SOW4141 CHAPTER 8 FULLY SOLVED TEST
PAPER GRADED A+
◉ A security monitor is a conceptual piece of the system within the
trusted computer base that manages access controls—in other
words, it mediates all access to objects by subjects. __________.
Answer: False - reference
◉ The data access principle that ensures no unnecessary access to
data exists by regulating members so they can perform only the
minimum data manipulation necessary is known as required
privilege. __________.
Answer: False - least
◉ The principle of limiting users' access privileges to the specific
information required to perform their assigned tasks is known as
need-to-know. __________.
Answer: True
◉ In a lattice-based access control, a restriction table is the row of
attributes associated with a particular subject (such as a user).
__________.
Answer: False - capabilities
,◉ A security clearance is an access control model in which each user
of an information asset is assigned an authorization level that
identifies the level of classified information he or she is cleared to
access. __________.
Answer: True
◉ Dumpster exploitation is an information attack that involves
searching through a target organization's trash and recycling bins
for sensitive information. __________.
Answer: False - diving
◉ In information security, a framework or security model
customized to an organization, including implementation details, is a
_________.
a. security standard b. methodology
c. security policy d. blueprint.
Answer: d
◉ Which of the following is a generic model for a security program?
a. framework
b. methodology
c. security standard
d. blueprint.
Answer: a
,◉ In information security, a specification of a model to be followed
during the design, selection, and initial and ongoing implementation
of all subsequent security controls is known as a __________.
a. framework
b. security plan
c. security standard
d. blueprint.
Answer: a
◉ Which of the following is the original purpose of ISO/IEC 17799?
a. Use within an organization to obtain a competitive advantage
b. Implementation of business-enabling information security
c. Use within an organization to ensure compliance with laws and
regulations
d. To offer guidance for the management of InfoSec to individuals
responsible for their organization's security programs.
Answer: d
◉ When the ISO 27002 standard was first proposed, several
countries, including the United States, Germany, and Japan, refused
to adopt it, claiming that it had fundamental problems; which of the
following is NOT one of them?
a. It was not as complete as other frameworks.
, b. The standard lacked the measurement precision associated with
a technical standard.
c. The standard was hurriedly prepared.
d. It was feared it would lead to government intrusion into business
matters..
Answer: f
◉ One of the most widely referenced InfoSec management models,
known as Information Technology—Code of Practice for Information
Security Management, is also known as __________.
a. ISO 27002
b. IEC 27100
c. NIST SP 800-12
d. IEEE 801.
Answer: a
◉ The managerial tutorial equivalent of NIST SP 800-12, providing
overviews of the roles and responsibilities of a security manager in
the development, administration, and improvement of a security
program, is NIST __________.
a. SP 800-100: Information Security Handbook: A Guide for
Managers (2007)
b. SP 800-18, Rev. 1: Guide for Developing Security Plans for Federal
Information Systems (2006)
PAPER GRADED A+
◉ A security monitor is a conceptual piece of the system within the
trusted computer base that manages access controls—in other
words, it mediates all access to objects by subjects. __________.
Answer: False - reference
◉ The data access principle that ensures no unnecessary access to
data exists by regulating members so they can perform only the
minimum data manipulation necessary is known as required
privilege. __________.
Answer: False - least
◉ The principle of limiting users' access privileges to the specific
information required to perform their assigned tasks is known as
need-to-know. __________.
Answer: True
◉ In a lattice-based access control, a restriction table is the row of
attributes associated with a particular subject (such as a user).
__________.
Answer: False - capabilities
,◉ A security clearance is an access control model in which each user
of an information asset is assigned an authorization level that
identifies the level of classified information he or she is cleared to
access. __________.
Answer: True
◉ Dumpster exploitation is an information attack that involves
searching through a target organization's trash and recycling bins
for sensitive information. __________.
Answer: False - diving
◉ In information security, a framework or security model
customized to an organization, including implementation details, is a
_________.
a. security standard b. methodology
c. security policy d. blueprint.
Answer: d
◉ Which of the following is a generic model for a security program?
a. framework
b. methodology
c. security standard
d. blueprint.
Answer: a
,◉ In information security, a specification of a model to be followed
during the design, selection, and initial and ongoing implementation
of all subsequent security controls is known as a __________.
a. framework
b. security plan
c. security standard
d. blueprint.
Answer: a
◉ Which of the following is the original purpose of ISO/IEC 17799?
a. Use within an organization to obtain a competitive advantage
b. Implementation of business-enabling information security
c. Use within an organization to ensure compliance with laws and
regulations
d. To offer guidance for the management of InfoSec to individuals
responsible for their organization's security programs.
Answer: d
◉ When the ISO 27002 standard was first proposed, several
countries, including the United States, Germany, and Japan, refused
to adopt it, claiming that it had fundamental problems; which of the
following is NOT one of them?
a. It was not as complete as other frameworks.
, b. The standard lacked the measurement precision associated with
a technical standard.
c. The standard was hurriedly prepared.
d. It was feared it would lead to government intrusion into business
matters..
Answer: f
◉ One of the most widely referenced InfoSec management models,
known as Information Technology—Code of Practice for Information
Security Management, is also known as __________.
a. ISO 27002
b. IEC 27100
c. NIST SP 800-12
d. IEEE 801.
Answer: a
◉ The managerial tutorial equivalent of NIST SP 800-12, providing
overviews of the roles and responsibilities of a security manager in
the development, administration, and improvement of a security
program, is NIST __________.
a. SP 800-100: Information Security Handbook: A Guide for
Managers (2007)
b. SP 800-18, Rev. 1: Guide for Developing Security Plans for Federal
Information Systems (2006)
