- (Topic 1)
Which of the following statements pertaining to access control is false?

1. A. Users should only access data on a need-to-know basis.
2. B. If access is not explicitly denied, it should be implicitly allowed.
3. C. Access rights should be granted based on the level of trust a company has on a subject.
4. D. Roles can be an efficient way to assign rights to a type of user who performs certain tasks.

Correct Answer: B
Access control mechanisms should default to no access to provide the necessary level of security and ensure that no security holes go unnoticed. If access is not explicitly allowed, it should be implicitly denied.
Source: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw- Hill/Osborne, 2002, Chapter 4: Access Control (page 143).

- (Topic 1)
Which of the following is needed for System Accountability?

1. A. Audit mechanisms.
2. B. Documented design as laid out in the Common Criteria.
3. C. Authorization.
4. D. Formal verification of system design.

Correct Answer: A
Is a means of being able to track user actions. Through the use of audit logs and other tools the user actions are recorded and can be used at a later date to verify what actions were performed.
Accountability is the ability to identify users and to be able to track user actions. The following answers are incorrect:
Documented design as laid out in the Common Criteria. Is incorrect because the Common Criteria is an international standard to evaluate trust and would not be a factor in System Accountability.
Authorization. Is incorrect because Authorization is granting access to subjects, just because you have authorization does not hold the subject accountable for their actions.
Formal verification of system design. Is incorrect because all you have done is to verify the system design and have not taken any steps toward system accountability.
References:
OIG CBK Glossary (page 778)

- (Topic 4)
Most access violations are:

1. A. Accidental
2. B. Caused by internal hackers
3. C. Caused by external hackers
4. D. Related to Internet

Correct Answer: A
The most likely source of exposure is from the uninformed, accidental or unknowing person, although the greatest impact may be from those with malicious or fraudulent intent.
Source: Information Systems Audit and Control Association, Certified Information Systems Auditor 2002 review manual, Chapter 4: Protection of Information Assets (page 192).

- (Topic 4)
Which of the following specifically addresses cyber attacks against an organization's IT systems?

1. A. Continuity of support plan
2. B. Business continuity plan
3. C. Incident response plan
4. D. Continuity of operations plan

Correct Answer: C
The incident response plan focuses on information security responses to incidents affecting systems and/or networks. It establishes procedures to address cyber attacks against an organization's IT systems. These procedures are designed to enable security personnel to identify, mitigate, and recover from malicious computer incidents, such as unauthorized access to a system or data, denial of service, or unauthorized changes to system hardware or software. The continuity of support plan is the same as an IT contingency plan. It addresses IT system disruptions and establishes procedures for recovering a major application or general support system. It is not business process focused. The business continuity plan addresses business processes and provides procedures for sustaining essential business operations while recovering from a significant disruption. The continuity of operations plan addresses the subset of an organization's missions that are deemed most critical and procedures to sustain these functions at an alternate site for up to 30 days.
Source: SWANSON, Marianne, & al., National Institute of Standards and Technology (NIST), NIST Special Publication 800-34, Contingency Planning Guide for Information Technology Systems, December 2001 (page 8).

- (Topic 4)
All of the following can be considered essential business functions that should be identified when creating a Business Impact Analysis (BIA) except one. Which of the following would not be considered an essential element of the BIA but an important TOPIC to include within the BCP plan:

1. A. IT Network Support
2. B. Accounting
3. C. Public Relations
4. D. Purchasing

Correct Answer: C
Public Relations, although important to a company, is not listed as an essential business function that should be identified and have loss criteria developed for.
All other entries are considered essential and should be identified and have loss criteria developed.
Source: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw- Hill/Osborne, 2002, chapter 9: Disaster Recovery and Business continuity (page 598).