CSI Security Policies & Procedures 2

Question 1

Which document typically defines the acceptable use of an organization's information systems and assets?

Accepted Answer

Acceptable Use Policy

Answer

An Acceptable Use Policy (AUP) formally defines how employees may use organizational IT resources and assets.

Question 2

A 'clean desk policy' in a security context is primarily designed to:

Accepted Answer

Prevent unauthorized access to sensitive information left in plain view

Answer

Clean desk policies require employees to secure sensitive documents and lock screens when away, preventing unauthorized information access.

Question 3

When a security policy conflicts with an employee's job function, the proper course of action is to:

Accepted Answer

Seek a formal policy exception or waiver through appropriate channels

Answer

Formal exception processes allow legitimate operational needs to be accommodated while maintaining documented governance oversight.

Question 4

Which type of security control is a policy that requires dual authorization for high-risk transactions?

Accepted Answer

Preventive control

Answer

Dual authorization requirements are preventive controls because they stop unauthorized actions before they occur.

Question 5

A 'separation of duties' policy is most effective at preventing:

Accepted Answer

Insider fraud and collusion

Answer

Separation of duties ensures no single individual can complete a fraudulent transaction alone, making insider fraud much harder to commit.

(CSI) Certified Security Investigator Practice Test