Information Security Management Ch 8

What is the primary purpose of the ISO/IEC 27002 standard?

• To establish a framework for financial reporting

• To offer a detailed technical guide for software development

• To outline the principles of project management

• To provide a common basis for developing organizational security standards

Which of the following is NOT a key principle of access control?

• Data encryption

• Least privilege

• Separation of duties

• Need to know

What does the term 'benchmarking' refer to in InfoSec?

• Auditing user access rights

• Comparing organizational performance against standards

• Creating new security policies

• Implementing security technologies

Which of the following is a key advantage of NIST documents?

• They are outdated and not widely used

• They are free and widely reviewed

• They are only available to government agencies

• They focus solely on technical controls

Which of the following is NOT a type of access control?

• Deterrent

• Compensating

• Descriptive

• Directive

What does the term 'accountability' refer to in access control?

• The classification of data

• The enforcement of security policies

• The documentation of user activities

• The process of identifying users

Which of the following is a common method for ensuring data integrity?

• Data masking

• Hashing

• Encryption

• Access control

Which principle is essential for effective user authentication?

• Single sign-on

• Multi-factor authentication

• Role-based access

• Data encryption

What is the main goal of the principle of least privilege?

• To ensure all users have maximum access

• To limit user access to only what is necessary

• To provide unrestricted access to sensitive data

• To simplify user management

Which of the following best describes a security incident?

• A planned security audit

• An event that compromises the integrity of data

• A routine system update

• A successful user login