QUESTION: 137

Which of the following sections come under the ISO/IEC 27002 standard?

Security policy
Asset management
Financial assessment
Risk assessment

Answer(s): A,B,D

Explanation:

ISO/IEC 27002 is an information security standard published by the International Organization for Standardization (ISO) and by the International Electrotechnical Commission (IEC) as ISO/IEC 17799:2005. This standard contains the following twelve main sections: 1.Risk assessment: It refers to assessment of risk. 2.Security policy: It deals with the security management. 3.Organization of information security: It deals with governance of information security. 4.Asset management: It refers to inventory and classification of information assets. 5.Human resources security: It deals with security aspects for employees joining, moving and leaving an organization. 6.Physical and environmental security: It is related to protection of the computer facilities. 7.Communications and operations management: It is the management of technical security controls in systems and networks. 8.Access control: It deals with the restriction of access rights to networks, systems, applications, functions and data. 9.Information systems acquisition, development and maintenance: It refers to build security into applications. 10.Information security incident management: It refers to anticipate and respond appropriately to information security breaches. 11.Business continuity management: It deals with protecting, maintaining and recovering business-critical processes and systems.
12.Compliance: It is used for ensuring conformance with information security policies, standards, laws and regulations. Answer C is incorrect. Financial assessment does not come under the ISO/IEC 27002 standard.

Reveal Solution Next Question

QUESTION: 138

Which of the following statements about the authentication concept of information security management is true?

It establishes the users' identity and ensures that the users are who they say they are.
It ensures the reliable and timely access to resources.
It determines the actions and behaviors of a single individual within a system, and identifies that particular individual.
It ensures that modifications are not made to data by unauthorized personnel or processes.

Answer(s): A

Explanation:

The concept of authentication establishes the users' identity and ensures that the users are who they say they are. Answer B is incorrect. The concept of availability ensures the reliable and timely access to data or resources. Answer D is incorrect. The concept of integrity ensures that modifications are not made to data by unauthorized personnel or processes. Answer C is incorrect. The concept of accountability determines the actions and behaviors of a single individual within a system, and identifies that particular individual.

Reveal Solution Next Question

QUESTION: 139

Billy is the project manager of the HAR Project and is in month six of the project. The project is scheduled to last for 18 months. Management asks Billy how often the project team is participating in risk reassessment in this project. What should Billy tell management if he's following the best practices for risk management?

Project risk management happens at every milestone.
Project risk management has been concluded with the project planning.
Project risk management is scheduled for every month in the 18-month project.
At every status meeting the project team project risk management is an agenda item.

Answer(s): D

Explanation:

Risk management is an ongoing project activity. It should be an agenda item at every project status meeting. Answer A is incorrect. Milestones are good times to do reviews, but risk management should happen frequently. Answer C is incorrect. This answer would only be correct if the project has a status meeting just once per month in the project. Answer B is incorrect. Risk management happens throughout the project as does project planning.

Reveal Solution Next Question

QUESTION: 140

You work as a security manager for BlueWell Inc. You are going through the NIST SP 800-37 C&A methodology, which is based on four well defined phases. In which of the following phases of NIST SP 800-37 C&A methodology does the security categorization occur?

Security Accreditation
Security Certification
Continuous Monitoring
Initiation

Answer(s): D

Explanation:

The various phases of NIST SP 800-37 C&A are as follows: Phase 1: Initiation- This phase includes preparation, notification and resource identification. It performs the security plan analysis, update, and acceptance. Phase 2: Security Certification- The Security certification phase evaluates the controls and documentation. Phase 3: Security Accreditation- The security accreditation phase examines the residual risk for acceptability, and prepares the final security accreditation package. Phase 4: Continuous Monitoring-This phase monitors the configuration management and control, ongoing security control verification, and status reporting and documentation.

Reveal Solution Next Question

Free CSSLP Exam Braindumps (page: 34)

QUESTION: 137

Explanation:

QUESTION: 138

Explanation:

QUESTION: 139

Explanation:

QUESTION: 140

Explanation: