Info Sec Managment L4-Security Standards, Frameworks & Reg

Open Ended

How do governance, risk management, and compliance work together to protect an organization?

Multiple Choice

Why is it important for organizations to follow security standards and regulations?

• To ensure the safety of their employees only

• To avoid unnecessary expenses

• To protect sensitive information and maintain trust

• To increase the number of policies

Multiple Choice

Which step in implementing a security governance system involves determining who is responsible for security within an organization?

• Define governance structure

• Develop policies

• Identify and assess risks

• Monitor performance

Multiple Select

Which of the following are key reasons why laws and regulations are mandatory for organisations?

• To avoid penalties

• To ensure compliance

• To improve technical skills

• To protect organisational assets

Home

Open in new tab

Copy link

Open Ended

Discuss how Governance, Risk and Compliance (GRC) roles differ from technical roles in an organization.

Multiple Choice

What is the primary purpose of security controls in an organization?

• To monitor employee performance

• To protect assets from unauthorized access, theft, damage, or disruption

• To develop company policies

• To align IT processes with business goals

Multiple Choice

Which of the following is an example of a logical security control?

• User account reviews

• Encryption

• Locks

Multiple Choice

Which of the following is NOT an objective of the Payment Card Industry Data Security Standards (PCI DSS)?

• Protect cardholder data when it is stored and in transit

• Maintain a vulnerability management programme

• Increase the speed of card transactions

Multiple Choice

What is the full meaning of FIPS?

• Federal Information Processing Standards

• Finding Information Processing Security

• Federal Information Protection Standards

Open Ended

Explain why frameworks are important in cybersecurity and provide one example of a commonly used framework.

Multiple Choice

Which of the following is NOT one of the three main parts of the NIST Cybersecurity Framework (CSF)?

• Core

• Implementation Tiers

• Profiles

• Controls

Multiple Select

Select 2 key activities of the Protect function in the NIST CSF?

• Incident response planning

• Awareness and training

• Data security

Multiple Choice

What is the main purpose of the Respond function in the NIST CSF?

• To prevent cybersecurity incidents from occurring

• To contain and manage incidents once they occur

• To recover from incidents

Multiple Choice

Which of the following best describes the concept of 'risk' in information security?

• The obligation to follow laws and regulations

• The possibility that a threat will exploit a vulnerability and cause harm

• Decision-making authority and oversight

• Acceptable behaviour and security expectations

Open Ended

Summarize one key difference between security governance and security management based on what you learned in this lesson.