CSS Midterm
Smaller organizations tend to spend approximately __________ percent of the total IT budget on security
20
Larger organizations tend to spend approximately __________ percent of the total IT budget on security
5
Which of the following is NOT a part of an information security program?
All of these are part of an information security program
Which of the following should be included in an InfoSec governance program?
An InfoSec risk management methodology
When using the Governing for Enterprise Security (GES) program, an Enterprise Security Program (ESP) should be structured so that governance activities are driven by the organization's executive management, and so that it selects key stakeholders as well as the ____________.
Board Risk Committee
Which of the following is NOT a step in the problem-solving process?
Build support among management for the candidate solution.
Which of the following is the study of the rightness or wrongness of intentions and motives as opposed to the rightness or wrongness of the consequences (also known as duty- or obligation-based ethics)?
Deontological ethics
The penalties for offenses related to the National Information Infrastructure Protection Act of 1996 depend on whether the offense is judged to have been committed for several reasons. Which of the following is NOT one of those reasons ?
For political advantage
__________ is the set of responsibilities and practices exercised by the board and executive management with the goal of providing strategic direction, ensuring that objectives are achieved, ascertaining that risks are managed appropriately, and verifying that the enterprise's resources are used responsibly.
Governance
The National Association of Corporate Directors (NACD) recommends four essential practices for boards of directors. Which of the following is NOT one of these recommended practices?
Hold regular meetings with the CIO to discuss tactical InfoSec planning
According to Wood, which of the following is a reason the InfoSec department should report directly to top management?
It fosters objectivity and the ability to perceive what's truly in the best interest of the organization as a whole
Which of the following is an information security governance responsibility of the chief information security officer ?
Set security policy, procedures, programs, and training.
Which of the following describes the primary reason the InfoSec department should NOT fall under the IT function?
There is a misalignment between the goals of the InfoSec department, which focuses on protecting information, and the IT function, which focuses on efficiency in processing and accessing information.
The basic outcomes of InfoSec governance should include all but which of the following?
Time management by aligning resources with personnel schedules and organizational objectives
Which of the following sections of the ISSP provides instructions on how to report observed or suspected policy infractions?
Violations of Policy
What are the two general approaches for controlling user authorization for the use of a technology?
access control lists and capability tables
What do audit logs that track user activity on an information system provide?
accountability
In which phase of the SecSDLC does the risk management task occur?
analysis
Force majeure includes all of the following EXCEPT:
armed robbery
Which of the following is a policy implementation model that addresses issues by moving from the general to the specific and is a proven mechanism for prioritizing complex changes?
bulls-eye model
A 2007 Deloitte report found that enterprise risk management is a valuable approach that can better align security functions with the __________ while offering opportunities to lower costs.
business mission
The purpose of SETA is to enhance security in all but which of the following ways?
by adding barriers
Which of the following is a disadvantage of the individual policy approach to creating and managing ISSPs?
can suffer from poor policy dissemination, enforcement, and review
Which of the following is NOT one of the three general causes of unethical and illegal behavior?
carelessness
Which of the following is NOT among the functions typically performed within the InfoSec department as a compliance enforcement obligation?
centralized authentication
A senior executive who promotes the project and ensures its support, both financially and administratively, at the highest levels of the organization is needed to fill the role of a(n) ____________ on a development team.
champion
Which ethical standard is based on the notion that life in community yields a positive outcome for the individual, requiring each individual to contribute to that community ?
common good
Which of the following is a C.I.A. triad characteristic that ensures only those with sufficient privileges and a demonstrated need may access certain information?
confidentiality
Individuals who control, and are therefore responsible for, the security and use of a particular set of information are known as ____________.
data owners
Which of the following ethical frameworks is the study of the choices that have been made by individuals in the past?
descriptive ethics
The __________ phase of the SecSDLC has team members create and develop the blueprint for security and develop critical contingency plans for incident response.
design
Investigations involving the preservation, identification, extraction, documentation, and interpretation of computer media for evidentiary and root cause analysis are known as _________.
digital forensics
A __________ is an attack in which a coordinated stream of requests is launched against a target from many locations at the same time
distributed denial of service
A process focused on the identification and location of potential evidence related to a specific legal action after it was collected through digital forensics is known as _________.
e-discovery
Which of the following is the most cost-effective method for disseminating security information and news to employees?
