Question 1

Different honest people can make different ethical decisions in a given situation.

Accepted Answer

A) True 
 B)False

Question 2

After performing a preliminary security assessment, a company should develop a remediation plan for EVERY security gap identified.

Accepted Answer

A) True 
 B)False

Question 3

Responding to risk through risk avoidance is likely to be acceptable to other units of the firm.

Accepted Answer

A) True 
 B)False

Question 4

The first step in developing an IT security plan is to ________.

Accepted Answer

A)  determine needs 
B)  assess the current state of the company's security 
C)  create comprehensive security 
D)  prioritize security projects 
A)  determine needs 
B)  assess the current state of the company's security 
C)  create comprehensive security 
D)  prioritize security projects

Question 5

COSO focuses on ________.

Accepted Answer

A)  corporate internal and financial controls 
B)  IT governance 
C)  IT security governance 
D)  All of the above 
A)  corporate internal and financial controls 
B)  IT governance 
C)  IT security governance 
D)  All of the above

Question 6

________ examines IT processes for efficiency, effectiveness, and adequate controls.

Accepted Answer

A)  Internal auditing 
B)  Financial auditing 
C)  IT auditing 
D)  None of the above 
A)  Internal auditing 
B)  Financial auditing 
C)  IT auditing 
D)  None of the above

Question 7

The steps required to issue a new employee a password should be specified in a ________.

Accepted Answer

A)  procedure 
B)  process 
C)  Both A and B 
D)  Neither A nor B 
A)  procedure 
B)  process 
C)  Both A and B 
D)  Neither A nor B

Question 8

Most IT security analysts recommend placing IT security functions within the IT department.

Accepted Answer

A) True 
 B)False

Question 9

Which of the following is an example of a conflict of interest?

Accepted Answer

A)  Preferential dealings with relatives 
B)  Investing in competitors 
C)  Competing with the company while still employed by the company 
D)  All of the above 
A)  Preferential dealings with relatives 
B)  Investing in competitors 
C)  Competing with the company while still employed by the company 
D)  All of the above

Question 10

The party that is ultimately held accountable for a resource or control is ________.

Accepted Answer

A)  the owner 
B)  the trustee 
C)  the accredited security officer 
D)  the certified security officer 
A)  the owner 
B)  the trustee 
C)  the accredited security officer 
D)  the certified security officer

Question 11

In order to demonstrate support for security, top management must ________.

Accepted Answer

A)  ensure that security has an adequate budget 
B)  support security when there are conflicts between the needs of security and the needs of other business functions 
C)  follow security procedures themselves 
D)  All of the above 
A)  ensure that security has an adequate budget 
B)  support security when there are conflicts between the needs of security and the needs of other business functions 
C)  follow security procedures themselves 
D)  All of the above

Question 12

Using both a firewall and host hardening to protect a host is ________.

Accepted Answer

A)  defense in depth 
B)  risk acceptance 
C)  an anti-weakest link strategy 
D)  adding berms 
A)  defense in depth 
B)  risk acceptance 
C)  an anti-weakest link strategy 
D)  adding berms

Question 13

The growing number of compliance laws and regulations is driving firms to use formal governance frameworks to guide their security processes.

Accepted Answer

A) True 
 B)False

Question 14

________ is preferred by U.S. auditors.

Accepted Answer

A)  ISO/IEC 27000 family 
B)  COSO 
C)  CobiT 
D)  PCI-DSS 
A)  ISO/IEC 27000 family 
B)  COSO 
C)  CobiT 
D)  PCI-DSS

Question 15

Security metrics allow a company to know if it is improving in its implementation of policies.

Accepted Answer

A) True 
 B)False

Question 16

The ISO/IEC 2700 family focuses on ________.

Accepted Answer

A)  corporate governance 
B)  IT governance 
C)  IT security governance 
D)  All of the above about equally 
A)  corporate governance 
B)  IT governance 
C)  IT security governance 
D)  All of the above about equally

Question 17

Employees usually must rationalize bad behavior.

Accepted Answer

A) True 
 B)False

Question 18

Which of the following specifies how to do certification by external parties?

Accepted Answer

A)  COSO 
B)  CobiT 
C)  ISO/IEC 27000 
D)  All of the above have certification by external parties. 
A)  COSO 
B)  CobiT 
C)  ISO/IEC 27000 
D)  All of the above have certification by external parties.

Question 19

Many compliance regimes require firms to adopt specific formal governance framework to drive security planning and operational management.

Accepted Answer

A) True 
 B)False

Question 20

The goal of IT security is reasonable risk reduction.

Accepted Answer

A) True 
 B)False

Different honest people can make different ethical decisions in a given situation.

After performing a preliminary security assessment, a company should develop a remediation plan for EVERY security gap identified.

Responding to risk through risk avoidance is likely to be acceptable to other units of the firm.

The first step in developing an IT security plan is to ________.

COSO focuses on ________.

________ examines IT processes for efficiency, effectiveness, and adequate controls.

The steps required to issue a new employee a password should be specified in a ________.

Most IT security analysts recommend placing IT security functions within the IT department.

Which of the following is an example of a conflict of interest?

The party that is ultimately held accountable for a resource or control is ________.

In order to demonstrate support for security, top management must ________.

Using both a firewall and host hardening to protect a host is ________.

The growing number of compliance laws and regulations is driving firms to use formal governance frameworks to guide their security processes.

________ is preferred by U.S. auditors.

Security metrics allow a company to know if it is improving in its implementation of policies.

The ISO/IEC 2700 family focuses on ________.

Employees usually must rationalize bad behavior.

Which of the following specifies how to do certification by external parties?

Many compliance regimes require firms to adopt specific formal governance framework to drive security planning and operational management.

The goal of IT security is reasonable risk reduction.

The Threat Environment

Cryptography

Secure Networks

Access Control

Firewalls

Host Hardening

Application Security

Data Protection

Incident and Disaster Response

Module A: Networking Concepts

Filters

Exam 2: Planning and Policy

Different honest people can make different ethical decisions in a given situation.

After performing a preliminary security assessment, a company should develop a remediation plan for EVERY security gap identified.

Responding to risk through risk avoidance is likely to be acceptable to other units of the firm.

The first step in developing an IT security plan is to ________.

COSO focuses on ________.

________ examines IT processes for efficiency, effectiveness, and adequate controls.

The steps required to issue a new employee a password should be specified in a ________.

Most IT security analysts recommend placing IT security functions within the IT department.

Which of the following is an example of a conflict of interest?

The party that is ultimately held accountable for a resource or control is ________.

In order to demonstrate support for security, top management must ________.

Using both a firewall and host hardening to protect a host is ________.

The growing number of compliance laws and regulations is driving firms to use formal governance frameworks to guide their security processes.

________ is preferred by U.S. auditors.

Security metrics allow a company to know if it is improving in its implementation of policies.

The ISO/IEC 2700 family focuses on ________.

Employees usually must rationalize bad behavior.

Which of the following specifies how to do certification by external parties?

Many compliance regimes require firms to adopt specific formal governance framework to drive security planning and operational management.

The goal of IT security is reasonable risk reduction.

The Threat Environment

Cryptography

Secure Networks

Access Control

Firewalls

Host Hardening

Application Security

Data Protection

Incident and Disaster Response

Module A: Networking Concepts

Filters