(ISC)2 Practice Exam 3

What is meant by non-repudiation? (D1, L1.1.1) - Answer- If a user does something, they can't later claim that they didn't do it. The concept of "secrecy" is most related to which foundational aspect of security? (D1, L1.1.1) - Answer- Confidentiality Siobhan is deciding whether to make a purchase online; the vendor wants Siobhan to create a new user account, and is requesting Siobhan's full name, home address, credit card number, phone number, email address, the ability to send marketing messages to Siobhan, and permission to share this data with other vendors. Siobhan decides that the item for sale is not worth the value of Siobhan's personal information, and decides to not make the purchase. What kind of risk management approach did Siobhan make? (D1, L1.2.2) - Answer- avoidance Which of the following is NOT one of the four typical ways of managing risk? (D1, L1.2.1) - Answer- Conflate Is it possible to avoid risk? (D1, L1.2.1) - Answer- Yes A chief information security officer (CISO) at a large organization documented a policy that establishes the acceptable use of cloud environments for all staff. This is an example of a: (D1, L1.3.1) - Answer- Management/Administrative control Guillermo is the system administrator for a midsized retail organization. Guillermo has been tasked with writing a document that describes, step-by-step, how to securely install the operating system on a new laptop. This document is an example of a ________. (D1, L1.4.1) - Answer- procedure Lankesh is the security administrator for a small food-distribution company. A new law is published by the country in which Lankesh's company operates; the law conflicts with the company's policies. Which governance element should Lankesh's company follow? (D1, L1.4.2) - Answer- the law While taking the certification exam for this certification, you notice another candidate for the certification cheating. What should you do? (D1, L1.5.1) - Answer- Report the candidate to (ISC)2. Kristal is the security administrator for a large online service provider. Kristal learns that the company is harvesting personal data of its customers and sharing the data with local governments where the company operates, without the knowledge of the users, to allow the governments to persecute users on the basis of their political and philosophical beliefs. The published user agreement states that the company will not shar