ISO-IEC-LI Online Training Archives

Page 1 of 1

1. What is the most important reason for applying the segregation of duties?

Segregation of duties makes it clear who is responsible for what.

Segregation of duties ensures that, when a person is absent, it can be investigated whether he or she has been committing fraud.

Tasks and responsibilities must be separated in order to minimize the opportunities for business assets to be misused or changed, whether the change be unauthorized or unintentional.

Segregation of duties makes it easier for a person who is ready with his or her part of the work to take time off or to take over the work of another person.

2. Why is compliance important for the reliability of the information?

Compliance is another word for reliability. So, if a company indicates that it is compliant, it means that the information is managed properly.

By meeting the legislative requirements and the regulations of both the government and internal management, an organization shows that it manages its information in a sound manner.

When an organization employs a standard such as the ISO/IEC 27002 and uses it everywhere, it is compliant and therefore it guarantees the reliability of its information.

When an organization is compliant, it meets the requirements of privacy legislation and, in doing so, protects the reliability of its information.

3. What is the best way to comply with legislation and regulations for personal data protection?

Performing a threat analysis

Maintaining an incident register

Performing a vulnerability analysis

Appointing the responsibility to someone

4. What is an example of a non-human threat to the physical environment?

Fraudulent transaction

Corrupted file

Storm

Virus

5. Who is accountable to classify information assets?

the CEO

the CISO

the Information Security Team

the asset owner

6. A company moves into a new building. A few weeks after the move, a visitor appears unannounced in the office of the director. An investigation shows that visitors passes grant the same access as the passes of the company's staff .

Which kind of security measure could have prevented this?

physical security measure

An organizational security measure

A technical security measure

7. ISO 27002 provides guidance in the following area

PCI environment scoping

Information handling recommendations

Framework for an overall security and compliance program

Detailed lists of required policies and procedures

8. Which is a legislative or regulatory act related to information security that can be imposed upon all organizations?

ISO/IEC 27001:2005

Intellectual Property Rights

ISO/IEC 27002:2005

Personal data protection legislation

9. Which of these reliability aspects is "completeness" a part of?

Availability

Exclusivity

Integrity

Confidentiality

10. Which of the following measures is a preventive measure?

Installing a logging system that enables changes in a system to be recognized

Shutting down all internet traffic after a hacker has gained access to the company systems

Putting sensitive information in a safe

Classifying a risk as acceptable because the cost of addressing the threat is higher than the value of the information at risk