IMST Information Security & Risk Management 2 — Questions and Answers
Question 1: What is 'role-based access control' (RBAC)?
- Granting access based on an individual's physical location
- A model where access permissions are assigned to roles, and users are granted access by being assigned to appropriate roles (Correct answer)
- An access control system based on data sensitivity labels
- A method of controlling access based on time of day
Correct answer: A model where access permissions are assigned to roles, and users are granted access by being assigned to appropriate roles
RBAC assigns permissions to job roles rather than individuals, so users automatically receive the access rights associated with their organizational role.
Question 2: What is a 'risk register' in information security management?
- A list of approved vendors for security software
- A document that records identified risks, their likelihood, impact, owners, and treatment plans (Correct answer)
- A log of all security incidents that have occurred
- A register of employees who have completed security training
Correct answer: A document that records identified risks, their likelihood, impact, owners, and treatment plans
A risk register is a centralized record of all identified information risks, including their assessment, priority, responsible owner, and the controls or mitigation actions planned or in place.
Question 3: What does 'encryption' protect in information management?
- It prevents unauthorized users from accessing the system
- It transforms data into an unreadable format so that only authorized parties with the decryption key can read it (Correct answer)
- It backs up data to prevent loss
- It detects and removes malware from stored files
Correct answer: It transforms data into an unreadable format so that only authorized parties with the decryption key can read it
Encryption converts plaintext data into ciphertext using an algorithm and key, ensuring that even if data is intercepted or stolen, it is unreadable without the correct decryption key.
Question 4: What is the principle of 'least privilege' in information security?
- Providing all employees with maximum access to improve productivity
- Granting users only the minimum access rights necessary to perform their job functions (Correct answer)
- Restricting data access to senior management only
- Using unprivileged accounts for all administrative tasks
Correct answer: Granting users only the minimum access rights necessary to perform their job functions
The principle of least privilege limits user access rights to only what is required for their specific job duties, reducing the risk of accidental or malicious data compromise.
Question 5: What is a 'Business Continuity Plan' (BCP)?
- A strategic plan for organizational growth and expansion
- A documented plan for maintaining or restoring essential business operations during and after a disruption (Correct answer)
- A financial plan for surviving an economic recession
- An IT disaster recovery script for restoring server backups
Correct answer: A documented plan for maintaining or restoring essential business operations during and after a disruption
A BCP outlines the processes and procedures to ensure that critical business functions can continue during and after a disaster, minimizing downtime and data loss.
Question 6: What type of security control is employee security awareness training?
- Technical control
- Physical control
- Administrative (managerial) control (Correct answer)
- Detective control
Correct answer: Administrative (managerial) control
Security awareness training is an administrative (managerial) control—a policy, procedure, or process designed to reduce human-related security risks.
IMST Information Security & Risk Management 2
What is 'role-based access control' (RBAC)?