CNET251 Chapt 9 - Security Management Practices

Organizations that provide complete job descriptions when advertising open positions should include the elements of the job description that describe access privileges.

• True

• False

Which type of security (background) check might be required by someone applying for jobs in law enforcement or high-security positions?

• identity checks

• credit history

• polygraph test

• reference check

Which personnel security practice is used to ensure that no one employee is performing actions that cannot be knowledgeably reviewed by another employee?

• mandatory vacation policy

• two-person control

• separation of duties

• task rotation

All but which of the following is one of the four factors critical to success of an InfoSec program, as listed by SP 800-55 Rev. 1?

• Actions-oriented measurement analysis

• Strong upper-level management support

• Practical InfoSec policies and procedures

• Quantifiable performance measurements

Which phase of the performance measurement development process identifies relevant stakeholders and their interests in InfoSec measurement?

• Phase 1

• Phase 2

• Phase 4

• Phase 7

Measurements that examine the performance of an individual control or group of controls within the InfoSec program are known as which of the following?

• micro-focus measurements

• baseline measurements

• macro-focus measurements

• benchmark measurements

Performance targets are often a hindrance to effective security.

• True

• False

An organization that works within an industry regulated by laws and standards is required to meet regulatory or industry guidelines in security practices.

• True

• False

Which NIST document covers basic engineering principles regarding security baselines?

• SP 800-27

• SP 800-55

• SP 800-55A

• SP 800-11

What term below is used to describe security efforts that are considered among the best in an industry?

• Standard of due care

• Standard of due diligence

• Recommended business practices

• Best security practices