Revision Questions

1. The effectiveness of SoD is best ensured by which of the following?
   1. Implementing strong password rules
   2. Making available a security awareness poster on the intranet
   3. Frequent information security training
   4. Reviewing access privileges when an operator's role changes
2. What is the prime responsibility of an information security manager?
   1. To manage the risk to information assets
   2. To implement the security configuration for IT assets
   3. To conduct disaster recovery testing
   4. To close identified vulnerabilities
3. To determine the extent of sound processes, the maturity model is used. Another approach is to use which of the following?
   1. The Monte Carlo method
   2. Process performance and capabilities
   3. Vulnerability assessments
   4. Risk analysis
4. Information system access should be primarily authorized by which of the following?
   1. The information owner
   2. The system auditor
   3. The CISO
   4. The system administrator
5. The information security manager observes that the incident log is stored on a production database server. Which of the following is a major concern?
   1. The unavailability of log details if the server crashes
   2. The unauthorized modification of logs by the database administrator
   3. Log capturing makes the transaction process slow
   4. Critical information may not be captured in the log files
6. Appointing a CISO indicates which of the following?
   1. The organization wants to enhance the role of senior management
   2. The organization is committed to its responsibility for information security
   3. The board of directors wants to pass on their accountability
   4. The organization wants to improve its technology architecture
7. The main objective of integrating security-related roles and responsibilities is which of the following?
   1. To address the security gaps that exist between assurance functions
   2. To address the unavailability of manpower
   3. To address the gap in business continuity and disaster recovery
   4. To address the complications in system development processes
8. Which of the following is the best compensating control when the same employee is responsible for updating servers, maintaining the access control, and reviewing the logs?
   1. To verify that only approved changes are made
   2. To conduct penetration tests
   3. To conduct risk assessments
   4. Reviews of log files conducted by the manager
9. What is the responsibility of the information owner when complying with the information classification scheme?
   1. To implement security measures to protect their data
   2. To determine the level of classification for their data
   3. To arrange backups of their data
   4. To delegate the processes of information classification to the system administrator
10. The effectiveness of the organization's security measures is the final responsibility of which of the following?
    1. The security administrator
    2. The CISO
    3. Senior management
    4. The information security auditor
11. What is the best way to ensure that responsibilities are carried out?
    1. Signed non-disclosure agreements
    2. Heavy penalties for non-compliance
    3. Assigned accountability
    4. Documented policies
12. Who is responsible for complying with the organization's security policies and standards?
    1. The CISO
    2. Senior management
    3. The compliance officer
    4. All organizational units
13. Continuous improvement of the risk management process is most likely ensured by which of the following?
    1. The regular review of implemented security controls
    2. Implementing an information classification policy
    3. The adoption of a maturity model
    4. Regular audits of risk management processes
14. Information security is the responsibility of which of the following?
    1. All personnel
    2. IT personnel
    3. Security personnel
    4. Operational personnel
15. Who should security policies be finally approved by?
    1. Operation managers
    2. The CISO
    3. Senior management
    4. The chief technical officer (CTO)
16. Confidentiality of information can be best ensured by which of the following?
    1. Implementing an information classification policy
    2. Implementing SoD
    3. Implementing the principle of least privilege
    4. Implementing information security audits
17. As an information security manager, how do you characterize a decentralized information security process?
    1. Consistency in information security processes
    2. Better compliance with policy
    3. Better alignment with decentralized unit requirements
    4. Optimum utilization of information security resources