Question 1

In order to avoid reprisal or retaliation against employees,reporting of violations of policy should be set up to be ____________________ .

Accepted Answer

The answer of In order to avoid reprisal or retaliation...

Question 2

The ____ layer is the outermost layer of the bull's-eye model,hence the first to be assessed for marginal improvement.

Accepted Answer

A)   Systems
B)   Networks
C)   Policies
D)   ApplicationsE) C) and D)
F) B) and C)

Question 3

The ISSP sections Authorized Access and Usage of Equipment and Prohibited Usage of Equipment may be combined into a section called ____.

Accepted Answer

A)   Violations of Policy
B)   Limitations of Liability
C)   Appropriate Use Policy
D)   Systems ManagementE) None of the above
F) A) and B)

Question 4

A(n)standard is a more detailed statement of what must be done to comply with a policy._________________________

Accepted Answer

A) True 
 B)False

Question 5

Today,most EULAs are presented on blow-by screens.

Accepted Answer

A) True 
 B)False

Question 6

Which of the following is a type of information security policy that deals with the entirety of an organization's information security efforts?

Accepted Answer

A)   Issue-specific security policy
B)   System-specific security policy
C)   Company-wide security policy
D)   Enterprise information security policyE) C) and D)
F) B) and D)

Question 7

Unless a policy actually reaches the end users,it cannot be enforced.

Accepted Answer

A) True 
 B)False

Question 8

Granularity is the level of specificity and detail with which administrators can control access to their systems._________________________

Accepted Answer

A) True 
 B)False

Question 9

The policy administrator must be technically oriented.

Accepted Answer

A) True 
 B)False

Question 10

A disadvantage of creating a number of independent ISSP documents is that the result may ____.

Accepted Answer

A)   overgeneralize the issues
B)   suffer from poor policy dissemination
C)   skip over vulnerabilities
D)   be written by those with less complete subject matter expertiseE) None of the above
F) All of the above

Question 11

If multiple audiences exist for information security policies,different documents must be created for each audience.

Accepted Answer

A) True 
 B)False

Question 12

Which of the following is true about information security policy?

Accepted Answer

A)   It should be written after a company has encountered an incident
B)   It may conflict with the law
C)   End users should not be involved in the creation of the policy
D)   It must be able to stand up in court, if challengedE) None of the above
F) B) and D)

Question 13

A standard is built from a ____.

Accepted Answer

A)   practice
B)   policy
C)   procedure
D)   guidelineE) A) and C)
F) A) and D)

Question 14

The policy champion and manager is called the ____.

Accepted Answer

A)   policy developer
B)   lead policy developer
C)   policy enforcer
D)   policy administratorE) B) and C)
F) All of the above

Question 15

Configuration codes entered into security systems to guide the execution of the system when information is passing through it are called ____.

Accepted Answer

A)   access control lists
B)   user profiles
C)   configuration rules
D)   capability tableE) A) and B)
F) B) and D)

Question 16

Which of the following is NOT a guideline that may help in the formulation of information technology (IT) policy as well as information security policy?

Accepted Answer

A)   All policies must contribute to the success of the organization
B)   Policies must be reviewed and approved by legal council before administration
C)   Management must ensure the adequate sharing of responsibility for proper use of information systems
D)   End users of information systems should be involved in the steps of policy formulationE) C) and D)
F) None of the above

Question 17

A(n)enterprise information security policy is a type of information security policy that provides detailed,targeted guidance to instruct all members of the organization in the use of technology-based systems._________________________

Accepted Answer

A) True 
 B)False

Question 18

The responsibilities of both the users and the systems administrators with regard to specific technology rules should be specified in the ____________________ section of the ISSP.

Accepted Answer

The answer of The responsibilities of both the users and...

Question 19

A disadvantage of creating a single comprehensive ISSP document is that such a document ____.

Accepted Answer

A)   usually fails to cover all the necessary issues
B)   can suffer from poor policy review
C)   can suffer from poor policy enforcement
D)   may overgeneralize the issues and skip over vulnerabilitiesE) C) and D)
F) None of the above

Question 20

____ comprise a set of rules that dictates acceptable and unacceptable behavior within an organization.

Accepted Answer

A)   Standards
B)   Procedures
C)   Guidelines
D)   PoliciesE) A) and B)
F) C) and D)

Exam 4: Information Security Policy

Which of the following is a type of information security policy that deals with the entirety of an organization's information security efforts?

Correct AnswerverifiedShow Answer

In order to avoid reprisal or retaliation against employees,reporting of violations of policy should be set up to be ____________________ .

Correct AnswerverifiedShow Answer

Granularity is the level of specificity and detail with which administrators can control access to their systems._________________________

Correct AnswerverifiedShow Answer

The policy champion and manager is called the ____.

Correct AnswerverifiedShow Answer

A disadvantage of creating a single comprehensive ISSP document is that such a document ____.

Correct AnswerverifiedShow Answer

Configuration codes entered into security systems to guide the execution of the system when information is passing through it are called ____.

Correct AnswerverifiedShow Answer

Which of the following is NOT a guideline that may help in the formulation of information technology (IT) policy as well as information security policy?

Correct AnswerverifiedShow Answer

Unless a policy actually reaches the end users,it cannot be enforced.

Correct AnswerverifiedShow Answer

A(n)enterprise information security policy is a type of information security policy that provides detailed,targeted guidance to instruct all members of the organization in the use of technology-based systems._________________________

Correct AnswerverifiedShow Answer

Today,most EULAs are presented on blow-by screens.

Correct AnswerverifiedShow Answer

If multiple audiences exist for information security policies,different documents must be created for each audience.

Correct AnswerverifiedShow Answer

A(n)standard is a more detailed statement of what must be done to comply with a policy._________________________

Correct AnswerverifiedShow Answer

The responsibilities of both the users and the systems administrators with regard to specific technology rules should be specified in the ____________________ section of the ISSP.

Correct AnswerverifiedShow Answer

A standard is built from a ____.

Correct AnswerverifiedShow Answer

The policy administrator must be technically oriented.

Correct AnswerverifiedShow Answer

Which of the following is true about information security policy?

Correct AnswerverifiedShow Answer

A disadvantage of creating a number of independent ISSP documents is that the result may ____.

Correct AnswerverifiedShow Answer

The ____ layer is the outermost layer of the bull's-eye model,hence the first to be assessed for marginal improvement.

Correct AnswerverifiedShow Answer

The ISSP sections Authorized Access and Usage of Equipment and Prohibited Usage of Equipment may be combined into a section called ____.

Correct AnswerverifiedShow Answer

____ comprise a set of rules that dictates acceptable and unacceptable behavior within an organization.

Correct AnswerverifiedShow Answer

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified