Hello World 1 Questions

0.0 (0)

N. S.

Set of flashcards Details

Summary	Diese Lernkarten decken grundlegende Konzepte der Informationssicherheit und Risikomanagement ab. Sie behandeln Themen wie Risikoanalyse, Sicherheitskontrollen, Sicherheitsmanagement und die Rolle von Sicherheitsmanagern in Organisationen. Die Karteikarten sind besonders nützlich für Sicherheitsverantwortliche und IT-Manager, die ihre Fähigkeiten im Umgang mit Sicherheitsrisiken und -strategien verbessern möchten.
Flashcards	99
Students	3
Language	Deutsch
Category	Religion/Ethics
Level	Primary School
Created / Updated	18.11.2013 / 09.06.2024
Weblink	https://card2brain.ch/box/hello_world_1_questions
Embed	<iframe src="https://card2brain.ch/box/hello_world_1_questions/embed" width="780" height="150" scrolling="no" frameborder="0"></iframe>

Card list

A new regulation for safeguarding information processed by a specify type of transaction has come to the attention of an information security officer. The officer should first: A) meet with stakeholders to decide how to comply B) analyze key risks in the compliance process C) assess whether existing controls meet the regulation D) update the existing security/privacy policy

An organization plans to contract with an outside service provider to host its corporate web site. The most important concern for the information security manager is to ensure that: A) an audit of the service provider uncovers no significant weakness B) the contract includes a nondisclosure agreement C) the contract should mandate that the service provider will comply with security policies D) the third-party service provider conducts regular penetration testing

An organization has consolidated global operations. The CIO has asked the chief information security officer to develop a new organization information security strategy. Which of the following actions should be taken first? A) identify the assets B) conduct a risk assessment C) define the scope D) result in major problems with billing systems and transaction processing agreements

A computer programmer altered the program for checking accounts so that his account would be bypassed when a listing of accounts with overdrafts was prepared. Which of the following controls would be least effective in preventing or detecting this abuse? A) user sign-off for all program changes B) internal auditor review of all employee accounts C) independent code review following any change D) independent listing of overdrafts and follow-up by internal auditors

The responsibility of assuring that the systems development lifecycle design adheres to corporate security policies and test system security prior to implementations that of the: A) security officer B) project manager C) quality manager D) project steering committee

Security risk assessments are most cost-effective to a software development organization when they are performed: A) before system development begins B) at system deployment C) before developing a business case D) at each stage of the SDLC

An organization has recently installed a security patch, which crashed the production server. To minimize the probability of this occurring again, the information security professional should: A) apply the patch according to the patch's release notes B) ensure that a good change management process is in place C) thoroughly test the patch before sending it to production D) approve the patch after doing a risk assessment

The scope of logical access controls review would include the valuation of: A) effectiveness and efficiency of IT security and related controls B) confidentiality, integrity and availability of information to authorized users C) access to systems software and application software to ensure compliance with the access policy D) access to user authorization levels, parameters and operational function through application software

Management feels that its daily review of log files provides a compensating control for a weakness in access controls to program and data files. Which of the following would be least important in evaluating the adequacy of this control? A) the type of information written to the log file B) how well the log file is protected C) the identity of the person responsible for the software that generates the log D) the retention period of the log data file

Which of the following is the most important factor on which to rely on successfully assign cross-organizational responsibility to integrate on information security program: A) the ease of information security technologies B) open channels of communication C) the roles of different job functions D) qualities information security professionals in each department

To improve the security of an organization's human resources system, an information security manager was presented with a choice to either implement an additional packet filtering firewall or a heuristic-based intrusion detection system. How should the security manager with a limited budget choose between the two technologies? A) risk analysis B) BIA C) ROI analysis D) cost-benefit analysis

Which of the following is not a necessary benefit of consulting with current customers of the proposed software package during the software evaluation process? A) learning what other customers paid for the software B) obtaining assurance concerning the vendor's ability to fulfill commitments C) learning whether the vendor keeps the software current by providing enhancements of software D) determining if other customers are suing the software in a similar situation to yours

Which of the following techniques most clearly indicates whether specific risk-reduction controls should be implemented? A) cost-benefit analysis B) penetration testing C) frequent risk assessment programs D) annual loss expectancy calculation

An account with full administrative privileges over a production file is found to be accessible by a member of the software development team. This account was set up to allow the developer to download non sensitive production data for software testing purposes. Assuming all options are possible, which of the following should the information security manager recommend? A) restrict account access to read only B) log all usage of this account C) suspend the account and activate only when needed D) require that a change requests be submitted for each download

In a PKI, a registration authority: A) verifies information supplied by the subject requesting a certificate B) issues the certificate after the required attributes are verified and the keys are generated C) digitally sign a message to achieve no repudiation of the signed message D) registers signed messages to protect them from future repudiation

The most effective approach to ensure the continued effectiveness of information security controls is by: A) ensuring inherent control strength B) ensuring strategic alignment C) utilizing effective life cycle management D) utilizing effective change management

What would be the purpose of an enterprise's board setting direction for information security, driving policy and information security strategy? A) developing a mission statement B) defining an enterprise risk profile C) allocating accountability D) selecting specific security solutions

