Quiz 11

An employee in an organization is requesting access to more information than is required. This request should be denied on the basis of which principle:

Two separate employees are required to open a safe containing sensitive information. One employee has part of the safe combination, and a second employee has another part of the safe combination. This arrangement follows the principle of:

The information security officer in an organization has assigned various accounting department employees to various roles in the organization’s financial system, taking care to assign roles with the fewest possible functions. Roles have been assigned according to the principle of:

An organization has in its possession many types of business records that vary in sensitivity and handling requirements. No policy exists that defines how any of these records should be protected. This organization lacks:

The purpose of a periodic review of user access rights is:

The purpose of a password policy that requires a minimum number of days between password changes is:

The purpose of a password policy that locks an account after five unsuccessful login attempts is:

The purpose of backups includes all of the following EXCEPT:

The most effective way to confirm whether backups function properly is:

An organization’s data classification policy includes handling procedures for data at each level of sensitivity. The IT department backs up all data onto magnetic tape, resulting in tapes that contain data at all levels of sensitivity. How should these backup tapes be handled?

All of the following methods for destroying data on hard disk drives are sufficient EXCEPT:

All of the following are valid reasons for backing up data EXCEPT:

An organization’s IT manager is establishing a business relationship with an off-site media storage company, for storage of backup media. The storage company has a location 5 miles away from the organization’s data center, and another location that is 70 miles away. Why should one location be preferred over the other?

An organization’s IT manager wants to discontinue the business relationship with an off-site media storage company, and instead store the organization’s backup tapes at his residence, which is closer to the organization’s data center. Should this plan be considered, and why:

Why do the actions of system administrators need to be monitored more closely than other personnel?

Which of the following is NOT a risk associated with remote access:

A workstation that can remotely access the organization’s network through a VPN and access the local LAN, all through the same physical network connection, is using:

What is the difference between split tunneling and inverse split tunneling:

The primary advantage of the use of a central management console for anti-virus is:

The process of erasing magnetic media through the use of a strong magnetic field is known as:

A security manager has instructed a system administrator to wipe files on a hard disk. This means that the administrator needs to:

An organization has received notice of a lawsuit related to activities in its operations department. How should the organization respond:

An organization has experienced several virus infections on its desktop workstations. Which of the following remedies would NOT be effective to reduce virus infections?

An organization has been made a party in a civil lawsuit. The organization is required to search its electronic records for specific memoranda. This process is known as:

An organization’s critical application is required to be continuously available, with only a few minutes’ per month of downtime allowed. What measure should the organization implement to assure this level of availability?