12 Jul QUESTION 11. In the ISO/IEC 27002 framework, _________________ desc
QUESTION 11. In the ISO/IEC 27002 framework, _________________ describes the use and controls related to encryption. cryptography operations security communications security access control2 points QUESTION 21. Network infrastructure includes devices upon which an application resides, such as application and database servers. All other non-application networked devices may fall under the definition of platforms.TrueFalse2 points QUESTION 31. If information is modified by any means other than the intentional actions of an authorized user or business process, it could have disastrous results for a business. This underscores the importance of availability controls, which prevents the inadvertent or malicious modification of information. For example, if a product-testing firm that spends many hours testing the optimal settings for a piece of safety equipment used in factories undergoes a power surge that alters the data stored in the testing database, the company might use the incorrect data to recommend equipment settings and jeopardize the safety of factory workers.TrueFalse2 points QUESTION 41. ___________________ addresses how specific a policy is with respect to resources. Availability Confidentiality Integrity Granularity2 points QUESTION 51. Security standards provide guidance for achieving specific security policies, are frequently related to particular technologies or products, are used as benchmarks for audit purposes, and are drawn from industry best practices, experience, business drivers, and internal testing.TrueFalse2 points QUESTION 61. It is important to create an IT security program structure that aligns with program and organizational goals and describes the operating and risk environment. Which of the following is one of the important issues for the structure of the information security program? Human resources security Management and coordination of security-related resources Access control Asset management2 points QUESTION 71. Integrity broadly means limiting disclosure of information to authorized individuals. For example, if the principle of integrity is applied to e-mail, then you might have an objective of ensuring that all sensitive information be protected against eavesdropping. And then to implement this objective you would require that all e-mails containing sensitive information be encrypted, and then ensure that only authorized individuals have access to the decryption key.TrueFalse2 points QUESTION 81. In the third line of defense, the auditor serves as an advisor to the first and second lines of defense in matters concerning risk. The third line must preserve his or her independence but also offer input on risk direction and strategies.TrueFalse2 points QUESTION 91. As the people responsible for ensuring data quality within the business unit, data stewards are the owners of the data.TrueFalse2 points QUESTION 101. Of the different risks that can occur in an IT security framework, events that transpire outside an organization’s domain of control and impact IT operations fall under the category of operational risks.TrueFalse2 points QUESTION 111. There are many IT security policy frameworks that can often be combined to draw upon each of their strengths. Which of the following is not one of the frameworks? COSO for financial controls and enterprise risk management structure COBIT for IT controls, governance, and risk management ITIL for IT services management GRC for IT operations, governance, risk management, and compliance2 points QUESTION 121. Of the six specific business risks, the ___________________ risk results from negative publicity regarding an organization’s practices. Litigation and a decline in revenue are possible outcomes of this type of risk. compliance financial operational reputational2 points QUESTION 131. In the organizational structure, the vendor management team is responsible for managing security concerns involving third parties and vendors. This team conducts an assessment on a vendor before data leaves the organization and is processed by a third party. The concept of separation of duties is often put in place to ensure that data is verified before it leaves the organization.TrueFalse2 points QUESTION 141. _____________________ denotes the use of human interactions to gain any kind of desired access. Most often, this term involves exploiting personal relationships by manipulating an individual into granting access to something a person should not have access to. value delivery tone at the top social engineering strategic risk2 points QUESTION 151. Policies and standards are a collection of concrete definitions that describe acceptable and unacceptable human behavior. The questions related to_______________ are more appropriate for procedures or guidelines than policies or standards, which require detail that is more at the level of________________. where, when and how; what and why how; what where and when; what, who and why where, when, and how; what, who, and why2 points QUESTION 161. Among the parties who should be given the chance to become a second or third layer of review is the legal department, which should be called upon for insight into the policy development process. They can offer counsel on current legislation that requires certain types of information to be protected in specific ways.TrueFalse2 points QUESTION 171. It is human nature to resist working