#01 Security Principle

A chief information security officer (CISO) at a large organization documented a policy that establishes the acceptable use of cloud environments for all staff. This is an example of a: (D1, L1.3.1)

• • Management/Administrative control

• • Technical control

• • Physical control

• • Cloud control

Answer explanation

Correct. Policies, standards, processes, procedures and guidelines set by corporate administrative entities (e.g., executive- and/or mid-level management) are management/administrative controls. 

Is it possible to avoid risk? (D1, L1.2.1)

• • Yes

• • No

• • Sometimes

• • Never

Answer explanation

Correct. To avoid an identified risk, stop doing what you have identified as being too risky or dangerous and not acceptable to the organization.

What is meant by non-repudiation? (D1, L1.1.1)

• • If a user does something, they can’t later claim that they didn’t do it.

• • Controls to protect the organization’s reputation from harm due to inappropriate social media postings by employees, even if on their private accounts and personal time.

• • It is part of the rules set by administrative controls.

• • It is a security feature that prevents session replay attacks.

Answer explanation

Correct. To repudiate means to attempt to deny after the fact, to lie about one's actions.  

Which of the following is NOT one of the four typical ways of managing risk? (D1, L1.2.1)

• • Avoid

• • Accept

• • Mitigate

• • Conflate

Answer explanation

Correct. Conflate is not a term used to describe a way to manage risk. 

Siobhan is deciding whether to make a purchase online; the vendor wants Siobhan to create a new user account, and is requesting Siobhan’s full name, home address, credit card number, phone number, email address, the ability to send marketing messages to Siobhan, and permission to share this data with other vendors. Siobhan decides that the item for sale is not worth the value of Siobhan’s personal information, and decides to not make the purchase. What kind of risk management approach did Siobhan make? (D1, L1.2.2)

• • avoidance

• • acceptance

• • mitigation

• • transfer

Answer explanation

Correct. This is an example of avoidance; in order to avoid the risk of unauthorized use of the personal data, Siobhan chose not to engage in the activity. 

Guillermo is the system administrator for a midsized retail organization. Guillermo has been tasked with writing a document that describes, step-by-step, how to securely install the operating system on a new laptop. This document is an example of a ________. (D1, L1.4.1)

• • policy

• • standard

• • procedure

• • guideline

Answer explanation

Correct. A procedure (sometimes referred to as a "process" document) is a description of how to perform an action. It is usually written by the office/person who performs that action on a regular basis. 

Lankesh is the security administrator for a small food-distribution company. A new law is published by the country in which Lankesh’s company operates; the law conflicts with the company’s policies. Which governance element should Lankesh’s company follow? (D1, L1.4.2)

• • the law

• • the policy

• • any procedures the company has created for the particular activities affected by the law

• • Lankesh should be allowed to use personal and professional judgment to make the determination of how to proceed

Answer explanation

Correct. Laws are the explicit authority of the jurisdiction where any organizations operate; laws cannot be violated, regardless of internal company governance. Laws supersede everything else. 

Kristal is the security administrator for a large online service provider. Kristal learns that the company is harvesting personal data of its customers and sharing the data with local governments where the company operates, without the knowledge of the users, to allow the governments to persecute users on the basis of their political and philosophical beliefs. The published user agreement states that the company will not share personal user data with any entities without the users’ explicit permission. According to the (ISC)² Code of Ethics, to whom does Kristal ultimately owe a duty in this situation? (D1, L1.5.1)

• • the governments of the countries where the company operates

• • the company Kristal works for

• • the users

• • (ISC)²

Answer explanation

The (ISC)² Code of Ethics Canons are listed in order of primacy; that is, the most important comes first, and the rest are in order of priority. Kristal owes a duty to each of the entities listed in the answers; however, the users are the most important entity in order of the Code hierarchy, as the users are described in the first Canon: "society," "the common good," and "public." 

While taking the certification exam for this certification, you notice another candidate for the certification cheating. What should you do? (D1, L1.5.1)

• • Nothing — each person is responsible for their own actions.

• • Yell at the other candidate for violating test security.

• • Report the candidate to (ISC)².

• • Call local law enforcement.

Answer explanation

The Preamble to the (ISC)² Code of Ethics requires that (ISC)² membership "requires that we adhere, and be seen to adhere, to the highest ethical standards of behavior." Cheating violates this standard. (ISC)² has enforcement mechanisms for ensuring membership complies with this requirement. 

The concept of “secrecy” is most related to which foundational aspect of security? (D1, L1.1.1)

• • Confidentiality

• • Integrity

• • Availability

• • Plausibility

Answer explanation

Correct. Confidentiality is about limiting access to information/assets and is therefore most similar to secrecy.