Day#3A: Quiz 14-15-16

What does an organization’s security architecture represent?

• A set of practices used to address security requirements at a tactical level

• A set of practices used to address security requirements at an operational level

• A set of practices used to address security requirements at a system level

Which of the following security services aim to facilitate user identification and support shared authentication across the organization?

• Boundary control

• Access control

• Cryptographic

What are the six cascading levels covered in the SABSA matrix for security architecture development?

• Elements, purpose, procedures, personnel, area, and schedule

• Functions, planning, procedures, personnel, geography, and duration

• Asset, motivation, process, people, location, and time

Which of the following steps should organizations take when preparing for the implementation of information security controls, among others?

• Prepare the required documented information

• Conduct a cost analysis

• Both A and B

Why should organizations involve employees in the process of drafting information security procedures and policies?

• Because it saves time and resources during the drafting process

• Because it motivates them to contribute in the implementation of the information security controls

• Because it is a requirement of ISO/IEC 27001

ISO/IEC 27001 provides a specific documentation method to be used for designing and describing controls.

• True

• False

In how many themes are the 93 controls of Annex A grouped?

• Five

• Three

• Four

What is the main purpose of control 6.1 Screening of Annex A of ISO/IEC 27001?

• To ensure that all personnel are eligible and suitable for their roles

• To ensure that employees and contractors are aware of and fulfil their information security responsibilities

• To protect the organization’s interests as part of the process of any changes in employment

Who should have access to documented operating procedures for information processing facilities?

• Only the top management

• Only the person responsible for operating procedures

• Any user that needs them

What is the main requirement of control 8.34 Protection of information systems during audit testing of Annex A?

• The tester and appropriate management must appropriately manage test information

• The tester and appropriate management must plan and agree on audit tests and other assurance activities involving assessment of operational systems

• The tester must separate and secure the development, testing, and production environments