Instant Access ISC.SSCP.v2022-06-29.q999 Actual Practice Test Engine for Free (Page 31)

Question 147

What is the main purpose of Corporate Security Policy?

A.To transfer the responsibility for the information security to all users of the organization
B.To communicate management's intentions in regards to information security
C.To provide detailed steps for performing specific actions
D.To provide a common framework for all development activities

Correct Answer: B

Section: Security Operation Adimnistration
Explanation/Reference:
A Corporate Security Policy is a high level document that indicates what are management`s intentions in regard to Information Security within the organization. It is high level in purpose, it does not give you details about specific products that would be use, specific steps, etc..
The organization's requirements for access control should be defined and documented in its security policies.
Access rules and rights for each user or group of users should be clearly stated in an access policy statement.
The access control policy should minimally consider:
Statements of general security principles and their applicability to the organization Security requirements of individual enterprise applications, systems, and services Consistency between the access control and information classification policies of different systems and networks Contractual obligations or regulatory compliance regarding protection of assets Standards defining user access profiles for organizational roles Details regarding the management of the access control system As a Certified Information System Security Professional (CISSP) you would be involved directly in the drafting and coordination of security policies, standards and supporting guidelines, procedures, and baselines.
Guidance provided by the CISSP for technical security issues, and emerging threats are considered for the adoption of new policies. Activities such as interpretation of government regulations and industry trends and analysis of vendor solutions to include in the security architecture that advances the security of the organization are performed by the CISSP as well.
The following are incorrect answers:
To transfer the responsibility for the information security to all users of the organization is bogus. You CANNOT transfer responsibility, you can only tranfer authority. Responsibility will also sit with upper management. The keyworks ALL and USERS is also an indication that it is the wrong choice.
To provide detailed steps for performing specific actions is also a bogus detractor. A step by step document is referred to as a procedure. It details how to accomplish a specific task.
To provide a common framework for all development activities is also an invalid choice. Security Policies are not restricted only to development activities.
Reference Used for this question:
Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition ((ISC)2 Press) (Kindle Locations 1551-1565). Auerbach Publications. Kindle Edition.
and
Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition ((ISC)2 Press) (Kindle Locations 9109-9112). Auerbach Publications. Kindle Edition.

Question 148

Which of following is not a service provided by AAA servers (Radius, TACACS and DIAMETER)?

A.Authentication
B.Administration
C.Accounting
D.Authorization

Question 149

Which of the following is considered the weakest link in a security system?

A.People
B.Software
C.Communications
D.Hardware

Question 150

Guards are appropriate whenever the function required by the security program involves which of the following?

A.The use of discriminating judgment
B.The use of physical force
C.The operation of access control devices
D.The need to detect unauthorized access

Question 151

Layer 4 in the DoD model overlaps with which layer(s) of the OSI model?

A.Layers 5, 6, & 7 - Session, Presentation, and Application Layers
B.Layers 2, 3, & 4 - Data Link, Network, and Transport Layers
C.Layer 7 - Application Layer
D.Layer 3 - Network Layer

Question 147

Question 148

Question 149

Question 150

Question 151

Download PDF File