Managing security operations | 410 | Indiana University-Purdue University at Indianapolis

Answer the following 12 questions by selecting the single BEST answer for each. Using your course materials and/or other credible resources, provide a 50–100-word explanation on why you chose your answer. Please cite your sources for your answers from your course materials or other credible resources.

1. You must provide SOC 2 and SOC 3 reports on the security, availability, confidentiality, processing integrity, and privacy of operational controls. As part of these reports, you must provide information regarding the disclosure of data to third parties. To which tenet of SOC 2 and SOC 3 does this information apply?

A. Privacy
B. Security
C. Confidentiality

2. You must provide SOC 2 and SOC 3 reports on the security, availability, confidentiality, processing integrity, and privacy of operational controls. As part of these reports, you must provide information regarding the backup and restoration of data. To which tenet of SOC 2 and SOC 3 does this information apply?

A. Privacy
B. Availability
C. Security

3. As part of routine maintenance, your organization requires that system administrators perform a routine access review and audit. As part of this process, you decide to audit user access to files and folders. Which Windows audit policy should you enable?

A. Object access
B. Logon events
C. Account logon events
D. Directory service access

4. You have received a list of users and their jobs. You need to implement the principle of least privilege. What is the next step that should be performed?

A. Determine the minimum set of privileges needed to perform the user’s job.
B. Determine the maximum set of privileges needed to perform the user’s job.
C. Configure the appropriate privileges for the user’s account.

5. Which statement best describes a two-man control?

A. Two operators work together to complete a given task.
B. Two operators review and approve each other’s work.
C. An operator handles more than one position within an organization.

6. Which type of security identifies the process of safeguarding information assets after the implementation of security?

A. Physical security
B. Operations security
C. Application security

7. Several users in your organization have administrative-level user accounts. During a recent security audit, the auditors suggest that new user accounts be created for these users to grant the users the minimum permissions that they need to carry out their daily tasks. The users should only use their administrative-level accounts when performing administrative-level tasks. Which operations security principle is being implemented?

A. Separation of duties
B. Least privilege
C. Job rotation

8. As an organization’s security administrator, you must prevent conflicts of interest when assigning personnel to complete certain security tasks. Which operations security tenet are you implementing?

A. Separation of duties
B. Due diligence
C. Due care

9. Which of the following is MOST important to the success of an information security program?

A. Senior management sponsorship
B. Security awareness training
C. Adequate start-up budget and staffing

10. What is the BEST defense against a structured query language injection attack?

A. Regularly updated signature files
B. Strict controls on input fields
C. A properly configured firewall

11. Which of the following is the MOST important consideration when implementing an intrusion detection system?

A. Patching
B. Tuning
C. Encryption

12. Which of the following is the MOST important consideration when securing customer credit card data acquired by a point-of-sale cash register?

A. Authentication
B. Hardening
C. Encryption