Podcast
Questions and Answers
What is the primary purpose of software license management?
What is the primary purpose of software license management?
- To create software licenses for developers
- To eliminate duplicate or overlapping licenses (correct)
- To ensure all software is available for download
- To allow unlimited use of software across all devices
What does 'data in motion' refer to?
What does 'data in motion' refer to?
- Data stored in the cloud or a private server
- Data that has been archived for long-term storage
- Data being transferred across networks or devices (correct)
- Data saved on a hard drive without active access
Which of the following is NOT a phase in the information lifecycle as defined by ISO 27002?
Which of the following is NOT a phase in the information lifecycle as defined by ISO 27002?
- Analysis (correct)
- Creation
- Retention
- Processing
What challenge is associated with data storage on physical media?
What challenge is associated with data storage on physical media?
What does the retention phase in some models of the information lifecycle signify?
What does the retention phase in some models of the information lifecycle signify?
What is one of the responsibilities of software inventory management?
What is one of the responsibilities of software inventory management?
Which phase immediately precedes the deletion/destruction phase in the information lifecycle?
Which phase immediately precedes the deletion/destruction phase in the information lifecycle?
What type of data is referred to as being 'at rest'?
What type of data is referred to as being 'at rest'?
What is a recommended practice for media that is no longer needed?
What is a recommended practice for media that is no longer needed?
Which of the following should NOT be included in the documentation requirements for transporting media?
Which of the following should NOT be included in the documentation requirements for transporting media?
What should staff or couriers understand regarding the transport of media?
What should staff or couriers understand regarding the transport of media?
When transporting media, what must be considered about encryption?
When transporting media, what must be considered about encryption?
What role do appointed custodians play in media transport?
What role do appointed custodians play in media transport?
What is the consequence of storing unnecessary data on media?
What is the consequence of storing unnecessary data on media?
What procedure should be followed regarding media transport accountability?
What procedure should be followed regarding media transport accountability?
How should responsibilities of custodians be managed during transport?
How should responsibilities of custodians be managed during transport?
Why is it important for an organization to have a retention strategy for sensitive information?
Why is it important for an organization to have a retention strategy for sensitive information?
What type of security control includes procedures like inspecting a perimeter fence?
What type of security control includes procedures like inspecting a perimeter fence?
Which of the following is an example of a technical or logical control?
Which of the following is an example of a technical or logical control?
What should an organization do if its information disposal processes do not match retention requirements?
What should an organization do if its information disposal processes do not match retention requirements?
Which of the following describes group policy objects (GPOs) in Windows-based systems?
Which of the following describes group policy objects (GPOs) in Windows-based systems?
What is the primary purpose of risk mitigation controls in information security?
What is the primary purpose of risk mitigation controls in information security?
What action is part of implementing physical security controls?
What action is part of implementing physical security controls?
Which of the following best characterizes the relationship between security controls?
Which of the following best characterizes the relationship between security controls?
What is a key reason mature organizations review their policies?
What is a key reason mature organizations review their policies?
Who typically needs to consider changes in policies due to external factors?
Who typically needs to consider changes in policies due to external factors?
What differentiates a policy from a sub-policy?
What differentiates a policy from a sub-policy?
Which of the following would likely be of primary interest to management?
Which of the following would likely be of primary interest to management?
What challenge does the diverse use of the term 'policy' present in organizations?
What challenge does the diverse use of the term 'policy' present in organizations?
What aspect of organizational governance may lead to more frequent policy changes?
What aspect of organizational governance may lead to more frequent policy changes?
How should the use of the term 'policy' be interpreted in the context of security practice?
How should the use of the term 'policy' be interpreted in the context of security practice?
Which factor may disrupt the understanding of information security practices internationally?
Which factor may disrupt the understanding of information security practices internationally?
What is the purpose of a configuration management plan?
What is the purpose of a configuration management plan?
What is a configuration item (CI)?
What is a configuration item (CI)?
Who manages the configuration management plan within an organization?
Who manages the configuration management plan within an organization?
Which of the following best describes a baseline configuration?
Which of the following best describes a baseline configuration?
What is one of the primary roles of the change control board (CCB)?
What is one of the primary roles of the change control board (CCB)?
Why is record-keeping essential in a configuration management and change control system?
Why is record-keeping essential in a configuration management and change control system?
In the context of configuration management, what is the role of a stakeholder in the CCB?
In the context of configuration management, what is the role of a stakeholder in the CCB?
What could happen if a backup image does not match the known configuration baseline?
What could happen if a backup image does not match the known configuration baseline?
Flashcards are hidden until you start studying
Study Notes
Software Licensing and Data Storage
- Software license tools can often save money by detecting and eliminating duplicate licenses.
- Data is either being used, in motion, or stored.
- Data in motion refers to the transfer of data across networks, communications links, or to and from storage devices.
- Data at rest is data stored in endpoint devices, removable media, and storage subsystems.
- Data storage on paper, removable storage media, and devices needs to be secured when in transit.
Information Lifecycle
- ISO 27002 defines the information lifecycle in five phases: creation, processing, storage, transmission, and deletion/destruction.
- Security controls are categorized as physical, technical (or logical), and administrative elements.
- Physical controls include physical barriers, security patrols, and maintenance.
- Technical controls are software and data settings that govern how systems behave.
- Administrative controls are policies and procedures that define how systems are managed.
Security Policy and Compliance
- Security policies are written statements of security rules, objectives, and strategies.
- Policy review processes should address the changing needs of external stakeholders.
- Subpolicies amplify higher-level policies and provide more specific instructions.
- A challenge for the information security community is the lack of a common language.
Data Storage and Disposal
- Organizations should have a defined set of procedures for securing and transporting media outside of controlled areas.
- Media transport procedures should include transportation methods, routes, and handling considerations.
- Every category of corporate or private-sector sensitive information should have a retention strategy defined.
- Media disposal and information retention plans must match to ensure compliance.
Configuration Management and Change Control
- A configuration management (CM) plan defines how an organization manages the configuration of its hardware and software assets.
- A configuration control board (CCB) manages the CM plan and approves changes.
- A configuration item (CI) is a single, discreet component of an IT system that has configurable settings.
- A baseline configuration is a defined set of configurations for a CI that has been formally reviewed and approved.
Studying That Suits You
Use AI to generate personalized quizzes and flashcards to suit your learning preferences.
