Question 1

________ are payments made by a supplier to a corporate buyer when a purchase is made.

Accepted Answer

A)  Bribes 
B)  Kickbacks 
C)  Both A and B 
D)  Neither A nor B 
A)  Bribes 
B)  Kickbacks 
C)  Both A and B 
D)  Neither A nor B

Question 2

The worst problem with classic risk analysis is that ________.

Accepted Answer

A)  protections often protect multiple resources 
B)  resources often are protected by multiple resources 
C)  we cannot estimate the annualized rate of occurrence 
D)  costs and benefits are not the same each year 
A)  protections often protect multiple resources 
B)  resources often are protected by multiple resources 
C)  we cannot estimate the annualized rate of occurrence 
D)  costs and benefits are not the same each year

Question 3

Companies should replace their legacy security technologies immediately.

Accepted Answer

A) True 
 B)False

Question 4

Informing employees that monitoring will be done is a bad idea.

Accepted Answer

A) True 
 B)False

Question 5

Internal corporate attackers often have a history of overt unacceptable behavior.

Accepted Answer

A) True 
 B)False

Question 6

Placing security within IT ________.

Accepted Answer

A)  creates independence 
B)  is likely to give security stronger backing from the IT department 
C)  Both A and B 
D)  Neither A nor B 
A)  creates independence 
B)  is likely to give security stronger backing from the IT department 
C)  Both A and B 
D)  Neither A nor B

Question 7

________ are check lists of what should be done in a specific procedure.

Accepted Answer

A)  Baselines 
B)  Guidelines 
C)  Standards 
D)  Procedures 
A)  Baselines 
B)  Guidelines 
C)  Standards 
D)  Procedures

Question 8

Planning, protection, and response follow a fairly strict sequence from one stage to another.

Accepted Answer

A) True 
 B)False

Question 9

Policies should specify the details of how protections are to be applied.

Accepted Answer

A) True 
 B)False

Question 10

The manager of the security department often is called ________.

Accepted Answer

A)  the chief security officer (CSO) 
B)  the chief information security officer (CISO) 
C)  Either A and B 
D)  Neither A nor B 
A)  the chief security officer (CSO) 
B)  the chief information security officer (CISO) 
C)  Either A and B 
D)  Neither A nor B

Question 11

The stage of the plan-protect response cycle that consumes the most time is ________.

Accepted Answer

A)  planning 
B)  protection 
C)  response 
D)  each of the above consumes about the same amount of time 
A)  planning 
B)  protection 
C)  response 
D)  each of the above consumes about the same amount of time

Question 12

It is mandatory for decision makers to consider guidelines.

Accepted Answer

A) True 
 B)False

Question 13

Hotlines for reporting improper behavior are required by law to be non-anonymous.

Accepted Answer

A) True 
 B)False

Question 14

In manual procedures, the segregation of duties ________.

Accepted Answer

A)  reduces risk 
B)  increases risk by creating blind spots 
C)  increases risk by reducing accountability 
D)  can only be done safely through information technology 
A)  reduces risk 
B)  increases risk by creating blind spots 
C)  increases risk by reducing accountability 
D)  can only be done safely through information technology

Question 15

Senior officers often have an additional code of ethics.

Accepted Answer

A) True 
 B)False

Question 16

SLE times APO gives the ________.

Accepted Answer

A)  expected per-event loss 
B)  expected annual loss 
C)  expected life cycle loss 
D)  expected per-event benefit 
A)  expected per-event loss 
B)  expected annual loss 
C)  expected life cycle loss 
D)  expected per-event benefit

Question 17

A ________ is a material deficiency, or combination of significant deficiencies, that results in more than a remote likelihood that a material misstatement in the annual or interim financial statements will not be prevented or detected.

Accepted Answer

A)  material control failure 
B)  material control deficiency 
C)  critical control deficiency 
D)  critical control failure 
A)  material control failure 
B)  material control deficiency 
C)  critical control deficiency 
D)  critical control failure

Question 18

In benefits, costs and benefits are expressed on a per-year basis.

Accepted Answer

A) True 
 B)False

Question 19

________ are discretionary.

Accepted Answer

A)  Standards 
B)  Guidelines 
C)  Both A and B 
D)  Neither A nor B 
A)  Standards 
B)  Guidelines 
C)  Both A and B 
D)  Neither A nor B

Question 20

What is missing from the definition of response as "recovery?"

Accepted Answer

A)  The phrase "according to plan" must be added to "recovery." 
B)  The definition must refer to specific resources. 
C)  The phrase "Reasonable degree of" must begin the definition. 
D)  The phrase "and prosecution" must be added after "recovery." 
A)  The phrase "according to plan" must be added to "recovery." 
B)  The definition must refer to specific resources. 
C)  The phrase "Reasonable degree of" must begin the definition. 
D)  The phrase "and prosecution" must be added after "recovery."

________ are payments made by a supplier to a corporate buyer when a purchase is made.

The worst problem with classic risk analysis is that ________.

Companies should replace their legacy security technologies immediately.

Informing employees that monitoring will be done is a bad idea.

Internal corporate attackers often have a history of overt unacceptable behavior.

Placing security within IT ________.

________ are check lists of what should be done in a specific procedure.

Planning, protection, and response follow a fairly strict sequence from one stage to another.

Policies should specify the details of how protections are to be applied.

The manager of the security department often is called ________.

The stage of the plan-protect response cycle that consumes the most time is ________.

It is mandatory for decision makers to consider guidelines.

Hotlines for reporting improper behavior are required by law to be non-anonymous.

In manual procedures, the segregation of duties ________.

Senior officers often have an additional code of ethics.

SLE times APO gives the ________.

A ________ is a material deficiency, or combination of significant deficiencies, that results in more than a remote likelihood that a material misstatement in the annual or interim financial statements will not be prevented or detected.

In benefits, costs and benefits are expressed on a per-year basis.

________ are discretionary.

What is missing from the definition of response as "recovery?"

The Threat Environment

Cryptography

Secure Networks

Access Control

Firewalls

Host Hardening

Application Security

Data Protection

Incident and Disaster Response

Module A: Networking Concepts

Filters

Exam 2: Planning and Policy

________ are payments made by a supplier to a corporate buyer when a purchase is made.

The worst problem with classic risk analysis is that ________.

Companies should replace their legacy security technologies immediately.

Informing employees that monitoring will be done is a bad idea.

Internal corporate attackers often have a history of overt unacceptable behavior.

Placing security within IT ________.

________ are check lists of what should be done in a specific procedure.

Planning, protection, and response follow a fairly strict sequence from one stage to another.

Policies should specify the details of how protections are to be applied.

The manager of the security department often is called ________.

The stage of the plan-protect response cycle that consumes the most time is ________.

It is mandatory for decision makers to consider guidelines.

Hotlines for reporting improper behavior are required by law to be non-anonymous.

In manual procedures, the segregation of duties ________.

Senior officers often have an additional code of ethics.

SLE times APO gives the ________.

A ________ is a material deficiency, or combination of significant deficiencies, that results in more than a remote likelihood that a material misstatement in the annual or interim financial statements will not be prevented or detected.

In benefits, costs and benefits are expressed on a per-year basis.

________ are discretionary.

What is missing from the definition of response as "recovery?"

The Threat Environment

Cryptography

Secure Networks

Access Control

Firewalls

Host Hardening

Application Security

Data Protection

Incident and Disaster Response

Module A: Networking Concepts

Filters