Mod 14 Oversight and Operations

Which of the following statements best describes governance?

• It provides detailed mandatory steps that a user needs to follow to comply with a policy.

• It is the structures, systems, and practices put in place to assign, oversee, and report.

• It specifies the uniform uses of specific technologies for secure configurations.

• It relates to setting the tone to encourage employees to embrace good practices.

Answer explanation

The correct choice describes governance as the structures, systems, and practices that ensure proper assignment, oversight, and reporting, which is essential for effective management and accountability.

Publius is the chief information security officer at an organization. He needs to fill a position relating to governance. When advertising the position, which of the following words is he most likely to include in the job posting?

• Integrity

• Accountability

• Confidentiality

• Transparency

• Accounting

Answer explanation

In governance roles, 'Integrity', 'Accountability', and 'Transparency' are key values. They emphasize ethical behavior and openness, which are crucial for effective governance in information security.

Idalia works at a government agency responsible for issuing certain security directives. In addition, there are other members of the office responsible for enforcing those directives. Which of the following best describes the type of entity where Idalia works?

• Enforcement

• Compliance

• Regulatory

• Board

Answer explanation

Idalia's role in issuing security directives indicates she works in a regulatory entity, which creates and oversees compliance with rules, unlike enforcement or compliance roles that focus on implementation and adherence.

A technician is adding a computer to the network. The technician issues the ping command to verify the newly installed system has connectivity with the printer. Which of the following statements is NOT true regarding the object, subject, and operation in the context of the actions just described?

• The printer is the subject.

• The ping command is the operation.

• The printer is the object.

• The technician is the subject.

Answer explanation

The printer is the object in this context, as it is the target of the ping command. The subject is the technician who issues the command, making the statement 'The printer is the subject' NOT true.

Which of the following governance roles, in relation to system and data resources, determines the level of security needed for the data and delegates security duties as needed?

• Controller

• Processor

• Custodian

• Owner

Answer explanation

The Owner is responsible for determining the level of security required for data and can delegate security duties. This role ensures that data is protected according to its sensitivity and compliance needs.

A senior official at an organization is part of a team writing a set of documents that defines the organization's philosophy of how to safeguard its information. Which set of documents are they producing?

• Requirements

• Procedures

• Policies

Answer explanation

The team is producing 'Policies' as these documents outline the organization's philosophy and approach to safeguarding information, establishing the framework for how information should be managed and protected.

A set of management statements that defines an organization's philosophy of how to safeguard its information is a viable definition for a security policy. It outlines the principles that should be followed by its intended audience and addresses issues concerning the achievement of the overall purpose of the organization. What is this set of management statements called?

• Requirements

• Procedures

• Policies

• Standards

• Guidelines

Answer explanation

The correct answer is 'Policies' as it refers to the set of management statements that define an organization's philosophy on safeguarding information, outlining principles for the intended audience.

Galina is implementing a series of changes that were ratified by the governance board in the organization where she works. Included in the changes is updating the password policy for all users. Which document is Galina most likely to use when implementing the change?

• Requirements

• Procedures

• Guidelines

• Standards

• Policies

Answer explanation

Galina will use Procedures to implement the password policy changes, as they provide detailed steps for executing specific tasks, ensuring compliance with the updated policy established by the governance board.

A recent college graduate was hired. Part of the onboarding process includes reading a series of documents. One of the documents states that vulnerability scans conducted after network changes may be performed by internal staff. Which of the following types of documents is the college graduate most likely to be reading?

• Requirements

• Procedures

• Regulation

• Standards

• Policies

Answer explanation

The document describes specific actions (vulnerability scans) related to network changes, indicating it outlines accepted practices. This aligns with 'Standards', which define the criteria for processes within an organization.

Which of the following is likely to have the least severe of consequences if not complied with?

• Policies

• Guidelines

• Procedures

• Requirements

• Standards

Answer explanation

Guidelines are generally recommendations rather than mandatory rules, making their non-compliance less severe compared to policies, procedures, requirements, or standards, which often have stricter implications.