Chapter 9 Quiz

True or False? Procedures help enforce the intent of a policy.

• True

• False

True or False? Configuration changes can be made at any time during a system life cycle, and no process is required.

• True

• False

Answer explanation

It is important that all configuration changes occur only within a controlled process. Uncontrolled configuration changes often result in conflicts and even new security vulnerabilities.

Aditya is attempting to classify information regarding a new project that his organization will undertake in secret. Which characteristic is not normally used to make these types of classification decisions?

• Value

• Criticality

• Threat

• Sensitivity

Answer explanation

The three criteria normally used to make classification decisions are value, sensitivity, and criticality.

True or False? The Common Criteria is a set of system procurement standards used by several countries.

• True

• False

Mark is considering outsourcing security functions to a third-party service provider. What benefit is he most likely to achieve?

• Access to a higher level of expertise

• Developing in-house talent

• Building internal knowledge

• Higher degree of privacy

Answer explanation

In this scenario, Mark is most likely to achieve access to a high level of expertise because security vendors focus exclusively on providing advanced security services.

True or False? The idea that users should be granted only the levels of permissions they need to perform their duties is called the principle of least privilege.

• True

• False

What is the correct order of change control procedures regarding changes to systems and networks?

• Request, approval, impact assessment, build/test, monitor, implement

• Request, approval, impact assessment, build/test, implement, monitor

• Request, impact assessment, approval, build/test, monitor, implement

• Request, impact assessment, approval, build/test, implement, monitor

True or False? Mandatory vacations minimize risk by rotating employees among various systems or duties.

• True

• False

Answer explanation

Job rotation minimizes risk by rotating employees among various systems or duties. Mandatory vacations give you the opportunity to detect fraud. When users are on vacation, you should suspend their access to the organization's environment.

Marguerite is creating a budget for a software development project. What phase of the system life cycle is she undertaking?

• Operations and maintenance

• Functional requirements and definition

• System design specification

• Project initiation and planning

Answer explanation

The project initiation and planning phase includes developing project budgets, system design, maintenance, and the project timeline.

True or False? Regulatory compliance means complying with an organization's own policies, audits, culture, and standards.

• True

• False

Answer explanation

Organizational compliance means complying with an organization's own policies, audits, culture, and standards. Regulatory compliance means the organization must comply with laws, government regulations, and contractual requirements.