M5C2

The Primary objective of implementing Information security management is to:

• Ensure reasonable security practices
• Comply with internal audit requirements
• Adopt globally recognized standards
• Protect information assets

Which of the following is primary function of information security policies?

• Align information security practices with strategy
• Communicate intent of management to stakeholders
• Perform risk assessment of IT operations and assets
• Ensure compliance with requirements of standards

Information security policies are set of various policies addressing different information systems areas based on the IT infrastructure of organization. Which of the following policy is most common in all organizations?

• Acceptable use policy
• BYOD (Bring Your Own Device) policy
• Data encryption policy
• Biometric security policy

Protecting integrity of data primarily focuses on:

• Intentional leakage of data
• Accidental loss of data
• Accuracy and completeness
• Data backup procedures

Which of the following is primary reason for periodic review of security policy?

• Compliance requirements
• Changes on board of directors’
• Changes in environment
• Joining of new employees

Which is best evidence indicting support and commitment of senior management for information security initiatives?

• Directive for adopting global security standard
• Higher percentage of budget for security projects
• Assigning responsibilities for security to IT head
• Information security is on monthly meeting agenda

Which of the following is a concern for compliance with information security policy?

• Decrease in low risk findings in audit report
• High number of approved and open policy exceptions
• Security policy is reviewed once in two years
• Security policy is signed by Chief Information Officer

Which of the following is Primary purpose of Information classification?

• Comply with regulatory requirement
• Assign owner to information asset
• Provide appropriate level of protection
• Reduce costs of data protection

Classification of information is primarily based on:

• Where the information is stored?
• Who has access to information?
• What will happen if information is not available?
• Why attachments to mail are encrypted?

Which of the following best helps in classifying the information within organizations?

• Using minimum classes in classification schema
• Conducting training on classification schema
• Labeling all information based on classification schema
• Determining storage based on classification schema