Question 1

________ specify the low-level detailed actions that must be taken by specific employees.

Accepted Answer

A)  Procedures 
B)  Processes 
C)  Both A and B 
D)  Neither A nor B 
A)  Procedures 
B)  Processes 
C)  Both A and B 
D)  Neither A nor B

Question 2

________ are mandatory.

Accepted Answer

A)  Standards 
B)  Guidelines 
C)  Both A and B 
D)  Neither A nor B 
A)  Standards 
B)  Guidelines 
C)  Both A and B 
D)  Neither A nor B

Question 3

The owner can delegate ________ to the trustee.

Accepted Answer

A)  the work of implementation of a resource or control 
B)  accountability for a resource or control 
C)  Both A and B 
D)  Neither A nor B 
A)  the work of implementation of a resource or control 
B)  accountability for a resource or control 
C)  Both A and B 
D)  Neither A nor B

Question 4

Central security consoles ________.

Accepted Answer

A)  are dangerous 
B)  allow policies to be applied consistently 
C)  Both A and B 
D)  Neither A nor B 
A)  are dangerous 
B)  allow policies to be applied consistently 
C)  Both A and B 
D)  Neither A nor B

Question 5

________ are prescriptive statements about what companies should do and are put together by trade associations and government agencies.

Accepted Answer

A)  Best practices 
B)  Recommended practices 
C)  Both A and B 
D)  Neither A nor B 
A)  Best practices 
B)  Recommended practices 
C)  Both A and B 
D)  Neither A nor B

Question 6

Which of the following is a formal process?

Accepted Answer

A)  Annual corporate planning 
B)  Planning and developing individual countermeasures 
C)  Both A and B 
D)  Neither A nor B 
A)  Annual corporate planning 
B)  Planning and developing individual countermeasures 
C)  Both A and B 
D)  Neither A nor B

Question 7

Which CobiT domain has the most control objectives?

Accepted Answer

A)  Planning & Organization 
B)  Acquisition & Implementation 
C)  Delivery & Support 
D)  Monitoring 
A)  Planning & Organization 
B)  Acquisition & Implementation 
C)  Delivery & Support 
D)  Monitoring

Question 8

________ is a single countermeasure composed of multiple interdependent components in series that require all components to succeed if the countermeasure is to succeed.

Accepted Answer

A)  Defense in depth 
B)  Weakest link 
C)  Both A and B 
D)  Neither A nor B 
A)  Defense in depth 
B)  Weakest link 
C)  Both A and B 
D)  Neither A nor B

Question 9

According to the author, information assurance is a good name for IT security.

Accepted Answer

A) True 
 B)False

Question 10

________ is the plan-based creation and operation of countermeasures.

Accepted Answer

A)  Planning 
B)  Protection 
C)  Response 
D)  All of the above 
A)  Planning 
B)  Protection 
C)  Response 
D)  All of the above

Question 11

Electronic employee monitoring is rare.

Accepted Answer

A) True 
 B)False

Question 12

A company should consider list of possible remediation plans as an investment portfolio.

Accepted Answer

A) True 
 B)False

Question 13

A ________ occur(s) when a single security element failure defeats the overall security of a system.

Accepted Answer

A)  spot failure 
B)  weakest link failure 
C)  defense in depth departure 
D)  critical failure 
A)  spot failure 
B)  weakest link failure 
C)  defense in depth departure 
D)  critical failure

Question 14

Which companies do PCI-DSS affect?

Accepted Answer

A)  E-commerce firms 
B)  Medical firms 
C)  Government organizations 
D)  Companies that accept credit card payments 
A)  E-commerce firms 
B)  Medical firms 
C)  Government organizations 
D)  Companies that accept credit card payments

Question 15

A governance framework specifies how to do ________.

Accepted Answer

A)  planning 
B)  implementation 
C)  oversight 
D)  All of the above. 
A)  planning 
B)  implementation 
C)  oversight 
D)  All of the above.

