The preliminary steps to security planning include all of the following EXCEPT which of the following?
Answer(s): C
The keyword within the question is: preliminaryThis means that you are starting your effort, you cannot audit if your infrastructure is not even in place.
TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation.
Step-by-step instructions used to satisfy control requirements is called a:
Answer(s): D
One purpose of a security awareness program is to modify:
Answer(s): A
security awareness training is to modify employees behaviour and attitude towards towards enterprise's security posture.Security-awareness training is performed to modify employees' behavior and attitude toward security. This can best be achieved through a formalized process of security-awareness training.It is used to increase the overall awareness of security throughout the company. It is targeted to every single employee and not only to one group of users.Unfortunately you cannot apply a patch to a human being, the only thing you can do is to educate employees and make them more aware of security issues and threats. Never underestimate human stupidity.
TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation.also see:Harris, Shon (2012-10-18). CISSP All-in-One Exam Guide, 6th Edition (p. 130). McGraw-Hill.Kindle Edition.
Whose role is it to assign classification level to information?
The Data/Information Owner is ultimately responsible for the protection of the data. It is the Data/Information Owner that decides upon the classifications of that data they are responsible for.The data owner decides upon the classification of the data he is responsible for and alters that classification if the business need arises.The following answers are incorrect:Security Administrator. Is incorrect because this individual is responsible for ensuring that the access right granted are correct and support the polices and directives that the Data/Information Owner defines.User. Is Incorrect because the user uses/access the data according to how the Data/Information Owner defined their access.Auditor. Is incorrect because the Auditor is responsible for ensuring that the access levels are appropriate. The Auditor would verify that the Owner classified the data properly.
CISSP All In One Third Edition, Shon Harris, Page 121
Which of the following security controls might force an operator into collusion with personnel assigned organizationally within a different function in order to gain access to unauthorized data?
The questions specifically said: "within a different function" which eliminate Job Rotation as a choice.Management monitoring of audit logs is a detective control and it would not prevent collusion. Changing passwords regularly would not prevent such attack.This question validates if you understand the concept of separation of duties and least privilege. By having operators that have only the minimum access level they need and only what they need to do their duties within a company, the operations personnel would be force to use collusion to defeat those security mechanism.
Post your Comments and Discuss ISC SSCP exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SSCP content, but please register or login to continue.