The principle of least privilege/need to know is most likely to be mentioned in:

Personnel Information Security Policy

Access Control Policy

Vendor Management Policy

Business Continuity and Disaster Recovery

This text: "Establish and implement firewall and router configuration standards that include a formal process for approving and testing all network connections and changes to the firewall and router configurations" Is most likely to appear in:

A Policy document

A Procedures document

A Standards document

A Guidelines document

Which of the following is likely to be included in a Procedure related to Personnel Information Security?

An IT employee termination checklist

A rule that employees are to participate in job rotation

A specification of data a given job role is allowed to access

A set of steps to be performed to authorize an individual's access to business data

Which of the following is a well-formulated access control policy metric?

The number of active emergency accounts in excess of approved time limits

A list of users with elevated access rights

The date of the last review of the ACL policy

The number of security employees for whom background checks have not been completed

A document with a heading such as "HOW TO REPORT AN INFORMATION SECURITY INCIDENT" is most likely to be found in

A Standards document

A Guidelines document

A Procedures document

A Policy document

The statement "Workforce members must promptly report potential incidents to the appropriate individual with delegated authority using the contact information referenced in the table below in Section 4." Is most likely to appear in:

A Guidelines document

A Procedures document

A Standards document

A Policy document

The life cycle of an information security policy, as presented in the study materials, includes

Create, update, deploy, compare

Develop, maintain, approve, except

Develop, maintain, approve, accept

Create, update, implement, retire

The statement "To restore IBM Cloud Orchestrator, perform the following steps" Is most likely to appear in

A Policy document

A Guidelines document

A Standards document

A Procedures document

RTO and RPO are most likely to be mentioned in:

Personnel Information Security Policy

Access Control Policy

Acquisition/Development/Maintenance Policy

Security Incident Response Policy

Policies for Business Continuity and Disaster Recovery are most likely to address which of these topics?

Physical and logical access provisioning

Contract management

Segregation of duties

Defined thresholds and triggers for contingencies and escalation

Asset life cycle management

Which of the following statements is true of the named types of compliance document?

Definitions are included in policies but not standards

Procedures are not mandatory

The board of directors should approve procedures and guidelines

Guidelines are not mandatory

Data classification and ownership are most likely to be specified in which of the following policies?

Personnel Information Security

Acquisition/Development/Maintenance

Business Continuity and Disaster Recovery

Asset Management

Incident Response

Which of the following is a well-formulated access control policy metric?

The number of segregation of duties incidents or audit findings

Assessment of policy as compared to similar organizations

A systematic comparison to NIST standards

Specification of a desired level of protection

Which of the following is an example of an RPO?

The system needs to be restored in two working days or less

The recovery plan should be tested annually

The system cannot lose more than 15 minutes of data

The online store should be restored first in the case of a disaster

The statement: "Systems housing or regularly accessing Confidential Information must be in isolated network segments, protected with a physical firewall or equivalent using a 'default deny' rule set." Is most likely to appear in:

A Standards document

A Procedures document

A Policy document

A Guidelines document

Which of the following is an example of an RTO?

The system needs to be restored in two working days or less

The recovery plan should be tested annually

The system cannot loose more than 15 minutes of data

The online store should be restored first in the case of a disaster

The statement "University Information Technologies Services (UITS) is responsible for operating IT facilities that maximize physical security, provide reasoned protections for IT systems from natural disasters, and minimize cyber security risks for [...University] data and systems." Is most likely to appear in:

A Standards document

A Policy document

A Guidelines document

A Procedures document

A policy requiring background checks for IT administrators would be best categorized as a:

A privileged user management control

A change management control

A user provisioning control

A configuration management control

A policy stating that adjustments to server settings are to be properly tested and authorized and then recorded in a database would be best categorized as relating to:

Configuration management and authorization

Privileged user management

Access control and change management

Change management and configuration management

User provisioning and deprovisioning

Directory services mange data primarily to support:

Identity Management Controls

Configuration Management

Change Management

Patch Management

A control which requires users to have a unique password, that is a password they use ONLY for their organizational accounts would be _____A_____ while having the system require a password to be long and include special characters would be _____B______. Which of the following provides correct words for ___A____ and ___B___?

A:Preventive, B:Manual

A:Automatic, B:Manual

A:Manual, B:Preventive

A:Manual, B:Detective

A policy stating that a new user's rights are to be set up by one admin and verified by another are most closely related to:

User provisioning and deprovisioning

Identity Management

Change Management

Configuration Management

A control that automatically generates an email to an administrator when a server configuration setting has changed without proper authorization is:

Party preventive and partly corrective

Corrective and manual

Automatic and detective

Corrective and automatic

Patch management most closely relates to:

Installing (or not installing) updates on existing systems

Automatically validating the settings of key network components

Ensuring that administrative rights are not misused

Changes to the access rights of individual users

A policy stating that user accounts for all systems handling confidential data are to be authorized using the centralized SSO would be most closely associated with:

Configuration Management

User provisioning and deprovisioning

Identity Management

Change Management

A policy stating that default user accounts are to be removed and default passwords are to be changed when new servers are set up would be most closely associated with:

Identity Management

Configuration Management

User provisioning and deprovisioning

Change Management

Taking backups of the firewall rules on a network device is part of:

A preventive automatic control

A corrective, manual control

A corrective preventive control

A detective manual control

A preventive manual control