Incident management Incident handling Incident planning
answer
Incident management
question
Due to the potential impact of changes that can affect all users in a organization, and considering that security vulnerabilities can arise from uncoordinated changes, what should an organization create to oversee changes? change management team incident response team security control team compliance team
answer
change management team
question
​What is the most common type of P2P network? ​Kazaa ​Bittorrent ​eDonkey ​Sneakernet
answer
​Bittorrent
question
A collection of suggestions that should be implemented are referred to as a: security policy baseline guideline security procedure
answer
guideline
question
The "framework" and functions required to enable incident response and incident handling within an organization
answer
Incident management
question
Risk control type that covers the operational procedures to limit risk.
answer
Operational Risk Control Type
question
A risk control type that involves using technology to control risk
answer
Technical risk control type
question
A methodology for making modifications to a system and keeping track of those changes.
answer
Change Management
question
The expected monetary loss every time a risk occurs.
answer
Single Loss Expectancy (SLE)
question
A security policy that outlines how the organization uses personal information it collects.
answer
privacy policy
question
An event that in the beginning is considered to be a risk yet turns out to not be one.
answer
False positive
question
A policy that defines the actions users may perform while access systems and networking equipment
answer
Acceptable use policy
question
A network that does not have servers, so each device simultaneously functions as both a client and a server to all other devices connected to the network.
answer
Peer-to-peer Network
question
An event that does not appear to be a risk but actually turns out to be one.
answer
False negative
question
Which term below describes the art of helping an adult learn?
answer
andragogical
question
Policies that include statements regarding how an employee's information technology resources will be addressed are part of a:
answer
security-related human resource policy
question
What type of learner learns best through hands-on approaches?
answer
Kinesthetic
question
What can be defined as the study of what a group of people understand to be good and right behavior and how people make those judgments?
answer
Ethics
