Question
The principle of least privilege/need to know is most likely to be mentioned in: Personnel Information Security Policy Access Control Policy Vendor Management Policy Business
The principle of least privilege/need to know is most likely to be mentioned in:
Personnel Information Security Policy
Access Control Policy
Vendor Management Policy
Business Continuity and Disaster Recovery
This text: "Establish and implement firewall and router configuration standards that include a formal process for approving and testing all network connections and changes to the firewall and router configurations" Is most likely to appear in:
A Policy document
A Procedures document
A Standards document
A Guidelines document
Which of the following is likely to be included in a Procedure related to Personnel Information Security?
An IT employee termination checklist
A rule that employees are to participate in job rotation
A specification of data a given job role is allowed to access
A set of steps to be performed to authorize an individual's access to business data
Which of the following is a well-formulated access control policy metric?
The number of active emergency accounts in excess of approved time limits
A list of users with elevated access rights
The date of the last review of the ACL policy
The number of security employees for whom background checks have not been completed
A document with a heading such as "HOW TO REPORT AN INFORMATION SECURITY INCIDENT" is most likely to be found in
A Standards document
A Guidelines document
A Procedures document
A Policy document
The statement "Workforce members must promptly report potential incidents to the appropriate individual with delegated authority using the contact information referenced in the table below in Section 4." Is most likely to appear in:
A Guidelines document
A Procedures document
A Standards document
A Policy document
The life cycle of an information security policy, as presented in the study materials, includes
Create, update, deploy, compare
Develop, maintain, approve, except
Develop, maintain, approve, accept
Create, update, implement, retire
The statement "To restore IBM Cloud Orchestrator, perform the following steps" Is most likely to appear in
A Policy document
A Guidelines document
A Standards document
A Procedures document
RTO and RPO are most likely to be mentioned in:
Personnel Information Security Policy
Access Control Policy
Acquisition/Development/Maintenance Policy
Security Incident Response Policy
Policies for Business Continuity and Disaster Recovery are most likely to address which of these topics?
Physical and logical access provisioning
Contract management
Segregation of duties
Defined thresholds and triggers for contingencies and escalation
Asset life cycle management
Which of the following statements is true of the named types of compliance document?
Definitions are included in policies but not standards
Procedures are not mandatory
The board of directors should approve procedures and guidelines
Guidelines are not mandatory
Data classification and ownership are most likely to be specified in which of the following policies?
Personnel Information Security
Acquisition/Development/Maintenance
Business Continuity and Disaster Recovery
Asset Management
Incident Response
Which of the following is a well-formulated access control policy metric?
The number of segregation of duties incidents or audit findings
Assessment of policy as compared to similar organizations
A systematic comparison to NIST standards
Specification of a desired level of protection
Which of the following is an example of an RPO?
The system needs to be restored in two working days or less
The recovery plan should be tested annually
The system cannot lose more than 15 minutes of data
The online store should be restored first in the case of a disaster
The statement: "Systems housing or regularly accessing Confidential Information must be in isolated network segments, protected with a physical firewall or equivalent using a 'default deny' rule set." Is most likely to appear in:
A Standards document
A Procedures document
A Policy document
A Guidelines document
Which of the following is an example of an RTO?
The system needs to be restored in two working days or less
The recovery plan should be tested annually
The system cannot loose more than 15 minutes of data
The online store should be restored first in the case of a disaster
The statement "University Information Technologies Services (UITS) is responsible for operating IT facilities that maximize physical security, provide reasoned protections for IT systems from natural disasters, and minimize cyber security risks for [...University] data and systems." Is most likely to appear in:
A Standards document
A Policy document
A Guidelines document
A Procedures document
A policy requiring background checks for IT administrators would be best categorized as a:
A privileged user management control
A change management control
A user provisioning control
A configuration management control
A policy stating that adjustments to server settings are to be properly tested and authorized and then recorded in a database would be best categorized as relating to:
Configuration management and authorization
Privileged user management
Access control and change management
Change management and configuration management
User provisioning and deprovisioning
Directory services mange data primarily to support:
Identity Management Controls
Configuration Management
Change Management
Patch Management
A control which requires users to have a unique password, that is a password they use ONLY for their organizational accounts would be _____A_____ while having the system require a password to be long and include special characters would be _____B______. Which of the following provides correct words for ___A____ and ___B___?
A:Preventive, B:Manual
A:Automatic, B:Manual
A:Manual, B:Preventive
A:Manual, B:Detective
A policy stating that a new user's rights are to be set up by one admin and verified by another are most closely related to:
User provisioning and deprovisioning
Identity Management
Change Management
Configuration Management
A control that automatically generates an email to an administrator when a server configuration setting has changed without proper authorization is:
Party preventive and partly corrective
Corrective and manual
Automatic and detective
Corrective and automatic
Patch management most closely relates to:
Installing (or not installing) updates on existing systems
Automatically validating the settings of key network components
Ensuring that administrative rights are not misused
Changes to the access rights of individual users
A policy stating that user accounts for all systems handling confidential data are to be authorized using the centralized SSO would be most closely associated with:
Configuration Management
User provisioning and deprovisioning
Identity Management
Change Management
A policy stating that default user accounts are to be removed and default passwords are to be changed when new servers are set up would be most closely associated with:
Identity Management
Configuration Management
User provisioning and deprovisioning
Change Management
Taking backups of the firewall rules on a network device is part of:
A preventive automatic control
A corrective, manual control
A corrective preventive control
A detective manual control
A preventive manual control
Step by Step Solution
There are 3 Steps involved in it
Step: 1
![blur-text-image](https://dsd5zvtm8ll6.cloudfront.net/includes/images/document_product_info/blur-text-image.webp)
Get Instant Access with AI-Powered Solutions
See step-by-step solutions with expert insights and AI powered tools for academic success
Step: 2
![blur-text-image](https://dsd5zvtm8ll6.cloudfront.net/includes/images/document_product_info/blur-subtext-image.webp)
Step: 3
![blur-text-image](https://dsd5zvtm8ll6.cloudfront.net/includes/images/document_product_info/blur-subtext-image.webp)
Ace Your Homework with AI
Get the answers you need in no time with our AI-driven, step-by-step assistance
Get Started