e-mailed security newsletter
Also known as "items of potential evidentiary value," any information that could potentially support the organization's legal or policy-based case against a suspect is known as _________.
evidentiary material
Writing a policy is not always as easy as it seems. However, the prudent security manager always scours available resources for __________ that may be adapted to the organization.
examples
The coherent application of methodical investigatory techniques to collect, preserve, and present evidence of crimes in a court or court-like setting is known as _________.
forensics
Laws, policies, and their associated penalties only provide deterrence if three conditions are present. Which of these is NOT one of them?
frequency of review
ISO 27014:2013 is the ISO 27000 series standard for ____________.
governance of information security
Which of the following is NOT a step in the process of implementing training?
hire expert consultants
As frustrating as viruses and worms are, perhaps more time and money is spent on resolving virus __________.
hoaxes
In digital forensics, all investigations follow the same basic methodology once permission to search and seize is received, beginning with _________.
identifying relevant items of evidentiary value
Which of the following is a common element of the enterprise information security policy?
information on the structure of the InfoSec organization
The __________ phase of the SecSDLC begins with a directive from upper management specifying the process, outcomes, and goals of the project as well as its budget and other constraints
investigation
What is the first phase of the SecSDLC?
investigation
Which type of security policy is intended to provide a common understanding of the purposes for which an employee can and cannot use a resource?
issue-specific
There are three general categories of unethical behavior that organizations and society should seek to eliminate. Which of the following is NOT one of them?
malice
Many organizations create a single document that combines elements of the __________ SysSP and the ___________ SysSP.
management guidance, technical specifications
The protection of voice and data components, connections, and content is known as __________ security
network
Which of the following variables is the most influential in determining how to structure an information security program?
organizational culture
Which function of InfoSec management encompasses security personnel as well as aspects of the SETA program
people
According to NIST SP 800-18, Rev. 1, which individual is responsible for the creation, revision, distribution, and storage of the policy?
policy administrator
Which of the following is recognition that data used by an organization should only be used for the purposes stated by the information owner at the time it was collected?
privacy
Which subset of civil law regulates the relationships among individuals and among individuals and organizations?
private
Which of the following is NOT a primary function of information security management?
projects
Policy is only enforceable and legally defensible if it uses a process that assures repeatable results and conforms to each of the following EXCEPT __________.
proper conception
The hash values for a wide variety of passwords can be stored in a database known as a(n) __________, which can be indexed and quickly searched using the hash value, allowing the corresponding plaintext password to be determined.
rainbow table
What is the SETA program designed to do?
reduce the occurrence of accidental security breaches
Permission to search for evidentiary material at a specified location and/or to seize items to return to the investigator's lab for examination is known as a(n) _________.
search warrant
This person would be responsible for some aspect of information security and report to the CISO; in smaller organizations, this title may be assigned to the only or senior security administrator.
security manager
The unauthorized duplication, installation, or distribution of copyrighted computer software, which is a violation of intellectual property, is called __________.
software piracy
Which of the following functions needed to implement the information security program evaluates patches used to close software vulnerabilities and acceptance testing of new systems to assure compliance with policy and effectiveness?
systems testing
Human error or failure often can be prevented with training and awareness programs, policy, and __________.
technical controls
When an incident violates civil or criminal law, it is the organization's responsibility to notify the proper authorities; selecting the appropriate law enforcement agency depends on __________.
the type of crime committed
Which of the 12 categories of threats best describes a situation where the adversary removes data from a victim's computer?
theft
Digital forensics can be used for two key purposes: ________ or _________.
to investigate allegations of digital malfeasance; to perform root cause analysis
The final component of the design and implementation of effective policies is __________.
uniform and impartial enforcement
Which of the following is NOT among the three types of InfoSec policies based on NIST's Special Publication 800-14?
user-specific security policies
Which of the following is an advantage of the user support group form of training?
usually conducted in an informal social setting
Which of the following is a key advantage of the bottom-up approach to security implementation?
utilizing the technical expertise of the individual administrators
In which SDLC model does the work product from each phase transition into the next phase to serve as its starting point while allowing movement back to a previous phase should the project require it?
waterfall
Which of the following is NOT an aspect of access regulated by ACLs?
where the system is located
As noted by Kosutic, options for placing the CISO (and his or her security group) in the organization are generally driven by organizational size and include all of the following EXCEPT:
within a division/department with a conflict of interest