Question 16

Mandatory vacations should be enforced ________.

Accepted Answer

A)  to improve employee diligence to threats 
B)  to reduce the possibility of collusion between employees 
C)  to be in compliance with state and federal law 
D)  for ethical purposes 
A)  to improve employee diligence to threats 
B)  to reduce the possibility of collusion between employees 
C)  to be in compliance with state and federal law 
D)  for ethical purposes

Question 17

In COSO, a company's overall control culture is called its ________.

Accepted Answer

A)  control culture 
B)  tone at the top 
C)  control environment 
D)  security culture 
A)  control culture 
B)  tone at the top 
C)  control environment 
D)  security culture

Question 18

When companies studied where they stored private information, they found that much of this information was stored inside spreadsheets and word processing documents.

Accepted Answer

A) True 
 B)False

Question 19

________ entails investigating the IT security of external companies and the implications of close IT partnerships before implementing interconnectivity.

Accepted Answer

A)  Auditing 
B)  Due diligence 
C)  Peer-to-peer security 
D)  Vulnerability testing 
A)  Auditing 
B)  Due diligence 
C)  Peer-to-peer security 
D)  Vulnerability testing

Question 20

The goal of IT security is risk elimination.

Accepted Answer

A) True 
 B)False

________ specify the low-level detailed actions that must be taken by specific employees.

________ are mandatory.

The owner can delegate ________ to the trustee.

Central security consoles ________.

________ are prescriptive statements about what companies should do and are put together by trade associations and government agencies.

Which of the following is a formal process?

Which CobiT domain has the most control objectives?

________ is a single countermeasure composed of multiple interdependent components in series that require all components to succeed if the countermeasure is to succeed.

According to the author, information assurance is a good name for IT security.

________ is the plan-based creation and operation of countermeasures.

Electronic employee monitoring is rare.

A company should consider list of possible remediation plans as an investment portfolio.

A ________ occur(s) when a single security element failure defeats the overall security of a system.

Which companies do PCI-DSS affect?

A governance framework specifies how to do ________.

Mandatory vacations should be enforced ________.

In COSO, a company's overall control culture is called its ________.

When companies studied where they stored private information, they found that much of this information was stored inside spreadsheets and word processing documents.

________ entails investigating the IT security of external companies and the implications of close IT partnerships before implementing interconnectivity.

The goal of IT security is risk elimination.

The Threat Environment

Cryptography

Secure Networks

Access Control

Firewalls

Host Hardening

Application Security

Data Protection

Incident and Disaster Response

Module A: Networking Concepts

Filters

Exam 2: Planning and Policy

________ specify the low-level detailed actions that must be taken by specific employees.

________ are mandatory.

The owner can delegate ________ to the trustee.

Central security consoles ________.

________ are prescriptive statements about what companies should do and are put together by trade associations and government agencies.

Which of the following is a formal process?

Which CobiT domain has the most control objectives?

________ is a single countermeasure composed of multiple interdependent components in series that require all components to succeed if the countermeasure is to succeed.

According to the author, information assurance is a good name for IT security.

________ is the plan-based creation and operation of countermeasures.

Electronic employee monitoring is rare.

A company should consider list of possible remediation plans as an investment portfolio.

A ________ occur(s) when a single security element failure defeats the overall security of a system.

Which companies do PCI-DSS affect?

A governance framework specifies how to do ________.

Mandatory vacations should be enforced ________.

In COSO, a company's overall control culture is called its ________.

When companies studied where they stored private information, they found that much of this information was stored inside spreadsheets and word processing documents.

________ entails investigating the IT security of external companies and the implications of close IT partnerships before implementing interconnectivity.

The goal of IT security is risk elimination.

The Threat Environment

Cryptography

Secure Networks

Access Control

Firewalls

Host Hardening

Application Security

Data Protection

Incident and Disaster Response

Module A: Networking Concepts

Filters