Chapter4_SecurityPlanning

What is the primary purpose of an information security program?

• To develop a marketing strategy

• To establish policies, standards, and practices

• To hire more employees

• To create a budget for security

Which of the following is NOT a component of contingency planning?

• Business continuity plans

• Disaster recovery planning

• Incident response planning

• Employee training programs

What must security policies do to be effective?

• Be properly disseminated and understood

• Be ignored by employees

• Be expensive to implement

• Be written in legal jargon

What type of standards are formal standards classified as?

• De jure standards

• Informal standards

• De facto standards

• Operational standards

What is the role of a policy administrator?

• To enforce laws

• To conduct security audits

• To draft all security policies

• To manage policy effectiveness

Which of the following is a key technology component that monitors network traffic?

• Intrusion Detection System (IDS)

• Proxy Server

• Cache Server

• Firewall

What does a clean desk policy require?

• No personal items on desks

• All documents to be shredded

• Classified information to be stored securely

• Employees to work from home

What is the main focus of incident response planning?

• Training employees

• Identifying and responding to incidents

• Preventing all incidents

• Creating marketing strategies

What is a hot site in business continuity planning?

• A site with limited services

• A temporary office space

• A fully configured facility ready for use

• A site with no equipment

What is the purpose of security education, training, and awareness (SETA)?

• To reduce costs

• To improve employee awareness and skills

• To create more policies

• To hire new staff