Quiz on Information Security Management

What is the principle of least privilege?

• Access to the minimum amount of information for the minimum amount of time

• Access to all data regardless of job function

• Access to all information at all times

• Access to information based on personal preference

What does the need-to-know principle entail?

• Access based on seniority

• Access limited to specific information required for a task

• Access to general categories of data

• Access to all data in the organization

What is the purpose of separation of duties?

• To eliminate the need for oversight

• To ensure all employees have the same access

• To split significant tasks among multiple individuals

• To allow one person to control all tasks

Which of the following is a directive control?

• Firewalls

• Video monitoring signs

• Strong authentication requirements

• An appropriate use policy

What type of controls are managerial controls?

• Controls that are purely technical

• Controls that are discretionary

• Controls designed by strategic planners

• Controls that deal with operational functions

What does mandatory access control imply?

• Users can decide their own access levels

• Access is unrestricted

• Access is determined by a central authority

• Access is based on user preference

What is the highest level of classification in the U.S. government?

• Restricted

• Top Secret

• Secret

• Confidential

What is a clean desk policy?

• A policy that prohibits any document storage

• A policy requiring secure storage of information

• A policy allowing open access to all documents

• A policy that encourages sharing of documents

What does lattice-based access control involve?

• Randomized access levels

• A single level of access for all users

• A matrix of authorizations for access

• No restrictions on access

What are nondiscretionary controls based on?

• User preferences

• Random assignment

• Central authority and roles

• Individual discretion