TOPIC 4.0 Information Security Governance Principles

What is the main goal of a security policy in an organization?

• To manage employee attendance

• To protect information assets

• To monitor social media usage

• To control internet access

Which type of authentication is based on something you are?

• Password

• Biometrics

• Security token

• PIN

Which of the following categories are used in information classification?

• Public, Confidential, Highly Sensitive

• Physical, Logical, Abstract

• High, Medium, Low

• Open, Closed, Restricted

What is the purpose of data encryption?

• To compress data for faster transfer

• To make data unreadable without the encryption key

• To archive old data

• To backup data automatically

Which policy outlines acceptable and unacceptable behaviors when using an organization's information systems?

• Ethics Policy

• Acceptable Use Policy (AUP)

• Need to Know Policy

• Document Disposal Policy

Why is it important to apply file and folder permissions in an organization?

• To ensure faster file access

• To limit access and prevent unauthorized data breaches

• To reduce system performance issues

• To enable anyone to modify documents

What is the role of a termination policy in an organization?

• Allow former employees limited access to systems

• Revoke access rights and retrieve company assets

• Prevent employees from resigning

• Grant employees additional privileges

What does "Need to Know" policy aim to achieve?

• It restricts access to only the information necessary for an employee’s job role

• It ensures everyone has access to all company data

• It monitors employee productivity

• It grants access based on personal preferences

How does Single Sign-On (SSO) improve security?

• By requiring multiple passwords

• By allowing users to access multiple systems with one set of credentials

• By storing passwords in plaintext

• By preventing users from accessing multiple systems

Which of the following is an example of enforcing physical access control?

• Using password policies

• Implementing key cards and biometric systems

• Encrypting all company emails

• Conducting cybersecurity awareness training