hard unless there is a material outcome to be gained, so the concept of organizational culture is used to identify shared beliefs that employees have regarding financial success.TrueFalse2 points QUESTION 181. The ultimate goal of the review and approval processes is to gain senior executive approval of the policy or standard by the chief information security officer (CISO). In order to gain this approval, the CISO requires all parties to sign off on the document. Which of the following is not among the suggested list of people who should be given the chance to become a second or third layer of review? technical personnel legal audit and compliance finance2 points QUESTION 191. Of the principles that can be used to derive control requirements and help make implementation decisions, which principle functions as a deterrent control and helps to ensure that people understand they are solely responsible for actions they take while using organization resources? awareness principle accountability principle ethics principle timeliness principle2 points QUESTION 201. When changes or maintenance need to be performed, it is helpful to use information that describes changes to the organization; these changes often occur when there are common problems concerning compliance.TrueFalse2 points QUESTION 211. Awareness programs are separated into two parts: awareness and approval. The purpose of awareness is to provide employees a better understanding of security risks. The goal of approval is to gain the buy-in of all employees on the effectiveness of the program after they have demonstrated awareness.TrueFalse2 points QUESTION 221. One of the well-documented reasons for why projects fail is insufficient support from leadership. This occurs when value is only derived from policies when they are enforced. An organization must have the will and process to reward adherence.TrueFalse2 points QUESTION 231. In order to convince an organization to adopt security policies, it is necessary for a manager to have some proficiency in ________________, which refers to certain social personality traits such as the ability to communicate and project optimism. soft skills motivation tone at the top empathy 2 points QUESTION 241. One should focus on measuring risk to the business as opposed to implementation of policies and control when tying policy adherence to performance measurement.TrueFalse2 points QUESTION 251. It is advised to always have discretion with leaders. Explain in general terms what information security policies can and cannot achieve. It is equally important to be conservative in your estimates regarding the impact on the business; otherwise you risk losing credibility.TrueFalse2 points QUESTION 261. It is important for an organization to determine how it wants to manage ____________________, which means how to group various tasks, and____________________, which relates to the number of layers and number of direct reports found in an organization. division of labor, span of control span of control, division of labor separation of duties, flat organizational structure division of labor, separation of duties2 points QUESTION 271. One of the basic measurements for assessing whether or not individuals are being held accountable for adherence to security policies is the reported number of security violations by employees. You should investigate any unexplained increases in reported violations to determine why an abnormal number is occurring.TrueFalse2 points QUESTION 281. For leaders, implementing security policies is all about working through others to gain their support and adhere to the policies. Of the widely accepted leadership rules that apply to security policies, which of the following is not among these rules? productivity values support training
Our website has a team of professional writers who can help you write any of your homework. They will write your papers from scratch. We also have a team of editors just to make sure all papers are of HIGH QUALITY & PLAGIARISM FREE. To make an Order you only need to click Ask A Question and we will direct you to our Order Page at WriteDemy. Then fill Our Order Form with all your assignment instructions. Select your deadline and pay for your paper. You will get it few hours before your set deadline.
Fill in all the assignment paper details that are required in the order form with the standard information being the page count, deadline, academic level and type of paper. It is advisable to have this information at hand so that you can quickly fill in the necessary information needed in the form for the essay writer to be immediately assigned to your writing project. Make payment for the custom essay order to enable us to assign a suitable writer to your order. Payments are made through Paypal on a secured billing page. Finally, sit back and relax.
About Writedemy
We are a professional paper writing website. If you have searched a question and bumped into our website just know you are in the right place to get help in your coursework. We offer HIGH QUALITY & PLAGIARISM FREE Papers.
How It Works
To make an Order you only need to click on “Order Now” and we will direct you to our Order Page. Fill Our Order Form with all your assignment instructions. Select your deadline and pay for your paper. You will get it few hours before your set deadline.
Are there Discounts?
All new clients are eligible for 20% off in their first Order. Our payment method is safe and secure.