IT410M3-3: Examine foundational security operations concepts.
Learn
Read Chapter 16, “Managing Security Operations,” pp. 697–735, in CISSP (ISC)2 Certified Information Systems Security Professional Official Study Guide.
Chapter 16 explains the several basic security principles that are at the core of security operations in any environment. These include need to know, least privilege, separation of duties, job rotation and mandatory vacations. When combined, these practice help prevent security incidents from occurring or line the scope of the incidents that do occur.
Review Chapter 9, “Security Operations,” in CISSP For Dummies.
Chapter 9 takes a look at a number of security controls related to assessment and testing.
Purpose
This Assessment tests your knowledge and powers of deduction in determining the best answer about fundamental security concepts. At least 90% of the answers can be found in your course readings for this module.
This Assessment will help you to better understand how basic security practices help prevent security incidents from occurring and limits the scope of incidents that do occur.
Instructions
Part 1: Managing Security Operations
Section 1: Using Credible Sources, Justify Your Answers to Questions
Answer the following 12 questions by selecting the single BEST answer for each. Using your course materials and/or other credible resources, provide a 50–100-word explanation on why you chose your answer. Please cite your sources for your answers from your course materials or other credible resources.
1. You must provide SOC 2 and SOC 3 reports on the security, availability, confidentiality, processing integrity, and privacy of operational controls. As part of these reports, you must provide information regarding the disclosure of data to third parties. To which tenet of SOC 2 and SOC 3 does this information apply?
A. Privacy
B. Security
C. Confidentiality
Explanation:
2. You must provide SOC 2 and SOC 3 reports on the security, availability, confidentiality, processing integrity, and privacy of operational controls. As part of these reports, you must provide information regarding the backup and restoration of data. To which tenet of SOC 2 and SOC 3 does this information apply?
A. Privacy
B. Availability
C. Security
Explanation:
3. As part of routine maintenance, your organization requires that system administrators perform a routine access review and audit. As part of this process, you decide to audit user access to files and folders. Which Windows audit policy should you enable?
A. Object access
B. Logon events
C. Account logon events
D. Directory service access
Explanation:
4. You have received a list of users and their jobs. You need to implement the principle of least privilege. What is the next step that should be performed?
A. Determine the minimum set of privileges needed to perform the user’s job.
B. Determine the maximum set of privileges needed to perform the user’s job.
C. Configure the appropriate privileges for the user’s account.
Explanation:
5. Which statement best describes a two-man control?
A. Two operators work together to complete a given task.
B. Two operators review and approve each other’s work.
C. An operator handles more than one position within an organization.
Explanation:
6. Which type of security identifies the process of safeguarding information assets after the implementation of security?
A. Physical security
B. Operations security
C. Application security
Explanation:
7. Several users in your organization have administrative-level user accounts. During a recent security audit, the auditors suggest that new user accounts be created for these users to grant the users the minimum permissions that they need to carry out their daily tasks. The users should only use their administrative-level accounts when performing administrative-level tasks. Which operations security principle is being implemented?
A. Separation of duties
B. Least privilege
C. Job rotation
Explanation:
8. As an organization’s security administrator, you must prevent conflicts of interest when assigning personnel to complete certain security tasks. Which operations security tenet are you implementing?
A. Separation of duties
B. Due diligence
C. Due care
Explanation:
9. Which of the following is MOST important to the success of an information security program?
A. Senior management sponsorship
B. Security awareness training
C. Adequate start-up budget and staffing
Explanation:
10. What is the BEST defense against a structured query language injection attack?
A. Regularly updated signature files
B. Strict controls on input fields
C. A properly configured firewall
Explanation:
11. Which of the following is the MOST important consideration when implementing an intrusion detection system?
A. Patching
B. Tuning
C. Encryption
Explanation:
12. Which of the following is the MOST important consideration when securing customer credit card data acquired by a point-of-sale cash register?
A. Authentication
B. Hardening
C. Encryption
Explanation:
Part 2: Maintaining Security Operations
Section 1: Using Credible Sources, Justify Your Answers to Questions
Answer the following 12 questions by selecting the single BEST answer for each. Using your course materials and/or other credible resources, provide a 50–100-word explanation on why you chose your answer. Please cite your sources for your answers from your course materials or other credible resources.
1. Company management has decided to implement group policies to ensure that the company’s security policies are enforced across the organization. You must develop the appropriate group policies for your company. Which entities can you manage with these new policies?
a. users
b. client computers
c. server computers
d. domain controllers
A. option a
B. option b
C. option c
D. option d
E. options a and d
F. options b, c, and d
G. all of the options
Explanation:
2. At which point should a configuration change be added to the change log?
A. After the change is requested
B. After the change is tested
C. After the change is approved
Explanation:
3. What is the first step of the equipment life cycle?
A. Management
B. Procurement and Deployment
C. Assessment
Explanation:
4. According to your organization’s data backup policy, you must keep track of the number and location of backup versions of the organization’s data. What is the main purpose of this activity?
A. To restrict access to the backup versions
B. To create an audit trail
C. To ensure proper disposal of information
Explanation:
5. As a member of your organization’s security team, you are examining all aspects of operations security for your network. You must determine the countermeasures that can be used in operations security. You have already examined the resources and information that must be protected. What is the third asset type that must be examined?
A. Personnel
B. Network media
C. Hardware
Explanation:
6. Which device lock prevents access to hard drives or unused ports in a computer?
A. Switch control
B. Slot lock
C. Port control
Explanation:
7. Your organization is concerned with unauthorized users downloading confidential data to removable media. You decide to encrypt the company’s confidential data using the operating system’s encryption feature. What does this ensure?
A. The data is protected wherever it resides.
B. The data is protected while it is on the original media and removable media.
C. The data is protected while it is on the original media only.
Explanation:
8. Which option will have the least effect on the confidentiality, integrity, and availability of the resources within the organization?
A. Stolen computer
B. Lost keys to the door
C. Damaged hard drive
Explanation:
9. Which of the following BEST ensures that modifications made to in house developed business applications do not introduce security exposures?
A. Change management
B. Stress testing
C. Security baselines
Explanation:
10. What is the advantage of virtual private network tunneling for remote users?
A. It increases security between multi-tier systems
B. It helps ensure that communications are secure
C. It allows passwords to be changed or less frequently
Explanation:
11. Which of the following is MOST effective in protecting against the attack technique known as phishing?
A. Firewall blocking rules
B. Security awareness training
C. Intrusion detection system monitoring
Explanation:
12. Which of the following is the MOST important risk associated with middleware in a client server environment?
A. Server patching may be prevented
B. System backups may be incomplete
C. Data integrity may be affected
Explanation:
Minimum Submission Requirements
If work submitted for this competency assessment does not meet the minimum submission requirements, it will be returned without being scored.
Plagiarism
Plagiarism is an act of academic dishonesty. It violates the University Honor Code, and the offense is subject to disciplinary action. You are expected to be the sole author of your work. Use of another person’s work or ideas must be accompanied by specific citations and references. Whether the action is intentional or not, it still constitutes plagiarism.
Try it now!
How it works?
Follow these simple steps to get your paper done
Place your order
Fill in the order form and provide all details of your assignment.
Proceed with the payment
Choose the payment system that suits you most.
Receive the final file
Once your paper is ready, we will email it to you.
Our Services
Ace Writing Center has stood as the world’s leading custom essay writing services providers. Once you enter all the details in the order form under the place order button, the rest is up to us.
Essays
At Ace Writing Center, Nowadays, students normally have extremely busy schedules. You will note that some of them have to take on some evening or weekend jobs in order to get some income that can help them to sustain in college or in the university. This can deny them a chance to write all the essays given. Others usually get bombarded with a lot of work by their lecturers. This can still delay such students from working on all their essays. However, some of them usually try to work on all these essays but end up delivering their work late. This can prevent them from graduating since most lecturers are strict on deadlines. If you want to write a business essay, the wise way is to hire an outstanding essay writing service like us, so that you can get the best results. If you are keen, you will note that many companies usually overcharge their customers. Some of them are there only to make money. And in reality, they really don’t care to build a long term commitment with students. You should not choose such companies. You should take your time and choose a reliable company to work with. Ace Writing Center is the ultimate solution for you. We have been offering our writing service for more than 7 years. This is a clear indication that you will get quality essay writing service. We have a wide range of writers who can work on any business essay that you might have. We believe in doing extensive research so that we can provide quality work to all our clients. .
Admissions
Admission and Business Papers
Have you ever had to write an admission essay for college? The majority of students face the same issues when applying to a university or college and many in such situations decide they need professional help to cope with this matter. They get in a situation when the deadline keeps coming closer but lack motivation to start because they are just not sure if their writing skills are strong enough. We have a solution for you! Ace Writing Center is the best admission essay writing service with a large professional team and years of experience in providing high-quality papers to students of all levels and faculties. The mission of our team is to help students make their dreams of entering a good college come true and that’s what we offer!.
Editing
Editing and Proofreading
Sometimes all the words for your paper just flow out of your mind and into your fingers. You type quickly at your keyboard and there they are, your beautiful words right there on the screen. But you have no idea how to polish it up. You may be wishing there was a paper writing service that offered this type of writing service. Look no more! Here at Ace Writing Center, we offer you an editing and proofreading option that you can't find anywhere else..
Coursework
College Essay Writing
In case you are familiar Ace Writing Center, you know the way to distinguish a better company from a cheap one exactly. First of all, poor service website does not have a sufficient support. We think support team is an essential part of success; it has to answer all clients’ questions and be a connecting link between clients and their writers. On our web-service you will get answers about anything you need and your writer will receive all your instructions, assignments and requirements exactly and swiftly. A writing service that we run has got a flexible pricing system that will save you from senseless wastes and many bonus systems that let you sparing money for something important for you.
