Cyber Policy quiz 3

Zhang's business case to implement an exam proctoring software has been approved by UNSW management. He wants to understand which mandatory IT asset management requirements need to be documented from a cyber security perspective: (Select multiple correct answers)

• connections and data flows to and from the service.

• vulnerabilities identified and/or mitigated.

• cost of storage for the system

• cyber security controls, their function, and their configuration.

Deepak has obtained approval for his business to implement a new Information Resource/Application handling highly sensitive UNSW data, hosted in UCloud-AWS). He is required to do the following: (multiple correct answers)

• Review and update the information resource attribute fields in inventory on a periodic basis, as requested by cyber security team.

• Evaluate the assets "Inherent Cyber Risk Rating" classification using the Cyber Security Risk Management Standard

• Record the information resource in IT's central asset inventory.

• Update the information resource attribute fields in the asset inventory upon asset changes, upgrades, decommissioning.

As per the "Cyber Security Standard-Information Asset Management", all UNSW Business Divisions and Faculty's "Low Cyber Risk rated Information Resources must be recorded in an inventory.

• True

• False

High Cyber Risk Rated UNSW Information Services and supporting UNSW Information Assets must be reported to the UNSW IT ________ team for recording in the central UNSW IT inventory.

Mary Grace is business owner of learning management software(LMS), classified as High Cyber Risk rated information resource. One of the software has reached end of life/support but she is insisting on continuing to use it because it has been used for more than 9 years. What is your advice to her? (multiple correct answers)

• Since the LMS is currently non compliant with cyber security standards, it must be isolated from the network

• that LMS must have active maintenance or support contracts with the vendors or manufacturers.

• that LMS must be managed in accordance with the Cyber Security Standard – Risk Management.

• that her business division must not use end-of-life and/or end-of-support Information Resources, including the LMS.

As per Cyber Security Standard-Information Asset Management, all UNSW Business Divisions and Faculty's "High Cyber Risk rated Information Resources" must be recorded in "IT's" central asset inventory

• True

• False

The person responsible for defining, operating, measuring, and improving a UNSW Information Service and associated cyber security controls is called (select multiple correct answers)

• Information Asset Owner

• Information Service Owner

• System Owner

• IT service owner

Who is responsible for Asset Authorisation- the management decision to permit the operation of an Information Resource into a production environment through a formal release management process.

• Business Owner

• Data Owner

• CIO

• Information Service Owner

Jane is implementing a new solution by integrating 3 different applications (SaaS, PaaS and IaaS). She has classified the information resources as per Cyber Security Risk Management Standard as 1 high risk, 1 medium risk and 1 low risk. Which of the UNSW Information Resources does she have a mandate as per the standard, to record in an inventory: (select multiple correct answers)

• Medium Risk rated Information Resource

• High Risk rated Information Resource

• Low Risk rated Information Resource

• All Information Resource types

A regulatory requirement for a high risk Finance Division application requires certain security logs to be retained for 6 months. The Finance team wants to follow the regulatory advise and store the logs for 6 months. Your advise to the team is to retain them ​ (a)  

• for a minimum of 1 year
• as per the regulatory requirement
• for as long as its feasible
• its optional to retain