Security Assesment And Auditing

Front 1

____ work directly with data owners and are responsible for the storage, maintenance and protection of the information.

Back 1

Data custodians

Front 2

The National Association of Corporate Directors (NACD) recommends four essential practices for boards of directors. Which of the following is NOT one of these recommended practices?

Back 2

Place information security at the top of the board’s agenda

Front 3

The ____ phase is typically the most important phase of the security systems development life cycle (SecSDLC).

Back 3

maintenance

Front 4

The ____ explicitly declares the business of the organization and its intended areas of operations.

Back 4

mission statement

Front 5

According to the Corporate Governance Task Force (CGTF), in order to build programs suited to their needs, organizations should do all but which of the following?

Back 5

Create and execute a plan for punitive action for employees who fail to resolve information security deficiencies

Front 6

According to the Corporate Governance Task Force (CGTF), during which phase in the IDEAL model and framework does the organization plan the specifics of who it will reach its destination?

Back 6

Establishing

Front 7

The basic outcomes of information security governance should include all but which of the following?

Back 7

Resource management by executing appropriate measures to manage and mitigate risks to information technologies

Front 8

Which of the following is an information security governance responsibility of the organization’s employees?

Back 8

Implement policy, report security vulnerabilities and breaches

Front 9

A ____ is a feature left behind by system designers or maintenance staff.

Back 9

back door

Front 10

Which of the following is a characteristic of the bottom-up approach to security implementation?

Back 10

Systems administrators attempting to improve the security of their systems

Front 11

In the ____ phase of the security systems development life cycle (SecSDLC), the information obtained during the analysis phase is used to develop a proposed system-based solution for the business problem.

Back 11

logical design

Front 12

____ controls set the direction and scope of the security process and provide detailed instructions for its conduct.

Back 12

Managerial

Front 13

Operational plans are used by ____.

Back 13

managers

Front 14

The ____ statement contains a formal set of organizational principles, standards, and qualities.

Back 14

values

Front 15

According to the Corporate Governance Task Force (CGTF), during which phase in the IDEAL model and framework does the organization do the work according to the plan?

Back 15

Acting

Front 16

According to the Corporate Governance Task Force (CGTF), in order to build programs suited to their needs, organizations should do all but which of the following?

Back 16

Conduct an annual information security evaluation, the results of which the CISO should review with security staff and then report to the board of directors

Front 17

The information security governance framework generally consists of which of the following?

Back 17

A security strategy that talks about the value of information technologies protected

Front 18

____ commonly specify who can access a particular set of information.

Back 18

Data owners

Front 19

Vision statements are meant to be ____.

Back 19

ambitious

Front 20

At the end of each phase of the security systems development life cycle (SecSDLC), a ____ takes place.

Back 20

structured review