True or False? Configuration changes can be made at any time during a system life cycle, and no process is required.

Aditya is attempting to classify information regarding a new project that his organization will undertake in secret. Which characteristic is not normally used to make these types of classification decisions?

True or False? The Common Criteria is a set of system procurement standards used by several countries.

Mark is considering outsourcing security functions to a third-party service provider. What benefit is he most likely to achieve?

True or False? The idea that users should be granted only the levels of permissions they need to perform their duties is called the principle of least privilege.

What is the correct order of change control procedures regarding changes to systems and networks?

True or False? Mandatory vacations minimize risk by rotating employees among various systems or duties.

Marguerite is creating a budget for a software development project. What phase of the system life cycle is she undertaking?

True or False? Regulatory compliance means complying with an organization's own policies, audits, culture, and standards.

True or False? Using the names of superiors to convince another person that a higher authority has allowed access to information is a form of social engineering.

Bob is preparing to dispose of magnetic media and wishes to destroy the data stored on it. Which method is not a good approach for destroying data?

True or False? Company-related classifications are not standard; therefore, there may be some differences of meaning between the terms "private" and "confidential" in different companies.

Lin is creating a template for the configuration of Windows servers in her organization. The configuration includes the basic security settings that should apply to all systems. What type of document should she create?

True or False? Policies that cover data management should cover transitions throughout the data's life cycle.

In an accreditation process, who has the authority to approve a system for implementation?

True or False? The process of remediation makes sure all personnel are aware of and comply with an organization's policies.

True or False? The term "data owner" refers to the person or group that manages an IT infrastructure.

Antivirus, firewall, and email use policies belong to what part of a security policy hierarchy?

True or False? Change control is the management of changes to the configuration of a system.

True or False? A security awareness program should address the requirements and expectations of an organization's security policy.

True or False? A blanket purchase agreement (BPA) creates preapproved accounts with qualified suppliers to fulfill recurring orders for products or services.

True or False? The waterfall software development model works well in very dynamic environments where requirements change and are often revisited.