COMPUTER CONTROL AUDITING AND SECURITY > TAKE ASSESSMENT: TEST 6 TOPIC 6

Question 1
	Which below are indirect threats posed by fire? (13.2)
	A. Heat B. Release of toxic fumes C. Water damage from fire suppression D. Smoke damage E. Fire itself F. All of the above G. Only A, B, C and D above

The direct threat is the damage caused by the fire itself. The indirect threats are from heat, release of toxic fumes, water damage from fire suppression, and smoke damage.

Question 2
	TRUE OR FALSE - An overflowing of water into a data center can cause direct damage to all or part of the information system. (13.6)
	True False

Prevention and mitigation measures for water threats must encompass the range of such threats. For plumbing leaks, the cost of relocating threatening lines is generally difficult to justify. With knowledge of the exact layout of water supply lines, measures can be taken to locate equipment sensibly. The location of all shutoff valves should be clearly visible or at least clearly documented, and responsible personnel should know the procedures to follow in case of emergency. To deal with both plumbing leaks and other sources of water, sensors are vital. Water sensors should be located on the floor of computer rooms, as well as under raised floors, and should cut off power automatically in the event of a flood.

Question 3
	A device that assures the delivery of electric power without interruption is a(n) __________. (13.7)
	A. GFCI B. HVAC C. GPS D. UPS

To deal with brief power interruptions, an uninterruptible power supply (UPS) should be employed for each piece of critical equipment. The UPS is a battery backup unit that can maintain power to processors, monitors, and other equipment for a period of minutes. UPS units can also function as surge protectors, power noise filters, and automatic shutdown devices when the battery runs low. For longer blackouts or brownouts, critical equipment should be connected to an emergency power source, such as a generator. For reliable service, a range of issues need to be addressed by management, including product selection, generator placement, personnel training, testing and maintenance schedules, and so forth.

Question 4
	What are the benefits of security awareness, training and education programs for a organisation? (14.1)
	A. Improving employee behavior B. Increasing the ability to hold employees accountable for their actions C. Mitigating liability of the organization for an employee's behavior D. Complying with regulations and contractual obligations E. All of the above

1. Improving employee behavior
2. Increasing the ability to hold employees accountable for their actions
3. Mitigating liability of the organization for an employee's behavior
4. Complying with regulations and contractual obligations

Question 5
	At its core, a(n) __________ policy is a document that outlines the protections that should be enacted to ensure that the organization’s assets face minimal risks. (14.3)
	A. Safety B. Acceptable use C. Change management D. Security

An organizational security policy is a formal statement of the rules by which people that are given access to an organization's technology and information assets must abide.

Question 6
	Which of the following are reasons why organisations would have a email and internet use policy? (14.7)
	A. Stop work time being consumed through non-work-related activities B. Stop staff members looking at work related websites C. Stop staff members emailing organisation suppliers and or clients from outside the organisation D. None of the above

1. Significant employee work time may be consumed in non-work-related activities, such as surfing the Web, playing games on the Web, shopping on the Web, chatting on the Web, and sending and reading personal e-mail.

2. Significant computer and communications resources may be consumed by such non-work-related activity, compromising the mission that the IS resources are designed to support.

3. Excessive and casual use of the Internet and e-mail unnecessarily increases the risk of introduction of malicious software into the organization's IS environment.

4. The non-work-related employee activity could result in harm to other organizations or individuals outside the organization, thus creating a liability for the organization.

5. E-mail and the Internet may be used as tools of harassment by one employee against another.

6. Inappropriate online conduct by an employee may damage the reputation of the organization.