$1.$ a$)$ A threat is an object, person, or other entity that represents a constant danger to an asset. By providing suitable examples, explain in terms of the attack, exploits and vulnerability that make a person become a threat.

$(6$ Marks$)$

b$)$ From your answer in question $1($a$),$ suggest any TWO $(2)$ precaution approaches that can be applied to avoid those threats.

$(4$ Marks$)$

$[$Total: $10$ Marks$]$

$2.$ a$)$ Before implementing organizational planning, the organizational leaders are encouraged to start by creating a vision statement, a mission statement, and a value statement. How do these statements support the planning process? Justify your answer with TWO $(2)$ concrete reasons.

$(2$ Marks$)$

b$)$ The end user is one of the members in the security development team. Describe TWO $(2)$ possible ways in which the end user can support the security development process even though he or she has no security background.

$(2$ Marks$)3.$ Access control is one of the security approaches that enables an organization to restrict access of its group of users to information or tangible assets.

a$)$ Explain any TWO $(2)$ the importance of access control implementation in an organization.

$(6$ Marks$)$

b$)$ Describe THREE $(3)$ principles required to apply access control.

$(9$ Marks$)$

c$)$ By considering the Uniec Campus System, why are different groups of users such as students and lecturers are assigned different access rights to the same information such as coursework?

$(2$ Marks$)$

d$)$ In your opinion, which critical characteristics of information should an organization consider the most when classifying the data? Justify your answer.

$(3$ Marks$)$

e$)$ What type of security policy best suits on assigning different level of authority to users? Justify your answer.

$(3$ Marks$)$