Flashcards
SCIA 370 Chapter 11
Cards in this deck (20)
- 1While it would not be possible to classify all data in an organization, there has nonetheless been an increase in the amount of unstructured data retained in recent years, which has included data and logs. There are many different ways to make the time-consuming and expensive process of retaining data less challenging. Which of the following is not one these approaches? a. Classify only the data that is most vital and contains the highest risk to the organization. b. Classify data by point of origin or storage location. c. Classify data at use or time of inception. d. Classify all forms of data no matter the risk to the organization.d. Classify all forms of data no matter the risk to the organization.
- 2One of the most important approaches used to secure personal data is ________________, which is the process used to prove the identity of an individual. ______________, however, is the process used to enable a person’s access privileges. a. authentication, authorization b. authorization, authentication c. authentication, verification d. verification, authenticationa. authentication, authorization
- 3Of all the needs that an organization might have to classify data, there are three that are most prevalent. Which of the following is not one of the reasons? a. protect information b. retain information c. recover information d. transfer informationd. transfer information
- 4It is necessary to retain information for two significant reasons: legal obligation and business needs. Data that occupies the class of ________________ is comprised of records that are required to support operations; the data included might be customer and vendor records. a. regulated b. business c. temporary d. permanentb. business
- 5At Stanford University, data is labeled according to a classification scheme that identifies information in the following way: prohibited, restricted, confidential, and unrestricted. Which of the following schemes has Stanford adopted? a. customized classification b. business classification c. legal classification d. military classificationc. legal classification
- 6The National Security Information document EO 12356 explains the U.S. military classification scheme of top secret, secret data, confidential, sensitive but unclassified, and unclassified. Which of the following data can be reasonably expected to create serious damage to national security in the event that it was subject to unauthorized disclosure? a. top secret b. secret c. confidential d. sensitive but unclassifiedb. secret
- 7Despite the fact that there exists no mandatory scheme of data classification for private industry, there are four classifications used most frequently. Which of the following is not one of the four? a. highly sensitive b. moderately sensitive c. sensitive d. internalb. moderately sensitive
- 8The term ________________ denotes data that is being stored on devices like a universal serial bus (USB) thumb drive, laptop, server, DVD, CD, or server. The term ______________ denotes data that exists in a mobile state on the network, such as data on the Internet, wireless networks, or a private network. a. data at rest, data in transit b. data in transit, data at rest c. data on record, data in motion d. data in transit, data on recorda. data at rest, data in transit
- 9If an organization is creating a customized data classification scheme, it is important to keep in mind the accepted guidelines. Which of the following is not one these guidelines? a. Define the number of classification levels. b. Identify each classification level. c. Connect the classification to particular handling requirements. d. Make recommendations for how audits can be conducted.d. Make recommendations for how audits can be conducted.
- 10When constructing policies regarding data _______________, it is important that these policies offer particular guidance on separation of duties (SOD), and that there are procedures that verify SOD requirements. a. creation b. access c. use d. storageb. access
- 11There must be security policies in place to set core standards and requirements when it comes to encrypted data. Which of the following is not one of these standards and requirements? a. Encryption keys must be located in the same server as the encryption data. b. Encryption keys must be obtained via secure process. c. Administrator rights at the OS layer do not grant access rights to the database. d. Encryption keys must be located in isolation from encrypted data.a. Encryption keys must be located in the same server as the encryption data.
- 12In policies regarding the ___________ of data, it must be guaranteed that the data that exits the private network is secured and monitored; the data should also be encrypted while in transit. a. creation b. storage c. use d. physical transportd. physical transport
- 13_____________ risk is the possible outcome that can occur when an organization or business unsuccessfully addresses its fiscal obligations. a. Monetary b. Financial c. Strategic d. Complianceb. Financial
- 14Which of the following outcomes is one of the benefits of a risk-management approach to security policies? a. This approach eliminates all costs of decisions entirely. b. This approach promotes a subjective understanding of risk ensuring flexibility. c. This approach offers alternative courses of action that might not be obvious to the leaders. d. This approach delimits the benefits of decisions without the need for identifying the costs.c. This approach offers alternative courses of action that might not be obvious to the leaders.
- 15Because risk management is a both a governance process and a model that seeks consistent improvement, there is a series of steps to be followed every time a new risk emerges. Which of the following is not one of these steps? a. Make the risk a priority and connect it to strategic objectives. b. Establish an appropriate response to risk, which might mandate policy adjustment. c. Identify the prior risks; it is not necessary to determine the cause. d. Ascertain risk to assess how it impacts the organization.. Identify the prior risks; it is not necessary to determine the cause.
- 16A ______________________ is an apparatus for risk management that enables the organization to comprehend its risks and how those risks might impact the business. a. risk and control self-assessment (RCSA) b. risk avoidance self-assessment (RASA) c. risk transference self-assessment (RTSA) d. risk mitigation assess self-assessment (RMASA)a. risk and control self-assessment (RCSA)
- 17A risk exposure is defined as the impact to the organization when a situation transpires. The widely accepted formula for calculating exposure is as follows: Risk exposure =________________ the event will occur + ____________ if the event occurs a. where, outcome b. likelihood, impact c. how, impact d. likelihood, costb. likelihood, impact
- 18Of the risk management strategies, _________________ refers to the act of not engaging in actions that lead to risk, whereas ____________________refers to acquiescence in regard to the risks of particular actions as well as their potential results . a. risk avoidance, risk transference b. risk acceptance, risk transference c. risk mitigation, risk acceptance d. risk avoidance, risk acceptanced. risk avoidance, risk acceptance
- 19Consider this scenario: A major software company finds that code has been executed on an infected machine in its operating system. As a result, the company begins working to manage the risk and eliminates the vulnerability 12 days later. Which of the following statements best describes the company’s approach? a. The company effectively implemented data classification. b. The company effectively implemented quality control. c. The company effectively implemented patch management. d. The company effectively implemented quality assurance.c. The company effectively implemented patch management.
- 20If a vulnerability is not fixed at the root cause, there is a possibility that another route of attack can emerge. This route is known as the ____________________. a. vulnerability vector b. attack vector c. risk vector d. root vectorb. attack vector