Cyber Policy quiz 4

Lee is late for a meeting due to a personal issue. She requests her colleague to login on her behalf to record a meeting since her attendance is really critical. What do you think of this scenario?

• Lee has made the correct choice as her absence will create negative impact

• If its only one occasion, it's fine to do so

• Lee has breached Cyber policy by sharing her authentication detail

High risk UNSW Information Services must be configured to fail: (Select multiple correct answers)

• into a secure state (fail secure)

• as per Solution Architect's discretion

• systems can never fail

• at or before the recovery point objective

Privileged accounts (including any privileged accounts used by suppliers or service providers, any service accounts, shared accounts or generic accounts) must have their business requirements documented and stored in a searchable format. The information stored must include: (Select multiple correct answers)

• operational requirement.

• ownership of the account (Individual and organisation).

• contact details for the owner

• duration of access and any other restrictions such as hours or days of access.

Gary is designing a high risk HR system and intends to use an account with username 'unswHR' as login. Is he permitted to do the same?

• Yes

• No

• Can't say

Unauthenticated access must only be provided for ​ (a)   digital information

• publicly accessible
• private
• sensitive
• highly sensitive

Rachel is the Business Owner of procurement software for the University of New South Wales (UNSW). She is responsible for ensuring that appropriate recovery strategies and processes are defined and implemented for UNSW Information Services to restore services in the required time. What must she do to ensure that the Disaster Recovery plan is effective?

• The plan must be communicated effectively to all stakeholders, with training provided.

• The plan must be tested every two years.

• The plan must be reviewed and updated every five years.

• The plan must be kept secret from all stakeholders.

How often must Rachel's system Disaster Recovery plan be tested?

• Every two years. .

• Every five years.

• Annually and upon significant change

• Whenever the IT department sees fit

Arun is a business owner of Finance application that is designed in a way it requires 5 privileged accounts. For each of these accounts. Which of the following business requirements must be documented by him as the business owner? (multiple correct answers)

• operational requirement.

• ownership of the account

• contact details for the owner.

• level of access required

• duration of access and any other restrictions such as hours or days of access.

Jake needs to install service account to perform a system function for a high risk system. He insists on having an interactive login for himself for this account. What is you advise to Jake?

• Approve his design

• Tell him the design does not meet the Standard

• If it's a business requirement, Jake can do whatever he likes

Cindy is working on the design of IDAM controls for a student accommodation management system. She wants to understand appropriate password parameters for the system. Which of the following must be include? (multiple correct answers)

• Passphrases must be at least 12 characters in length

• include at least two or more alphabetic uppercase

• include at least one numeric

• include at least two or more alphabetic lowercase