Who should DECIDE how a company should approach security and what security measures should be implemented?
Answer(s): A
They are responsible for security of the organization and the protection of its assets.The following answers are incorrect because :Data owner is incorrect as data owners should not decide as to what security measures should be applied.Auditor is also incorrect as auditor cannot decide as to what security measures should be applied.The information security specialist is also incorrect as they may have the technical knowledge of how security measures should be implemented and configured , but they should not be in a position of deciding what measures should be applied.
Which of the following is responsible for MOST of the security issues?
Answer(s): C
Personnel cause more security issues than hacker attacks, outside espionage, or equipment failure.The following answers are incorrect because:Outside espionage is incorrect as it is not the best answer. Hackers is also incorrect as it is not the best answer. Equipment failure is also incorrect as it is not the best answer. Reference : Shon Harris AIO v3 , Chapter-3: Security Management Practices , Page : 56
What are the three FUNDAMENTAL principles of security?
Answer(s): B
The following answers are incorrect because:Accountability, confidentiality and integrity is not the correct answer as Accountability is not one of the fundamental principle of security.Integrity, availability and accountability is not the correct answer as Accountability is not one of the fundamental principle of security.Availability, accountability and confidentiality is not the correct answer as Accountability is not one of the fundamental objective of security.References : Shon Harris AIO v3 , Chapter - 3: Security Management Practices , Pages : 49-52
Within the context of the CBK, which of the following provides a MINIMUM level of security ACCEPTABLE for an environment ?
Baselines provide the minimum level of security necessary throughout the organization.Standards specify how hardware and software products should be used throughout the organization.Procedures are detailed step-by-step instruction on how to achieve certain tasks.Guidelines are recommendation actions and operational guides to personnel when a specific standard does not apply.
HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2002, chapter 3: Security Management Practices (page 94).
According to private sector data classification levels, how would salary levels and medical information be classified?
Answer(s): D
Typically there are three to four levels of information classification used by most organizations:Confidential: Information that, if released or disclosed outside of the organization, would create severe problems for the organization. For example, information that provides a competitive advantage is important to the technical or financial success (like trade secrets, intellectual property, or research designs), or protects the privacy of individuals would be considered confidential. Information may include payroll information, health records, credit information, formulas, technical designs, restricted regulatory information, senior management internal correspondence, or business strategies or plans. These may also be called top secret, privileged, personal, sensitive, or highly confidential. In other words this information is ok within a defined group in the company such as marketing or sales, but is not suited for release to anyone else in the company without permission.The following answers are incorrect:Public: Information that may be disclosed to the general public without concern for harming the company, employees, or business partners. No special protections are required, and information in this category is sometimes referred to as unclassified. For example, information that is posted to a company's public Internet site, publicly released announcements, marketing materials, cafeteria menus, and any internal documents that would not present harm to the company if they were disclosed would be classified as public. While there is little concern for confidentiality, integrity and availability should be considered.Internal Use Only: Information that could be disclosed within the company, but could harm the company if disclosed externally. Information such as customer lists, vendor pricing, organizational policies, standards and procedures, and internal organization announcements would need baseline security protections, but do not rise to the level of protection as confidential information. In other words, the information may be used freely within the company but any unapproved use outside the company can pose a chance of harm.Restricted: Information that requires the utmost protection or, if discovered by unauthorized personnel, would cause irreparable harm to the organization would have the highest level of classification. There may be very few pieces of information like this within an organization, but data classified at this level requires all the access control and protection mechanisms available to the organization. Even when information classified at this level exists, there will be few copies of it
Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition ((ISC)2 Press) (Kindle Locations 952-976). Auerbach Publications. Kindle Edition.
Post your Comments and Discuss ISC SSCP exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SSCP content, but please register or login to continue.