Module 11 - 13: Data, Risk, Governance

Multiple Choice

Not designed for any specific entity, the act mandates the implementation of risk assessments, internal controls and audit procedures.

• Gramm-Leach-Bliley Act (GLBA)

• Sarbanes-Oxley Act (SOX)

• Computer Security Act

• Federal information Security Management Act (FISMA)

Multiple Choice

One of the earliest requires federal agencies to develop security policies for computer systems that process confidential information.

• Computer Security Act

• Gramm-Leach-Bliley Act (GLBA)

• Sarbanes-Oxley Act (SOX)

• Federal information Security Management Act (FISMA)

Multiple Choice

Provide best practices of an overall Information Security Management System (ISMS)

• ISO 27000

• ISO 31000

• ISO 10000

• GPR 27000

Multiple Choice

What element of your risk mitigation strategy helps keep future additions to your network from introducing new security vulnerabilities?

• Change management
• Incident management
• Security audits
• Technical controls

Multiple Choice

The process of eliminating a risk by choosing not to participate in an action or activity describes which of the following?

• Risk avoidance

• Risk mitigate

• Residual risk

• Risk acceptance

Multiple Select

A security breach can have a negative long-term impact on an organization’s _______ that has taken years to build.

• Reputation

• Revenue

• Competitiveness

• Incompetence

Multiple Choice

A company recently set up an e-commerce portal to sell its product online. The company wants to start accepting credit cards for payment, which requires compliance with a security standard. Which of the following standards must the company comply with before accepting credit cards on its e-commerce platform?

• PCI DSS

• ISO 22301

• ISO 27001

• NIST CSF

Multiple Choice

Your company has long maintained an email server, but it’s insecure and unreliable. You’re considering just outsourcing email to an external company that provides secure cloud-based email services. What risk management strategy are you employing?

• Risk acceptance
• Risk avoidance
• Risk mitigation
• Risk transference

Multiple Select

What steps might be taken as part of a vulnerability scan?

• Bypassing security controls
• Exploiting vulnerabilities
• Finding open ports
• Identifying vulnerabilities
• Passively testing security controls

Multiple Select

Which of the following RAID levels incorporates disk striping? Select all that apply

• RAID 0
• RAID 1
• RAID 5
• RAID 10

Drag and Drop

You overhear a conversation in which an employee might be disclosing confidential information to an external party.
Question: What should be evaluated to investigate any disclosing breach​

Placeholder

Drag these tiles and drop them in the correct blank above

Background Check

Onboarding

Mandatory Vacation Policy

Job Rotation Implementation

Non-Disclosure Agreement

Multiple Choice

What is the primary benefit of mandatory vacation in an organization?

• To increase employee morale

• To detect illegal activities like fraud

• To reduce the workload of employees

• To improve job rotation

Drag and Drop

Background checks are important to verify an applicant's ​

Placeholder

and to uncover any ​

Placeholder

history which may be harmful to the company.​

Drag these tiles and drop them in the correct blank above

employment

criminal

options

letters

clean desk

NDA

Multiple Choice

Job rotation involves rotating employees through various positions to prevent any single person from holding particular job responsibilities for an extended period.

• True

• False

Multiple Choice

An employee who never takes vacation is not considered a security risk.

• True

• False

Multiple Select

Which of the following are components of onboarding? (Select all that apply)

• Background checks

• Exit interviews

• Initial training

• Non-Disclosure Agreements (NDAs)

• Mandatory Vacation