006_Gap Analysis1.2

What is the primary purpose of a gap analysis in IT security?

• To increase the number of IT staff

• To compare the current state to the desired future state

• To reduce IT costs

• To eliminate all security threats

What should be assessed when evaluating people in IT security?

• Their financial background

• Their formal experience in IT security

• Their marketing skills

• Their artistic abilities

Which of the following is NOT a part of the baseline establishment?

• NIST SP 800-171 Rev. 2

• ISO/IEC 27001

• Custom baselines

• Employee training programs

What is a key component of evaluating processes in IT security?

• Financial audits

• Alignment with security policies

• Employee satisfaction surveys

• Market research

What is a subtask mentioned under access control?

• Equipment needs

• User registration/deregistration

• Summarize findings

• Identify gaps

What is the purpose of documenting findings?

• To create a budget

• To compile data on all processes, devices, and locations

• To deregister users

• To limit system access

What is the goal of planning for the future?

• To deregister users

• To develop a path from the current state to the desired state

• To limit system access

• To compile data

What is the purpose of a final gap analysis report?

• To deregister users

• To summarize findings and recommendations

• To limit system access

• To compile data

What is a key component of the final gap analysis report?

• User feedback

• Detailed findings of the current state

• Equipment needs

• Access control

What is the purpose of evaluating processes?

• To deregister users

• To mitigate weaknesses

• To compile data

• To limit system access