Testing the security plan 1

What are the requirements for passwords to be considered strong?

• At least 12 characters long, include numbers, symbols, and uppercase letters.

• Implement strong password policies with regular password changes.

• Assign unique usernames to each employee and monitor their access.

What security measure is recommended for external access?

• Multi-factor authentication for critical systems.

• Clear access control policies.

• Multi-factor authentication for all external access.

• VPN- strong encryption protocols

What is the multi-layered approach to prevent Denial of service attack?

• Implement robust firewalls to monitor and filter incoming traffic.

• Configure routers and switches to mitigate the impact of volumetric attacks by dropping or rate-limiting suspicious traffic.

• Distribute incoming traffic across multiple servers.

• Provide comprehensive training to employees on recognizing the signs of a DoS attack and reporting incidents promptly.

What is the recommended frequency for software patches to be installed?

• Monthly patch updates are scheduled and tested for all systems.

• Install and regularly update anti-virus and anti-malware software.

• Real-time scanning is enabled on all computers and servers.

How often should user access rights be reviewed and updated?

• Access rights should be reviewed and updated at least every six months.

• Review and update access rights only when an employee leaves the company.

• Access rights need no regular review; set once and forget.

Which of the following is a recommended practice for securing mobile devices used in business?

• Use biometric authentication and ensure devices are encrypted.

• Only use mobile devices for non-sensitive operations.

• Mobile devices should be used without any restrictions or security measures.

What is an effective strategy to mitigate phishing attacks?

• Regular training and awareness programs for all employees.

• Phishing attacks cannot be mitigated effectively.

• Ignore phishing as a minor threat that does not require specific actions.