IA 6473 Chapter 8
Which of the following provides advice about the implementation of sound controls and control objectives for InfoSec, and was created by ISACA and the IT Governance Institute? NIST ISO COSO COBIT
COBIT
Dumpster exploitation is an information attack that involves searching through a target organization's trash and recycling bins for sensitive information. __________ True False
False
In a lattice-based access control, a restriction table is the row of attributes associated with a particular subject (such as a user). __________ True False
False
In information security, a framework or security model customized to an organization, including implementation details, is known as a template. __________ True False
False
In information security, a specification of a model to be followed during the design, selection, and initial and ongoing implementation of all subsequent security controls is known as a blueprint. __________ True False
False
Separation of duties is the principle by which members of the organization can access the minimum amount of information for the minimum amount of time necessary to perform their required duties. True False
False
The Information Technology Infrastructure Library provides guidance in the development and implementation of an organizational InfoSec governance structure. True False
False
The data access principle that ensures no unnecessary access to data exists by regulating members so they can perform only the minimum data manipulation necessary is known as required privilege. __________ True False
False
The principle of limiting users' access privileges to the specific information required to perform their assigned tasks is known as minimal access. True False
False
Under the Clark-Wilson model, internal consistency means that the system is consistent with similar data at the organization's competitors. True False
False
A security monitor is a conceptual piece of the system within the trusted computer base that manages access controls—in other words, it mediates all access to objects by subjects. __________ True False
False
The Information Technology Infrastructure Library (ITIL) is a collection of policies and practices for managing the development and operation of IT infrastructures. __________ True False
False
The Information Security __________ is a managerial model provided by an industry working group, National Cyber Security Partnership, which provides guidance in the development and implementation of organizational InfoSec structures and recommends the responsibilities that various members should have in an organization. Compliance Architecture Governance Framework Risk Model Security Blueprint
Governance Framework
The COSO framework is built on five interrelated components. Which of the following is NOT one of them? control activities risk assessment InfoSec governance control environment
InfoSec governance
Under the Common Criteria, which term describes the user-generated specifications for security requirements? Security Target (ST) Target of Evaluation (ToE) Protection Profile (PP) Security Functional Requirements (SFRs)
Protection Profile (PP)
This NIST publication provides information on the elements of InfoSec, key roles and responsibilities, an overview of threats and vulnerabilities, a description of the three NIST security policy categories, and an overview of the NIST RM Framework and its use, among other topics needed for a foundation in InfoSec. SP 800-34, Rev. 1: Contingency Planning Guide for Federal Information Systems (2010) SP 800-18, Rev. 1: Guide for Developing Security Plans for Federal Information Systems (2006) SP 800-12, Rev. 1: An Introduction to Information Security (2017) SP 800-55, Rev. 1: Performance Measurement Guide for Information Security (2008) Question 300 / 1 point
SP 800-12, Rev. 1: An Introduction to Information Security (2017)
Which security architecture model is part of a larger series of standards collectively referred to as the "Rainbow Series"? TCSEC Bell-LaPadula ITSEC Common Criteria
TCSEC
The information security principle that requires significant tasks to be split up so that more than one individual is required to complete them is called isolation of duties. __________ True False
True
The principle of limiting users' access privileges to the specific information required to perform their assigned tasks is known as need-to-know. __________ True False
True
Under lattice-based access controls, the column of attributes associated with a particular object (such as a printer) is referred to as which of the following? sensitivity level capabilities table access control list access matrix
access control list
An ATM that limits what kinds of transactions a user can perform is an example of which type of access control? content-dependent constrained user interface nondiscretionary temporal isolation
constrained user interface
In which form of access control is access to a specific set of information contingent on its subject matter? content-dependent access controls constrained user interfaces none of these temporal isolation
content-dependent access controls
Controls that remedy a circumstance or mitigate damage done during an incident are categorized as which of the following? corrective deterrent preventative compensating
corrective
An information attack that involves searching through a target organization's trash and recycling bins for sensitive information is known as __________. social engineering rubbish surfing dumpster diving trash trolling
dumpster diving
In information security, a specification of a model to be followed during the design, selection, and initial and ongoing implementation of all subsequent security controls is known as a __________. framework blueprint security plan security standard
framework
Which of the following is a generic model for a security program? blueprint methodology security standard framework
framework
Which access control principle specifies that no unnecessary access to data exists by regulating members so they can perform only the minimum data manipulation necessary? need-to-know least privilege eyes only separation of duties
least privilege
The Information Technology Infrastructure Library (ITIL) is a collection of methods and practices primarily for __________. managing the security infrastructure managing the development and operation of IT infrastructures developing secure Web applications operation of IT control systems to improve security
managing the development and operation of IT infrastructures
Which access control principle limits a user's access to the specific information required to perform the currently assigned task? eyes only need-to-know separation of duties least privilege
need-to-know
Which of the following is NOT a change control principle of the Clark-Wilson model? no unauthorized changes by authorized subjects no changes by unauthorized subjects no changes by authorized subjects without external validation the maintenance of internal and external consistency
no changes by authorized subjects without external validation
Which type of access controls can be role-based or task-based? discretionary constrained nondiscretionary content-dependent
nondiscretionary
Which piece of the Trusted Computing Base's security system manages access controls? reference monitor covert channel trusted computing base verification module
reference monitor
Which of the following specifies the authorization level that each user of an information asset is permitted to access, subject to the need-to-know principle? task-based access controls security clearances sensitivity levels discretionary access controls
security clearances
What is the information security principle that requires significant tasks to be split up so that more than one individual is required to complete them? need-to-know eyes only separation of duties least privilege
separation of duties
