Cybersecurity Management I - Strategic - C727 SOB, Exam Questions and answers, Rated A+

Cybersecurity Management I - Strategic - C727 SOB, Exam Questions and answers, Rated A+ ______________are primarily intended to: ensure that no unauthorized access to information is permitted and that accidental disclosure of sensitive information is not possible. Common confidentiality controls are user IDs and passwords - -Confidentiality models ___________have three goals: Prevent unauthorized users from making modifications to data or programs Prevent authorized users from making improper or unauthorized modifications Maintain internal and external consistency of data and programs - -Integrity models __________keep data and resources available for authorized use, especially during emergencies or disasters. - -Availability models ... ___________ role is assigned to the person who is ultimately responsible for the security maintained by an organization and who should be most concerned about the protection of its assets. The senior manager must sign off on all policy issues. In fact, all activities must be approved by and signed off on by the senior manager before they can be carried out. There is no effective security policy if the senior manager does not authorize and support it. The senior manager's endorsement of the security policy indicates the accepted ownership of the implemented security within the organization. The senior manager is the person who will be held liable for the overall success or failure of a security solution and is responsible for exercising due care and due diligence in establishing security for an organization. - -Senior Manager: The organizational owner (senior manager) __________are ultimately responsible for security, they rarely implement security solutions. In most cases, that responsibility is delegated to security professionals within the organization. - -o Even though senior managers _____________is assigned to a trained and experienced network, systems, and security engineer who is responsible for following the directives mandated by senior management. The security professional has the functional responsibility for security, including writing the security policy and implementing it. The role of security professional can be labeled as an IS/IT function role. The security professional role is often filled by a team that is responsible for designing and implementing security solutions based on the approved security policy. Security professionals are not decision makers; they are implementers. All decisions must be left to the senior manager. - -o Security Professional: The security professional, information security (InfoSec) officer, or computer incident response team (CIRT) role _______________ is assigned to the person who is responsible for classifying information for placement and protection within the security solution. The data owner is typically a high-level manager who is ultimately responsible for data protection. However, the data owner usually delegates the responsibility of the actual data management tasks to a data custodian. - -o Data Owner: The data owner role __________is assigned to the user who is responsible for the tasks of implementing the prescribed protection defined by the security policy and senior management. The data custodian performs all activities necessary to provide adequate protection for the CIA Triad (confidentiality, integrity, and availability) of data and to fulfill the requirements and responsibilities delegated from upper management. These activities can include performing and testing backups, validating data integrity, deploying security solutions, and managing data storage based on classification. - -o Data Custodian: The data custodian role ________________ responsible for reviewing and verifying that the security policy is properly implemented and the derived security solutions are adequate. The auditor role may be assigned to a security professional or a trained user. The auditor produces compliance and effectiveness reports that are reviewed by the senior manager. Issues discovered through these reports are transformed into new directives assigned by the senior manager to security professionals or data custodians. However, the auditor is listed as the final role because the auditor needs a source of activity (that is, users or operators working in an environment) to audit or monitor. - -o Auditor: An auditor is _________ is a way to implement something right away in order to perform mitigation procedures. - -o Due care ____________ is making sure the right thing was done correctly, and if it is necessary to do it again or if further research is required. Due care is doing the right thing, the prudent man rule - -o Due diligence _________A level of quality or attainment or a required or agreed level of quality or attainment; formally, the most commonly agreed standard by accredited technical bodies for risk management representing nations, that is, ISO 31000:2009, Risk management—Principles and guidelines - -Standards: