507 CITI Basics Of Information Security, Part 1 & 2

c) The greater the sensitivity and quantity of the data at issue, the more carefully the balance among these three must be evaluated

Explanation: The correct answer is c. The balance among prevention, detection, and response must be carefully evaluated based on the sensitivity and quantity of data at issue. Organizations have discretion in deciding their levels of security practice.

c) Using voicemail systems and answering machines that do not require a password or PIN for access.

Explanation: c) Using voicemail systems and answering machines that do not require a password or PIN for access.This is not generally a good practice for telephone use because it means that anyone who has access to the voicemail or answering machine can listen to the messages left on it. This could include sensitive information that should not be accessible to just anyone.

c) Measures including device data encryption, anti-malware software, and communications encryption.

Explanation: The technical safeguards described in the question would be considered a combination of physical, technical, and administrative safeguards. These measures would include device data encryption, anti-malware software, and communications encryption.

e) All of the above

Explanation: The correct answer is e) All of the above.The letters "CIA" in information security's context stand for confidentiality, integrity, and availability. All three of these concepts are important goals of information security.Confidentiality refers to limiting data access to appropriate persons for appropriate purposes. This ensures that sensitive information is not seen or used by unauthorized individuals.Integrity refers to the accuracy of the data for its intended use. This means that data cannot be altered without authorization, and that it is accurate and consistent.Availability refers to the ability of legitimate users to access their data when needed. This ensures that data is available when it is needed, and that users have the appropriate level of access to it.

c) To preserve good customer relations, visitors are generally allowed access to all areas of a facility unless it appears they are doing something suspicious.

Explanation: c) To preserve good customer relations, visitors are generally allowed access to all areas of a facility unless it appears they are doing something suspicious.This is not a good practice for physical security because it allows potential intruders access to the facility. It is better to have strict access controls in place so that only authorized personnel are allowed in sensitive areas.

a) Trying to ensure physical security, particularly for highly portable devices that are always on hand (like a smartphone).

Explanation: The best security practice for portable devices is to ensure physical security, particularly for highly portable devices that are always on hand (like a smartphone). This means keeping the device in a secure location when not in use, and using a security measure like a password or biometric authentication to prevent unauthorized access. Additionally, it is important to avoid storing sensitive information on portable devices, and to disable any remote-locate, remote-shutdown, and remote-erase capabilities to avoid accidental data loss.

a) Exercising care with every email message received, especially email containing file attachments that may be infected

Explanation: The best security practice for email is to exercise care with every email message received, especially email containing file attachments that may be infected. Accessing links in all emails regardless of the source to make sure important information is not missed is also a good practice. However, sending sensitive information in email messages or in attachments to such messages, as long as a legally binding confidentiality notice is included, is not a good practice.

d) All of the above

Explanation: All of the above are important for protecting computing devices and systems. Administrative safeguards help to ensure that only authorized users have access to systems and data, while technical safeguards help to protect data and systems from unauthorized access or modification. Physical safeguards help to protect against physical damage or theft of devices and systems.

a) Picking strong passwords and protecting them appropriately.

Explanation: The best practice for controlling computer access is to have each user login with their own unique ID and password. This way, if one user's password is compromised, the others will still be safe. Additionally, it is important to make sure that passwords are strong and are not stored in an unlocked location.

e) All of the above

Explanation: All of the above are good practices to avoid social engineering attacks.