Domain 3.5: Identify policies and best practices

Which choice below represents the recommended fire suppression method for an electrical fire? A) Water B) Argon C) Soda acid D) Foam E) All of these

B) Argon - Argon is an EPA approved replacement for Halon.

Mobile device management tools allow, as the name implies, the ability of network administrations to remotely manage remote devices. One feature allows devices to quickly be enrolled on a network. What is this capability known as? A) CARP B) On-boarding C) Change management D) Off-boarding

B) On-boarding

This document is designed to address the functions of network administrators and specified support staff. A) Service Level Agreement B) Privileged User Agreement C) Non-Disclosure Agreement D) Memorandum of Agreement

B) Privileged User Agreement - A Privileged User Agreement allows qualified company personnel the rights and privileges necessary to perform their duties without compromising security.

Which choices below represent recommended fire suppression methods for common combustibles? ( Choose all that apply). A) Halon B) Water C) Soda Acid D) Foam E) All of these

B) Water C) Soda Acid

Which choice below addresses the use of computer equipment and network resources for use that is non-beneficial to the company? A) Fair use policy B) Due care policy C) Acceptable use policy D) Security policy

C) Acceptable use policy - Acceptable use policy (AUP) is a set of rules applied by management of a network, website, service, or large computer system that restricts the ways in which the network or system may be used.

Which choice below represents that an organization is responsibly managing its data and security? A) Acceptable use B) Fair use C) Due care D) Security

C) Due care - Due care means that a company is taking reasonable precautions and being responsible

Which type of policy determines if information is secret, top-secret, or public? A) Information retention policies B) Information destruction policies C) Information classification policies D) Information security policies

C) Information classification policies - Information classification involves determining whether information is for internal use only or for public distribution or anywhere in between.

Which of the following bits of safety advice about lifting equipment is NOT recommended? A) Be careful not to twist when lifting. B) Keep objects as close to your body as possible. C) Lift with your back not your legs. D) When possible push instead of pull.

C) Lift with your back not your legs.

When DLP is implemented on your network, which method will successfully copy sensitive data? A) Flash drive B) FTP C) Cloud Storage D) Email E) None of these

E) None of these - DLP (Data Loss Prevention) protects sensitive data from being copied by any means.

When comparing different ways to ensure physical security you come across a device called a degausser. How would such a device be utilized as a security deterrent? A) As a millimeter-wave scanner B) As an X-ray machine for detecting weapons C) To destroy magnetic storage devices D) For advanced imaging technology machines.

C) To destroy magnetic storage devices - To guard against the threat of information being stolen from a decommissioned hard drive, you can erase their content using a magnetic hard drive eraser called a degausser. The degausser will make any data on the driver unreadable typically in under one minute. The degausser as first used in the film industry to erase magnetic strips as a cost saving device in order to make the film reusable.

Every organization should conduct a posture assessment, which is a thorough examination of each aspect of the network to determine how it might be compromised. Posture assessments should be performed at least __________________. A) Once a week B) Monthly C) Yearly but preferably quarterly D) each time a breach is made to the network

C) Yearly but preferably quarterly - Every organization should assess its security risks by periodically conducting a posture assessment with a thorough examination of each aspect of the network. This is to determine how the network may be compromised a security risk. Posture assessments should be performed at least annually and preferably quarterly. Posture assessments should also be performed after making any significant changes to the network.

When traveling to another country, which of the listed actions might you be required to perform? A) Obtain an export license B) Decrypt your data C) Prepare for device seizure and inspection D) All of these choices are valid.

D) All of these choices are valid. - International travel requires knowledge of the international export and import controls. These controls cover which data, devices, technology, and software are acceptable. Some countries do not allow encrypted data, while others need a permit.

You are the administrator of a small network and are in the process of setting up an account for a new employee, Mr. Bob smith. You have a policy of changing passwords every 30 days. Which of the following passwords would provide the most security from other employees attempting to hack into Mr. Smith's account? A) BSMITH B) SMITHB C) BSMITH1 D) BSM1ITh

D) BSM1ITh - Remember, passwords should be at least 6 characters long, a mixture of upper and lower case, non-words and symbols.

Which policy allows users to bring their personal technology into the workplace to perform non-work-related activities? A) PUA B) AUP C) NDA D) BYOD

D) BYOD - The BYOD (Bring Your Own Device) policy permits users to operate their personal devices while in the workplace. A PUA (Privileged user agreement) addresses the specific concerns of privileged users and the data that is accessible to them. The AUP (Acceptable use Policy) covers all aspects of the use of network resources in the workplace. The NDA (Non-disclosure agreement) covers the use of sensitive information, primarily the dissemination of sensitive information to third parties and competitor.

How can you improve password security? A) Create random passwords B) Specify password length C) Prevent users from having access to passwords D) Force a password change periodically.

D) Force a password change periodically. - Remember changing passwords on a schedule helps if a password is discovered. The password will not be useful to a hacker for long.

Which of the choices listed below correctly identifies a policy that addresses how to deal with a security issue after that issue has happened? A) Due care policy B) Separation of duties policy C) Acceptable use policy D) Incident response policy

D) Incident response policy - Incident are typically reported to an Information security Incident Response Team that determines the correct response to the incident by its interpretation of the Incident Response Policy.

Which documentation would be most useful to you if you need to determine how to carry out a proposed change in your network infrastructure? A) Wiring schematics B) Physical and logical network diagrams C) Baselines D) Policies and procedures

D) Policies and procedures

Which choice below correctly identifies a general statement produced by senior management and the technology department to dictate what security means to the organization? A) Acceptable use policy B) Fair use policy C) Due care policy D) Security policy

D) Security policy - Security policy is a definition of what it means to be secure for a system, organization or other entity. For an organization, it addresses the constraints on behavior of its members as well as restrictions imposed on opponents by mechanisms such as doors, locks, keys, and walls.

Asset disposal is covered as part of which network management process? A) DLP B) AUP C) NDA D) System life cycle E) Off-boarding

D) System life cycle - The system life cycle is part of network maintenance and covers the removal, replacement, and disposal of outdated devices. The AUP (Acceptable use policy) covers all aspects of the use of network resources in the workplace. The NDA (Non-disclosure agreement) covers the use of sensitive information, primarily the dissemination of sensitive information to third parties and competitors. Off-boarding is the process of disabling a wireless client's network access.

Which of the following passwords provide the best security? A) user2 B) userTwo C) password D) User$Two

D) User$Two

True or False? Once an incident has been contained it will be necessary to eradicate any causes of the incident.

True - Detection is not good enough; future attacks must be stopped and data that was accessed needs to be assessed.