Module 11 - 13: Data, Risk, Governance

Multiple Choice

Not designed for any specific entity, the act mandates the implementation of risk assessments, internal controls and audit procedures.

• Gramm-Leach-Bliley Act (GLBA)

• Sarbanes-Oxley Act (SOX)

• Computer Security Act

• Federal information Security Management Act (FISMA)

Multiple Choice

One of the earliest requires federal agencies to develop security policies for computer systems that process confidential information.

• Computer Security Act

• Gramm-Leach-Bliley Act (GLBA)

• Sarbanes-Oxley Act (SOX)

• Federal information Security Management Act (FISMA)

Multiple Choice

Provide best practices of an overall Information Security Management System (ISMS)

• ISO 27000

• ISO 31000

• ISO 10000

• GPR 27000

Fill in the Blanks

This EU Regulation lays down rules relating to the protection of people with regard to the processing of personal data and rules relating to the free movement of personal data.

Fill in the Blanks

A federal law that required the creation of national standards to protect sensitive patient health information from being disclosed without the patient’s consent or knowledge.

Fill in the Blanks

A Federal law that protects the privacy of student education records. This includes rights transfer to the student when he or she reaches the age of 18 or attends a school beyond the high school level.

Multiple Choice

What element of your risk mitigation strategy helps keep future additions to your network from introducing new security vulnerabilities?

• Change management
• Incident management
• Security audits
• Technical controls

Multiple Choice

The process of eliminating a risk by choosing not to participate in an action or activity describes which of the following?

• Risk avoidance

• Risk mitigate

• Residual risk

• Risk acceptance

Multiple Select

A security breach can have a negative long-term impact on an organization’s _______ that has taken years to build.

• Reputation

• Revenue

• Competitiveness

• Incompetence

Multiple Choice

A company recently set up an e-commerce portal to sell its product online. The company wants to start accepting credit cards for payment, which requires compliance with a security standard. Which of the following standards must the company comply with before accepting credit cards on its e-commerce platform?

• PCI DSS

• ISO 22301

• ISO 27001

• NIST CSF

Multiple Choice

Your company has long maintained an email server, but it’s insecure and unreliable. You’re considering just outsourcing email to an external company that provides secure cloud-based email services. What risk management strategy are you employing?

• Risk acceptance
• Risk avoidance
• Risk mitigation
• Risk transference

Multiple Select

What steps might be taken as part of a vulnerability scan?

• Bypassing security controls
• Exploiting vulnerabilities
• Finding open ports
• Identifying vulnerabilities
• Passively testing security controls

Multiple Select

Which of the following RAID levels incorporates disk striping? Select all that apply

• RAID 0
• RAID 1
• RAID 5
• RAID 10

Fill in the Blanks

In

, no single person should be responsible for certain job responsibilities for an extended period.

Drag and Drop

You overhear a conversation in which an employee might be disclosing confidential information to an external party.
Question: What should be evaluated to investigate any disclosing breach​

Placeholder

Drag these tiles and drop them in the correct blank above

Background Check

Onboarding

Mandatory Vacation Policy

Job Rotation Implementation

Non-Disclosure Agreement

Multiple Choice

What is the primary benefit of mandatory vacation in an organization?

• To increase employee morale

• To detect illegal activities like fraud

• To reduce the workload of employees

• To improve job rotation

Fill in the Blanks

knowledge is a policy where no individual has complete information needed to perform a specific function.

Fill in the Blanks

A

Desk Policy mandates that employees should leave their desks clear of all paperwork and sensitive information when they leave.

Drag and Drop

Background checks are important to verify an applicant's ​

Placeholder

and to uncover any ​

Placeholder

history which may be harmful to the company.​

Drag these tiles and drop them in the correct blank above

employment

criminal

options

letters

clean desk

NDA

Fill in the Blanks

During the

process, employees are introduced and trained about the company's practices and policies.

Fill in the Blanks

defines what is and what is not appropriate activity on an organization’s network or systems.

Fill in the Blanks

a legal contract that restricts the dissemination of confidential information.

Fill in the Blanks

The

interview is a tool used by HR to ask questions and ensure network disconnection when an employee leaves the organization.

Multiple Choice

Job rotation involves rotating employees through various positions to prevent any single person from holding particular job responsibilities for an extended period.

• True

• False

Multiple Choice

An employee who never takes vacation is not considered a security risk.

• True

• False

Multiple Select

Which of the following are components of onboarding? (Select all that apply)

• Background checks

• Exit interviews

• Initial training

• Non-Disclosure Agreements (NDAs)

• Mandatory Vacation