Question 1 5 pts (TCO 6) An employee who fails to report a suspected security weakness is doing his or her job. will not be punished. will be treated the same as if he or she had initiated a malicious act against the company. O is making sure not to aggravate the situation by making a mistake. Question 2 5 pts (TCO 7) Which domain of the ISO 17799:2000 is dedicated to access control? 8 O. O 10 O O 11 Question 3 5 pts (TCO 8) Retroactively injecting security into existing code at the end of a development project usually results in which of the following? O A perfectly secure application Creating new vulnerabilities A complete and secure review of the code O None of the above Question 4 5 pts (TCO 9) As it pertains to GLBA, what does NPI stand for? Nonpublic information Nonpublic personal information Nonprivate information Nonprivate personal information Question 5 5 pts (TCO 6) The primary antimalware control is O an updated antivirus solution. a firewall a router an acceptable use policy. Question 6 5 pts (TCO 7) The creation of accounts with special privileges should be handled the senior person in the IT department. O anybody in the IT department. the ISO. the CEO. Question 7 5 pts (TCO 8) Having a third-party consultant review internally developed code is an example of what not to do. the need-to-know principle. the separation of duties principle. mandatory access control. Question 8 5 pts (TCO 9) Who enforces the GLBA? Eight different federal agencies and states The FDIC The FFIEC The Secretary of the Treasury