Which of the following is a useful service for security managers to ensure that the security program is constantly being adjusted? A) external auditor reports B) external vulnerability reports C) external peer reviews D) external baseline benchmarking

Value at risk can be used: A) as a qualitative approach to evaluating risk B) to determine maximum probable loss over a period of time C) for risk analysis applicable only to financial organizations D) as a useful tool to expedite the assessment process

What is the main risk when there is no user management representation on the information security steering committee? A) functional requirements are not adequately considered B) user training program may be inadequate C) budgets allocate to business units are not appropriate D) information security plans are not aligned with business requirements

Tightly integrated IT systems are most likely to be affected by: A) aggregated risk B) systemic risk C) operational risk D) cascading risk

Keyboard commands:

= turn,

= for-/backward,

= scroll

An information security strategy containing specific links to an organization's business activities is primarily an indicator of: A) performance measurement B) integration C) alignment D) value delivery

Keyboard commands:

= turn,

= for-/backward,

= scroll

The most effective method to conduct a risk assessment on an internal system in an organization is to start by understanding the: A) performance metrics and indicators B) policies and standards C) recent audit findings and recommendations D) systems and its subsystems

Keyboard commands:

= turn,

= for-/backward,

= scroll

The acceptability of a partial system recovery after a security incident is most likely to be based on the: A) ability to resume normal operations B) maximum tolerable outage C) service delivery objective D) acceptable interruption window

Keyboard commands:

= turn,

= for-/backward,

= scroll

Which of the following is the most effective method to ensure that a business continuity plan meets on organization's needs? A) require quarterly updating of the BCP B) automate the survey of plan owners to obtain input to the plan C) Periodically test the cross-departmental plan with varied scenarios D) conduct face-to-face meetings with management for discussion and analysis

Keyboard commands:

= turn,

= for-/backward,

= scroll

The most complete business case for security solutions is one that: A) includes appropriate justification B) explains the current risk profile C) details regulatory requirements D) identifies incidents and losses

Keyboard commands:

= turn,

= for-/backward,

= scroll

The primary reason for senior management review of information security incidents is to: A) ensure adequate corrective actions were implemented B) demonstrate management commitment C) evaluate the incident response process for deficiencies D) evaluate the ability of the security team

Keyboard commands:

= turn,

= for-/backward,

= scroll

Which of the following is the greatest benefit of a risk aware culture: A) issues are escalated when suspicious activity is noticed B) controls are double checked to anticipate any issues C) individuals communicate with peers for knowledge sharing D) Employees are self-motivated to learn about costs and benefits

Keyboard commands:

= turn,

= for-/backward,

= scroll

A primary characteristic of a well-established information security culture is an alignment of: A) information security and business objectives B) security controls within information technology C) concurrent security strategies D) values to protect corporate assets

Keyboard commands:

= turn,

= for-/backward,

= scroll

Which of the following is the primary prerequisite to implementing data classification within an organization? A) defining job roles B) perform risk assessments C) identifying data owners D) establish data retention policies

Keyboard commands:

= turn,

= for-/backward,

= scroll

Which of the following risk assessment outputs is most suitable to help justifying an organizational information security program? A) an inventory of risk that may impact the enterprise B) documented threats to the enterprise C) evaluation of consequences D) a list of appropriate controls for reducing or eliminating risk

Which of the following tests gives the most assurance that a business continuity plan works without potentially impacting business operations: A) checklist test B) simulation test C) walk-through test D) full operational test

The primary objective for information security program development should be: A) conduct a risk assessment B) establish incident response program C) identifying and implementing the best security solution D) reducing the impact of risk in the business

Which of the following is the most important consideration when developing an information security strategy? A) resources available to implement the program B) Compliance with legal and regulatory constraints C) Effectiveness of risk management D) resources required to implement the strategy

Which of the following is the most important objective of data protection? A) identifying people who need access to information B) ensuring the integrity of information C) denying or authorizing access to the IS system D) monitoring logical access

Which of the following should be included in an annual information security budget that is submitted for management approval: A) a cost-benefit analysis of budgeted resources B) all of the resources that are recommended by the business C) total cost of ownership D) baseline comparisons

Which of the following is a benefit of information security governance: A) reduction of potential for civil or legal liability B) questioning trust in the vendor relationships C) increasing risk of decisions based on incomplete management information D) direct involvement of senior management in developing control processes

In the risk management process, a cost-benefit analysis is mainly performed: A) as part of an initial risk B) as part of risk response planning C) during an information asset valuation D) when insurance is calculated for risk

Which of the following is the best reason to perform a business impact analysis? A) the help determine the current state of risk B) to budget appropriately for needed controls C) to satisfy regulatory requirements D) to analyze the effect on the business

Which of the following statements concerning the risk is true? A) responsibility can not be transferred B) transferring risk is a form of mitigation C) transferring risk eliminates the risk D) risk cannot be transferred

1 / 99

Card list

Study

Hello World 1 Questions

Create or copy sets of flashcards

Create or copy sets of flashcards

Log in to see all the cards.

SWITCHaai

Office 365

Edulog

Apple ID

Google