Information Security & Data Privacy Quiz

What should be included in an Organization’s Information Security Policy? (Choose Two)

For which tasks is an Information Security Officer typically responsible? (Choose Two)

What core criteria do you need to take into account when determining an IT system’s availability requirements?

What procedures should you follow to determine how well a group of clients are protected during an IT Audit review?

When should you assess a security requirement of a given IT Asset as Compliant ✅ during an IT Audit review? (Choose Two)

What should you evaluate when assessing risk? (Choose Two)

What are some of the ways risks can be transferred?

What reason(s) may justify accepting a high level of risk? (Choose Two)

As an Information Security Officer, what should you do if your organization’s executives are not willing to provide the resources required to implement a given security control? (Choose Two)

Why should you review your security controls on a regular basis?

What should always be established before a key control related to Information Security is introduced? (Choose Two)

Drag and map the definitions to the appropriate description

An auditor reviews a Web Server and discovers important security updates haven’t been installed. What has the Auditor identified?

The goals of Information Security and Data Privacy are the same?

Drag and map the definitions to their appropriate description

Drag and map the Business Continuity strategies to their most appropriate description

Map the security threats to their appropriate description

Which phase within a Software Security Development Lifecycle (SDLC) is most effective to perform Threat Modeling?

A malicious user who may be able to impersonate the identity of a valid user for an application is an example of which STRIDE threat?

Drag and map the STRIDE threat properties to their appropriate description